Underhanded C Contest 2015: Sabotaging Nuclear Warhead Verification with NaN Tricks

The 2015 Underhanded C Contest challenged entrants to write C code that looks correct but secretly betrays its purpose — this year in a nuclear-verification scenario built with the Nuclear Threat Initiative, where a warhead-comparison routine had to be tricked into producing false positives. Of the 40-plus high-quality submissions, roughly a third converged on the same weapon: NaN poisoning. Because a floating-point NaN propagates through arithmetic and makes every comparison evaluate to false, a coder can arrange for weird input to divide by zero or take sqrt of a negative, then let the resulting NaN slip past a threshold check so that a non-match is silently reported as a match.

The writeup dissects several clever variants: clamping values so a correlation resolves to 0/0, an error-checking routine deliberately broken by omitting an ampersand so the flag is passed by value instead of reference, and a parser that memsets arrays to 0xFF and relies on unparseable Unicode ‘digits’ to leave a bit pattern that is itself a NaN. Most NaN entries were disqualified for being too brazen — an unchecked floating-point division stands out on review the way a toddler with a steak knife does — or for assuming the host country could simply corrupt the input.

The judges weighed realism heavily: a winning bug must trigger a false positive under plausible conditions yet almost never fire by accident. They sorted attacks into data-triggered (a crafted test spectrum) and environment-triggered (tampering with the system clock or CPU count), the latter shown in parallelized match() functions that misbehave when the number of available processors changes mid-computation. The piece is a compact lesson in how subtle, deniable sabotage hides in ordinary-looking numerical code — a warning that matters most exactly where software rigor is scarcest.