3 ms·

Are there similar projects which markup C to safer-C ? I remember seeing something similar but i cant find it. Somehow, it analyzes C code and produced C code

by yazr 8y ago

Are there similar projects which markup C to safer-C ? I remember seeing something similar but i cant find it. Somehow, it analyzes C code and produced C code with safe pointers, etc. Can someone please help ? Thanks (Not ASAN or binary-instrumentation projects)

nickpsecurity 8y ago
I dont recall transpilers but SAFEcode and Softbound+CETS aim to make C memory safe with compiler transformations. The first was used on an OS, too.
krupan 8y ago
Maybe not exactly what you are asking for: https://dlang.org/blog/2017/08/23/d-as-a-better-c/ https://dlang.org/blog/2017/08/23/d-as-a-better-c/
duneroadrunner 8y ago
Not sure if it's what you're thinking of, but there is the "C to SaferCPlusPlus" auto-translation helper tool[1]. The idea is that the output can be compiled as straight C, with the safety mechanisms disabled, or with the (compile-time and run-time) safety mechanisms enabled, which requires compilation as C++. The tool is currently being neglected, and at the moment it mostly just translates native arrays, and pointers that are being used as array iterators. I say "just", but actually it addresses what I believe to be (by far) the most difficult issue, which, as other commenters have mentioned, is determining in the general case whether a pointer is actually being used as an array iterator. And it also determines whether that array is a fixed-size array or a (potentially) resizable array. For example, in this code snippet: void foo1(int *p, int n) { foo2(p, n); } does p point into an array, or just at an int? You have to deduce it from context. And there's no theoretical limit to the amount of deduction you might need to do. The tool doesn't automatically translate regular "non-array" pointers yet, but that can be a straightforward task as the SaferCPlusPlus library has a safe, general drop-in replacement for pointers. Translating to "performance optimal" safe pointers is another story. There you have challenges similar to translating to safe Rust I think. [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...

by yazr 8y ago

nickpsecurity 8y ago

I dont recall transpilers but SAFEcode and Softbound+CETS aim to make C memory safe with compiler transformations. The first was used on an OS, too.

krupan 8y ago

Maybe not exactly what you are asking for: https://dlang.org/blog/2017/08/23/d-as-a-better-c/ https://dlang.org/blog/2017/08/23/d-as-a-better-c/

duneroadrunner 8y ago

Not sure if it's what you're thinking of, but there is the "C to SaferCPlusPlus" auto-translation helper tool[1]. The idea is that the output can be compiled as straight C, with the safety mechanisms disabled, or with the (compile-time and run-time) safety mechanisms enabled, which requires compilation as C++. The tool is currently being neglected, and at the moment it mostly just translates native arrays, and pointers that are being used as array iterators. I say "just", but actually it addresses what I believe to be (by far) the most difficult issue, which, as other commenters have mentioned, is determining in the general case whether a pointer is actually being used as an array iterator. And it also determines whether that array is a fixed-size array or a (potentially) resizable array. For example, in this code snippet: void foo1(int *p, int n) { foo2(p, n); } does p point into an array, or just at an int? You have to deduce it from context. And there's no theoretical limit to the amount of deduction you might need to do. The tool doesn't automatically translate regular "non-array" pointers yet, but that can be a straightforward task as the SaferCPlusPlus library has a safe, general drop-in replacement for pointers. Translating to "performance optimal" safe pointers is another story. There you have challenges similar to translating to safe Rust I think. [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...