10 ms·

Memory Issues: Episode III - Revenge Of The Buffer Overflow (2016) In all seriousness, repeated occurrences such as these should make people consider other lan

• pjmlp 10y ago
  The sad part is that already in the mid-60's and 70's, in computers much less powerful than the PDP-11, bounds checking wasn't a problem as such. In the few cases where it was a real problem for the application being written, it could be selectively disabled. Which according to C.A.Hoare in his 1981 speech, most people didn't want to do anyway. It only became a problem in the industry thanks to C.
  • krylon 10y ago
    Having written C for a living for about two years, I have to admit that a large part of me really likes C. But also, I would have commited unspeakable acts just to have a compiler switch to enable bounds checking, no matter how badly that would have affected performance. Even when one knows what one is doing - or thinks so, anyway - these errors are so easy to sneak in and such a pain to track down. (Especially since we were using OpenWatcom whose debugger did not show useful data when the program crashed, which is usually the time one needs it the most...)
    • ghrifter 10y ago
      Just curious - what do you do for a living that means you have to write C? I'm interested in really learning C or C++ more indepthly. I feel like I am very proficient in high level programming knowledge (other than design patterns). Basically, when or if the web dev industry falls out, I want to have a good back up of knowing low-level languages.
      • stephen_g 10y ago
        Anything in embedded systems. I write code for high performance satellite terminal (ground side) and also point-to-point radio systems (ultra-low latency, millimetre wave stuff). 90% of the code I write is in C, about 60% of the time on microcontrollers with <256KB of RAM, and the rest in a cut-down Linux running on an ARM Cortex A8. I'd actually prefer to use C++ for the Linux stuff (std::string, smart pointers and STL containers would save me so much time), but we don't have the C++ standard library in our custom distro.
        • nickpsecurity 10y ago
          Did you or anyone else try Ada or especially SPARK for you application? What were the gripes if so? Btw, since you're in embedded, what do you think about the potential for this Oberon IDE I found custom-designed for embedded? http://www.astrobe.com/Oberon.htm http://www.astrobe.com/Oberon.htm I imagine that, like with Modula's, you could probably turn off safety features where you needed for performance or real-time. I haven't confirmed it, though.
        • ghrifter 10y ago
          Interesting, thanks! If you dont mind, can you give me a rough estimate for your yearly salary or so? How long have you been programming in C?
      • Niksko 10y ago
        Probably embedded stuff. Web dev will probably die down, and with robots and automation and IoT becoming more prevalent, embedded programming will probably become popular. But hopefully by then embedded devices won't force us to us languages like C or C++. If the manufacture of embedded platforms scales up enough (more than it already has) then maybe we'll get devices with gigabytes of ram and insanely fast processors, so we can just write code in whatever language we like and have it be performant. A pipe dream maybe, but it wasn't that long ago that people were exclusively writing in assembler when performance was critical.
        • pjmlp 10y ago
    • PeCaN 10y ago
      > I would have commited unspeakable acts just to have a compiler switch to enable bounds checking -fsanitize=bounds in GCC6 (probably recent Clang also). Runtime overhead isn't even that high. Lately I've been trying to use Ada for things I would use C for—it's quite a nice language that gives you all the power of C but safe by default (i.e. you generally have to try to shoot yourself in the foot). Also concurrency in Ada doesn't consist of “sacrifice kittens to Cthulhu and pray that it works”, which is a nice feature.
      • ashitlerferad 10y ago
        I'm not sure about the bounds sanitiser, but the address sanitiser is not meant to be used as a hardening mechanism and allows trivial exploits: http://seclists.org/oss-sec/2016/q1/363 http://seclists.org/oss-sec/2016/q1/363
    • GregBuchholz 10y ago
      http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf https://en.wikipedia.org/wiki/Cyclone_%28programming_language%29 https://en.wikipedia.org/wiki/Cyclone_%28programming_languag... http://elinux.org/Electric_Fence http://elinux.org/Electric_Fence http://valgrind.org/ http://valgrind.org/ https://github.com/google/sanitizers https://github.com/google/sanitizers https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#C.2C_C.2B.2B https://en.wikipedia.org/wiki/List_of_tools_for_static_code_...
