This blog post examines divergent representations of the same source code variable produced by compiler optimizations. We’ll attempt to define divergent representations and look at the SQLite vulnerability we discovered, which was made easier to exploit by the divergent representation of a source code variable (one exhibiting undefined behavior). Use a variable that is defined by the Phi node’s defined variable (indicating that the node may affect a loop-control variable) Define a variable that is used in a downcasting operation (and is thus represented elsewhere as a narrower value) Use a variable that is assigned multiple sizes (i.e., a variable that may be represented as either 64 bit or 32 bit) Define a variable that is used in a subsequent 64-bit operation