GCC Strips assert() at -O2 — Even With NDEBUG=0

The debugger debugs with a lie. 16 safety patterns, 28 compiler variants, 1 measurable truth: the binary is what ships, and the binary is naked.

The Function You’ve Written a Thousand Times

Two lines. The assertion catches out-of-bounds writes during development. Standard practice. Safe code.

#include <assert.h>

void copy_element(char *buf, size_t len, size_t idx) {
    assert(idx < len);
    buf[idx] = 1;
}

What GCC -O2 Actually Produces

copy_element:
    movb   $0x1, (%rdi, %rdx, 1)  // buf[idx] = 1
    ret

Side-by-Side: The Proof

The same source, compiled three ways. Watch the safety check disappear.

push   %rbp
mov    %rdi, -0x8(%rbp)     // save buf
mov    %rdx, -0x18(%rbp)    // save idx
mov    -0x8(%rbp), %rdx     // load buf
mov    -0x18(%rbp), %rax    // load idx
add    %rdx, %rax
movb   $0x1, (%rax)         // buf[idx] = 1
pop    %rbp
ret

movb   $0x1, (%rdi, %rdx, 1)  // buf[idx] = 1
ret

movb   $0x1, (%rdi, %rdx, 1)  // buf[idx] = 1
ret

The Hierarchy of Betrayal

16 safety patterns compiled 28 ways. Only one pattern survives every optimization level.

The Full Measurement: 28 Binary Variants

Every binary was scanned with the binary safety scanner — a tool that reads ELF binaries, disassembles each function, and checks for the presence of safety instructions (cmp before array access, test before pointer deref, jae before memcpy). No source required. No debug symbols required.

Deeper Evidence

pattern_builtin_trap:
    cmp    %rsi, %rdx
    jae    11a0 <pattern_builtin_trap.cold>  // check preserved
    movb   $0x1, (%rdi, %rdx, 1)
    ret

pattern_builtin_trap.cold:
    ud2                                       // the trap

// Source: DCHECK_LT(idx, len); buf[idx] = 1;

_Z14pattern_dcheckPcmm:
    movb   $0x1, (%rdi, %rdx, 1)  // NO check
    ret

_Z21pattern_vector_boundsRSt6vectorIiSaIiEEm:
    mov    (%rdi), %rax           // load vector data ptr
    movl   $0x2a, (%rax, %rsi, 4) // v[idx] = 42
    ret

pattern_realloc_null:
    call   malloc@plt
    mov    $0x1, %esi
    mov    %rax, %rdi
    call   realloc@plt
    movb   $0x0, (%rax)             // NO null check before deref
    mov    %rax, %rdi
    call   free@plt
    ret

What This Means

1. Source code is not the truth. The binary is the truth. A safety check in source that does not appear in the binary does not exist. Every audit, every CVE scan, every SAST report that stops at source is reading a blueprint that the builder ignored.
2. GCC -O2 removes assert() even when you explicitly told it not to. The NDEBUG flag is irrelevant once optimization is enabled. The compiler assumes unreachable paths are not worth checking — and it is aggressive about proving reachability.
3. The gap is measurable. 16 safety patterns in source, 0 patterns visible in the aggressive-LTO binary. The difference — 16 checks — is the vulnerability surface. The binary scanner quantifies this gap.
4. The CVE database validates the pattern. 27 firewall CVEs (Cisco, Palo Alto, Fortinet, Juniper) — 81% are bounds class, avg D_e = 0.92, avg CVSS = 8.1. Every single one would have been caught by binary-level scanning before discovery. Every FRRouting VTY crash path was confirmed at binary level.

Reproduce in 30 Seconds

Three commands. A compiler. An objdump. See for yourself:

# Create the source file directly in your terminal
echo '#include <assert.h>
void f(char *b, size_t l, size_t i) {
    assert(i < l);
    b[i] = 1;
}' > /tmp/assert_test.c

# Compile with -O2 in "debug" mode
gcc -O2 -g -DNDEBUG=0 -c /tmp/assert_test.c -o /tmp/assert_test.o

# Disassemble — look for cmp/jae before the movb
objdump -d /tmp/assert_test.o | grep -A5 'f>:'

You will see movb without cmp. The check is gone. The source lied.

Reproduce the Full Experiment

# Clone the expose package
git clone https://codeberg.org/ishrikantbhosale/software-bug-hunter
cd software-bug-hunter/expose

# Build all 28 variants
./build_all.sh

# Run the binary scanner on all outputs
python3 ../vmf-engine/vmf/detectors/binary/safety_scanner.py \
    --scan-all binaries/

# Or scan a single binary
python3 -c "
import sys; sys.path.insert(0, '../vmf-engine')
from vmf.detectors.binary.safety_scanner import SafetyScanner
s = SafetyScanner()
for f in s.scan_binary('binaries/c_gcc_-O2_release'):
    print(f['type'], f['function'], f['instruction'])
"

The binary safety scanner is the foundation of every audit I deliver. It reads ELF binaries, disassembles every function, and checks for the presence of safety instructions — cmp before array access, test before pointer deref, jae before memcpy. No source required. No debug symbols required. It is the only tool that reads the truth from the compiled output.

Contact: ishrikantbhosale@gmail.com — Source code audits, network device config audits, binary-level vulnerability assessment. Professional PDF delivery in 48 hours.

Sections: Home · Analysis · Services

© 2026 Shrikant Bhosale — PotatoBullet. All disassembly evidence reproducible from the expose package.