      • krylon 10y ago
        Thanks! I had used valgrind before on a toy project to find memory leaks, but I had not used any of the other tools it offers. I remember that back then it did not work terribly well for bounds checking, but that was years ago. 2009-ish. Electric Fence I have heard of before, but I never tried it. I will definitely come back to these links when I am working in C the next time.
  • ams6110 10y ago
    It wasn't a problem in assembly language? Which was widely used before C became popular.
  • ArkyBeagle 10y ago
    No, it became a problem when 1) microprocessors evolved into being able to do real work 2) Vast hordes of the great unwashed (I'd say even including me ) were vacuumed into the resulting void and 3) tools vendors for languages with better safety furniture were found wanting. Delphi existed but was found wanting. Ada ads were in the back of oh so many magazines. But... And I'd throw in 4) - the CS industrial complex failed to address this except to rail against it. The first CACM I ever got was the one with "Reflections on trusting trust." If a Haskell or Rust is the answer, it needs to be more interesting. And if you say "but Java", name your second; I will meet you on the field of honor at dawn :) I personally found "nobody is going to save you; you are on your own" very liberating but perhaps that is unusual. "In order to live outside the law, one must be honest." - Bob Dylan.
• Someone1234 10y ago
  I too love C. I'd almost go so far as to say you need to do a security review before you write one line of code. You need to evaluate if C is a requirement or a preference, and if the security of the project can withstand being written in C (e.g. edge code that may be attacked). The argument that C (and C++) can be written well or flawlessly is tiresome. "Perfect code" is a fallacy that has been proven over and over again to be untrue and dangerously untrue. You should assume the code quality is less than optimal as your starting point. I am not promoting any specific alternative (Rust, Java, Go, etc) I am just saying that C/C++ are insecure by design and should be avoided unless they're a project requirement.
  • robert-wallis 10y ago
    This sounds like a witch hunt. Java has horrible security bugs even today. Bugs can be found in code written in all languages.
    • iso-8859-1 10y ago
      Java removed certain classes of errors (memory management). It introduced other (providing an insecure sandbox for applets).
      • wolf550e 10y ago
        I think code execution by insecure deserialization is the big Java security problem now, though I'm neither a security guy nor a Java guy.
      • lmm 10y ago
        It's not like C applets are safer.
        • PeCaN 10y ago
          If we consider NaCl to be "C applets"... yes, it actually is safer.
    • 10y ago
• frewsxcv 10y ago
  In case anyone wants to learn about an effort to incrementally port some of the BoringSSL (fork of OpenSSL) primitives to Rust: https://github.com/briansmith/ring https://github.com/briansmith/ring If anyone is looking to contribute and wants a "good first task", here are some tasks: https://github.com/briansmith/ring/issues?q=is%3Aopen+is%3Aissue+label%3Agood-first-bug https://github.com/briansmith/ring/issues?q=is%3Aopen+is%3Ai... Help is greatly appreciated :)
  • lambda 10y ago
    Of particular interest here is also webpki: https://github.com/briansmith/webpki https://github.com/briansmith/webpki Which is designed to validate TLS certificates. This is doing the ASN.1 parsing and signature verification in a zero-copy, memory safe way, built on top of ring for the core crypto primitives. Now, this isn't a full implementation of what you would need for replacing OpenSSL for certificate handling (and also isn't yet complete); in particular, this is extremely limited in scope as only being for client-side certificate verification. This particular OpenSSL issue was when parsing and re-encoding certificates, which is out of scope for webpki. But it is a good starting point for demonstrating memory-safe and efficient handling of complex tasks like parsing and verifying of TLS certificates.
• sebcat 10y ago
  Maybe the machine is at fault? Maybe the problem is not with C, but with a hardware architecture that does not offer finer granularity than page allocations? What if everything returned from malloc() would be bound checked by hardware? What if, instead of overwriting a malloc_chunk or the saved value of the instruction pointer, a hardware interrupt would be raised? Maybe the return stack and the parameter stack can be separate? Maybe someone solved these problems in hardware before the majority of us was born?
