| |||||||||||||
Are they using the right technology?Are they using the right technology?Posted May 25, 2012 4:03 UTC (Fri) by foom (subscriber, #14868)In reply to: Are they using the right technology? by ncm Parent article: A Tale of Two Pwnies (Part 1)
> A C++ or C compiler that generates code to check signed-integer overflow by default, and do anything at all [...] is completely standard-conforming
Nice trick you pulled there, slipped "signed" in! Yes, that's true about signed overflow, but *NOT* unsigned overflow. Which makes the whole safety thing rather half-baked...
> Gcc and Clang could have such a feature in no time
In fact, that option already exists in GCC:
Except, it doesn't work; it's been totally broken for over 5 years and nobody has stepped up to fix it yet.
(Log in to post comments)
Are they using the right technology? Posted May 28, 2012 6:52 UTC (Mon) by ncm (subscriber, #165) [Link]
Unsigned ints don't overflow. They implement well-defined modular arithmetic. No operations on unsigned int yield undefined results.
If anybody actually had any use for range-checked C, that mode in Gcc would work. Likewise, array bounds checking. The reason that people don't have any use for them is that they would fail to catch the overwhelming majority of overflow and overindexing bugs. A program that fails to keep a short int less than 32768 is a program that also fails to keep it below 10000. A program that overindexes its built-in arrays also overindexes variable-sized storage.
Are they using the right technology? Posted May 28, 2012 13:25 UTC (Mon) by nix (subscriber, #2304) [Link] Unsigned ints don't overflow. They implement well-defined modular arithmetic. No operations on unsigned int yield undefined results.... which, if unexpected, can be and often is a security hole. You haven't solved anything.
|
|||||||||||||