5 ms·

> But the problem is that the security concerns and fixes are all undefined here. No one in this sub-thread has mentioned (or implied) any "fix". You appear to

> But the problem is that the security concerns and fixes are all undefined here. No one in this sub-thread has mentioned (or implied) any "fix". You appear to be putting words in my mouth. > So the initial comment is still very right. Of course it's right, but it's also misleading when read in the context of the parent comment. > If you're relying on the padding to be anything in particular, you're in trouble. No shit.

Dylan16807 7y ago
> No one in this sub-thread has mentioned (or implied) any "fix". You appear to be putting words in my mouth. I'm talking about the comments hermitdev was replying to that were treating memset as a 'fix'. And 'fix' is shorthand for the opposite of "open[ing] you up to all kinds of info leaks". I don't think that's putting words in anyone's mouth.
- jcr1488 7y ago
  I guess we are misunderstanding each other's point. I just found hermitdev's comment to be misleading (despite being correct), but perhaps it's just my reading of it. To be fair though, memset() usually IS a fix. As mentioned by the kernel memzero_explicit() docs: > usually using memset is just fine (!) -- https://www.kernel.org/doc/htmldocs/kernel-api/API-memzero-explicit.html https://www.kernel.org/doc/htmldocs/kernel-api/API-memzero-e... A conforming C compiler can't just remove memset() as it pleases. The case that most often requires memzero_explicit() is when zeroing an object after destruction, because the compiler thinks it can statically determine that it's a dead store. It very rarely happens that a compiler elides a memset() used for initialization. I'm not sure why you seem to think that memset() can just be dropped at will for no reason whatsoever or that it's somehow always undefined behaviour.
  - saagarjha 7y ago
    A conforming C compiler can remove a memset that has no side effects.
    - jcr1488 7y ago
      You mean it can remove a memset() that doesn't cause the observable behaviour to change? For the sake of argument, can you show me some example code where it would be conforming to remove a memset() call? Preferably a realistic example and not a Google'd copypasta. Because it's all too easy to just regurgitate things you heard and think you understood, but no so easy to demonstrate it yourself.
      - nkurz 7y ago
        I agree that it would be rare for a memset() used for initialization to be removed, but this is a good recent paper that gives lots of examples of when stores are eliminated in practice: Dead Store Elimination (Still) Considered Harmful https://cseweb.ucsd.edu/~klevchen/yjoll-usesec17.pdf https://cseweb.ucsd.edu/~klevchen/yjoll-usesec17.pdf

Dylan16807 7y ago

> No one in this sub-thread has mentioned (or implied) any "fix". You appear to be putting words in my mouth. I'm talking about the comments hermitdev was replying to that were treating memset as a 'fix'. And 'fix' is shorthand for the opposite of "open[ing] you up to all kinds of info leaks". I don't think that's putting words in anyone's mouth.

jcr1488 7y ago
I guess we are misunderstanding each other's point. I just found hermitdev's comment to be misleading (despite being correct), but perhaps it's just my reading of it. To be fair though, memset() usually IS a fix. As mentioned by the kernel memzero_explicit() docs: > usually using memset is just fine (!) -- https://www.kernel.org/doc/htmldocs/kernel-api/API-memzero-explicit.html https://www.kernel.org/doc/htmldocs/kernel-api/API-memzero-e... A conforming C compiler can't just remove memset() as it pleases. The case that most often requires memzero_explicit() is when zeroing an object after destruction, because the compiler thinks it can statically determine that it's a dead store. It very rarely happens that a compiler elides a memset() used for initialization. I'm not sure why you seem to think that memset() can just be dropped at will for no reason whatsoever or that it's somehow always undefined behaviour.
- saagarjha 7y ago
  A conforming C compiler can remove a memset that has no side effects.
  - jcr1488 7y ago
    You mean it can remove a memset() that doesn't cause the observable behaviour to change? For the sake of argument, can you show me some example code where it would be conforming to remove a memset() call? Preferably a realistic example and not a Google'd copypasta. Because it's all too easy to just regurgitate things you heard and think you understood, but no so easy to demonstrate it yourself.
    - nkurz 7y ago
      I agree that it would be rare for a memset() used for initialization to be removed, but this is a good recent paper that gives lots of examples of when stores are eliminated in practice: Dead Store Elimination (Still) Considered Harmful https://cseweb.ucsd.edu/~klevchen/yjoll-usesec17.pdf https://cseweb.ucsd.edu/~klevchen/yjoll-usesec17.pdf