  • lmm 10y ago
    That wouldn't help. GCC would just compile code that turns off those features, since that would help it do better on benchmarks.
    • sebcat 10y ago
      Those "features" would be built into the platform. Instead of having the return stack and the parameter stack share memory space, the stacks would be kept separate by design. Instead of having malloc_chunks, the MMU would keep allocation metadata separate from the data presented to the user space. Any process overwriting an allocation would result in a segmentation fault, not on a per-page basis but on a per-allocation basis. It would be enforced by the architecture. It would not be optional. It would be by design.
      • ThisIs_MyName 10y ago
        http://yosefk.com/blog/the-high-level-cpu-challenge.html http://yosefk.com/blog/the-high-level-cpu-challenge.html
    • Sanddancer 10y ago
      To those downvoting lmm, look up C11 Annex K. There are standards for adding bounds checking and the like to C, but compiler makers don't implement them because they're "too slow." We need to demand more of our tooling makers.
  • ThisIs_MyName 10y ago
• osweiller 10y ago
  While C (and its love-child C++) bizarrely appears high in most synthetic programming popularity rankings, I personally doubt more than 5% of developers (if that) ply their days in it, or have more than a passing competency in it. Everyone is programming in Java, C#, JavaScript, and so on. Aside from myself, I haven't a single professional peer who develops on C (anecdotal, of course, but this is a pretty big net crossing multiple cities and industries) in any real way. It just happens to be that much of the most important software is written in it. Maybe there's something in that.
  • tracker1 10y ago
    I wouldn't minimize the amount of C(++), or the amount of mis-counting for jobs where C(++) is a desired skill, but not primary in the job role. There are a lot of jobs out there working on embedded systems where C/C+ are king. Though I do hope that Rust gains more traction in that space to avoid certain classes of bugs. I would guess that most development involves JS, as I would say that most development is directed in web applications of some kind. Though there are backend languages as well. For the types of development jobs I'm used to looking for, I see a lot more C# and Java, with some uptick in Node and Python. Excluding PHP (because shiver). I have several friends who work in the embedded space, and that is not small by any means.
  • PeCaN 10y ago
    I developed most of my hobby projects in C until recently. It's not as rare as you think. C is a good language to think in. Lately I've been switching to Ada, which I actually quite recommend if you like C. Shame it never really caught on, but using C libraries from Ada is trivial so there's not much of a library issue in spite of lack of popularity.
    • osweiller 10y ago
      ~5% of developers, while small compared to the whole, still encompasses about a million of the estimated 20 million developers worldwide. The other poster rightly mentioned the embedded space, and that is absolutely true (and indeed it is where I gained my affinity for C and C++), however there are easily 20 middleware / web / mobile developers for every embedded developer.
• ArkyBeagle 10y ago
  And I think the difficulty of manual memory management is vastly overrated. A bug is a bug is a bug. If OpenSSL is ... safety critical, then it should be treated as safety critical going forward. Tools don't make bugs, people make bugs. Of course, someone's free to write a replacement for OpenSSL in Rust and see how far that goes. FWIW, there used to be a rich suite of very respectable ASN.1 verification tools, at least the subset of ASN.1 used in SNMP.
  • masklinn 10y ago
    > I think the difficulty of manual memory management is vastly overrated. And your line of thinking is why we're going on 50 years of empirical evidence that people are terrible at manual memory management, and as with politics there's a pretty small common subset between those who believe themselves competent and those which should be trusted with it. > A bug is a bug is a bug. An error message is not a misprint is not a denial of service is not a DB penetration is not a crypto break is not a network ownage. "A bug is a bug is a bug" as long as your code is not used by anybody or trusted with anything.
    • ArkyBeagle 10y ago
      Manual memory management can be done safely and economically. This really is as simple as "the thing in the loop which has agency is the human, so the buck stops there." And a bug is still a bug is still a bug. This is not even a single point of failure; it's an ecosystem failure.
      • outworlder 10y ago
        It is cheaper still to do automatic memory management.
        • ArkyBeagle 10y ago
          Calculated exactly how and in what context? :) I'd agree in cases - <vector> in C++ don't cost much. It "delete()s" upon going out of scope.