6 ms·
Much harder to write compilers for, though.
by msla 8y ago
Much harder to write compilers for, though.
- pjmlp 8y agoSure, but that was already a solved problem outside Bell Labs, at least by reading IBM papers and interviews with well known compiler implementers from the 60 - 80's.
- walshemj 8y agoAnd PR1ME used pl1 as its system programming language
- graycat 8y agoOkay, okay, I give up; you win! I used to be a Prime customer and was going to post that! Gotta type fast at HN or get scooped! And what was the role of PL/I in Multics?
- unused0 8y agoThe bulk of Multics is written in PL/I. See https://multicians.org/pl1.html https://multicians.org/pl1.html for details.
- pjmlp 8y agoNot the OP, but you can find quite a good collection of info at https://www.multicians.org/ https://www.multicians.org/, specially interesting is the B2 Security Evaluation (https://www.multicians.org/b2.html https://www.multicians.org/b2.html) with the pearl that none of the UNIX known exploits, possible due to C's lack of safety where possible to take advantage of on Multics, thanks PL/I.
- unused0 8y agoSadly, a buffer overflow attack has been found; it is possible to write bad PL/I. (The defective code is a user-space tool, so at best, a remote code exploit. No privilege escalation.)
- pjmlp 8y agoAny public info about it?
- unused0 8y agoA writeup is on my round tuit list; some day soon. PL/I does bounds checking on arrays, but not on pointers. The Kermit server allocated an insufficiently large buffer to decompress packets into, and used ptrs to write to the buffer. (Errors 1 and 2: allocation and ptrs) Later in the code, there is a 'goto state(idx)' construct, with a declaration like 'dcl state (0:6) label init (state0, state1, ....);'. Which label is jumped to depends on the value of idx. The 'state' variable was not declared to be state (error 3), so the table is in writable memory, and due to whatever circumstances, is above the decompress buffer. A correctly crafted packet, when decompressed, will write over the end of the buffer and onto the state array. Later, when the goto is executed, the address transferred has been changed. It is not the case that a transfer can be made into the decompress buffer, as it is not in an executable segment, there are lots of places that could be transferred to, leaving open the possibility of an exploit. The error was discovered when a particular file transfer would reliably crash the kermit server, and analysis of the crash uncovered the coding errors.
- pjmlp 8y agoThanks for sharing. I always find such stories interesting.
- walshemj 8y agoI did not know that PL/1 was used in Multics but I did know that Prime did develop from it. At one point I did have Level 6 (root) on all of BT's primes and level 7 on the billing systems.
- graycat 8y agoYes, when I was at IBM's Watson lab working in KnowledgeTool, a PL/I pre-processor (using some of Deremer's work, our software did fully parse the KnowledgeTool source and, thus, also PL/I), I got to chat with George Radin, essentially the father of PL/I. For a while I was teaching computer science in the business school at Georgetown and taught a start on PL/I, e.g., enough to do quicksort.