5 ms·
RFC: Enforcing Bounds Safety in C (-fbounds-safety)
- rwmj 3y agoBeen there! https://www.doc.ic.ac.uk/~phjk/BoundsChecking.html https://www.doc.ic.ac.uk/~phjk/BoundsChecking.html (adding gcc -fbounds-checking, in 1995). We didn't need special annotations.
- olliej 3y agoHow did you make struct TerribleArray { int count; int *elements; } correctly bounds check that elements was at least count elements long? and that indexing into elements is restricted to 0..<count?
- rwmj 3y agoIt's bounded by the size of the object, eg. the struct. You know this because it was either allocated with malloc or on the stack. There's a paper at the link (one of the most referenced on this topic) which explains everything in detail.
- classified 3y agoStrictly speaking, this wouldn't be C any more. But it would be a bit more memory-safe.
- znpy 3y agoC compilers have been doing stuff like that for decades… trivial example: many compilers will insert an implicit return statement if you don’t do that. Without this code execution would just continue to whatever function is in memory, if there’s one. And yet… it’s still considered c language.
- andreareina 3y agoI think they meant more the new syntax.
- carbotaniuman 3y agoImplementation extensions have been around for decades. This seems as C as it can get! Also, the compiler has license to replace UB with anything, might as well be helpful.
- SAI_Peregrinus 3y agoIt's still conforming C. It's not strictly conforming C, but no compiler extensions are. I'm not aware of any compiler that fully enforces strictly conforming C. It may not even be possible, since a strictly conforming program "shall not produce output dependent on any unspecified, undefined, or implementation-defined behavior"[1], which would require the compiler to reject any program that produces such output even though some cases can only be detected at runtime. And since strictly conforming programs can only use features of the language and standard library defined in the C standard, the compiler can't even insert runtime checks to exit the program if such behavior is encountered (since that would be a language extension). [1] C17 standard 4.5
- jjnoakes 3y agoExisting compilers that know nothing of the new annotations can still compile the code (without the checks obviously) using the macro definitions provided in the article.
- cryptonector 3y agoIf adopted by the C committees, would this then no longer "[not] be C any more"?
- TazeTSchnitzel 3y agoOut-of-bounds accesses are undefined behaviour. A compiler is free, within the bounds of the standard, to do whatever it wants for them, including doing dynamic checks.
- dataflow 3y agoKind of wish people would stop inventing new notation. There's already Microsoft SAL. Just use the existing annotations (like _In_reads_(N) here) instead of forcing people to adopt two of them their codebases! https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal https://learn.microsoft.com/en-us/cpp/code-quality/understan...
- nynx 3y agoYou’d think maybe they could make the annotations less ugly
- dataflow 3y agoWho's they? Both annotations seem ugly. And ugliness is hardly a reason to litter everyone's code with a parallel set of names.
- olliej 3y agoWhat is the ugliness you're talking about? They're clear and explicitly named so I'm not sure what you could change that would make things better
- shadowgovt 3y agoAfter Oracle v. Google, can a project consider a protocol designed by Microsoft safe to use even if they're doing their own implementation of the contract enforcement engine?
- sirwhinesalot 3y agoSo many years of effort that could have been avoided had C introduced wide pointers into the standard 24 years ago. This will fail like all the other annotation attempts have failed.
- pjmlp 3y agoTo see how much WG14 cares about security, note that they even ignored the language authors proposal.
- uecker 3y agoI do not think security was an issue at this time. I assume you mean this proposal: https://www.bell-labs.com/usr/dmr/www/vararray.pdf https://www.bell-labs.com/usr/dmr/www/vararray.pdf I like it and it is on my list to implement as a prototype for GCC. And WG14 takes security seriously, but I think you overestimate the power WG14 has to simply change things. WG14 is supposed to standardize existing practice, not reinvent the language. So you should complain to compiler vendors. Or contribute to the development of open-source compilers.
- pjmlp 3y agoI will believe that, when C finally gets at very least vocabulary types for safer strings and arrays, instead of reboots of functions with pointer/count. Plenty of compiler vendors have extensions for safer C. Microsoft introduced similar annotation mechanism like the one being discussed here when Windows XP SP 2 came to be, in 2001. Apparently 50 years weren't enough to make it happen. Contrast this with how WG21 looks into security and code safety, enough papers on the subject, specially after the cybersecurity bills started to come about.
- deleted 3y ago[deleted]