5 ms·

Buffer overflows. That's far from perfect. It's much too easy to produce buffer overflows in C, be it due to the design of C strings or just because of the man

by bhaak 8y ago

Buffer overflows. That's far from perfect. It's much too easy to produce buffer overflows in C, be it due to the design of C strings or just because of the manual handling of dynamic memory.

sebcat 8y ago
The BERI CPU, the CHERI ISA and CheriBSD has an interesting approach to this, where they have capability-based addressing at the pointer level, supported by hardware. https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
simion314 8y ago
There is no String class,type in C. You could create a String and make it safe but slower, you need to keep in mind when C was created and for what purpose was it created.
- pjmlp 8y ago
  When C was created there was already 10 years experience writing safe OSes in ESPOL, NEWP, PL/I, PL/S, Mesa, BLISS and a couple of other variants, outside Bell Labs. The big difference was that those OSes versus UNIX costed real money.
  - simion314 8y ago
    So those OS were great but nobody wanted to pay for the greatness? I am not that old so I do not know that history but in University we learned programming with C because the hardware and C are close. Any idea why there was no popular safe array or safe string library for C? Maybe at that time there was no internet and everyone had to create his own abstractions?
    - pjmlp 8y ago
      Some of those OS are still being sold, like IBM i, IBM z and Unisys ClearPath MCP. Bell Labs was forbidden to sell their research, so they offered UNIX for a symbolic price to universities (vs what other OS used to cost), alongside source code tapes and a liberal license. This gave birth to several startups that tried to create a business using UNIX instead of the alternatives, given the authors experience with UNIX at the university, e.g. Sun and SGI among others. Later when the US goverment dictated AT&T split, AT&T was allowed to charge for UNIX and that is when they decided to go after BSD, because 10 years later, under such conditions, UNIX was slowing eating mainframes, given the success of Sun, SGI, Aix, .... There are no safe array or safe string libraries, because they all fall appart under scrutiny, given C's approach to secure code.
      - simion314 8y ago
        >There are no safe array or safe string libraries, because they all fall appart under scrutiny, given C's approach to secure code. I do not understand, maybe give an example. About the history I am not sure that proves that UNIX and C advantage was only because of that, it could be a factor but there are merits to C and UNIX that if you want to disprove you can;t just do it by mentioning that history. I mean Windows API used C.
        pjmlp 8y ago
        > I do not understand, maybe give an example. Because since those libraries are not built-in types, you always need to convert back to a ptr and length values at some point when interoperating with other C code. And given the lack of bounds checking, you are back at square one. > I mean Windows API used C. Windows API used C, because by the time Windows came around UNIX was already well established in the enterprise. C spread outside UNIX, because many of us were using C dialects, e.g. Small-C, on personal computers when bringing work home from job/university.
        jstimpfle 8y ago
        > Because since those libraries are not built-in types, you always need to convert back to a ptr and length values at some point when interoperating with other C code. And that's exactly why C wins, in my opinion. Because that means interoperability. Storing a pointer + length pair in a fixed layout struct is bad from a normalization standpoint. They are independent data. If you don't separate them you will end up with data redundancies as soon as you have parallel arrays. If you use dynamic vectors and in C++ or similar languages and you ask yourself which is the object that you should call .size() on, that's when you notice that it's morally wrong to bundle pointer + length.
- bhaak 8y ago
  I didn't say class or type but "C strings". You can't rip them out and replace them with something better without massive code legacy issues. And then you still haven't dealt with other sources of buffer overflows in C.
  - simion314 8y ago
    There are no C strings, there are C arrays that can be made to be of char data. C++ has a string type , Qt has a QString type and you can inter-operate with code that wants C char array. If you were creating the C language and compiler at that time with that hardware would have you not implemented pointers and created Java ?
enriquto 8y ago
Buffer overflows of your own data are your responsibility. The main problem is that there is no effective way in the language to control (prevent, or at least detect) stack overflows. For example, when you reach a recursion limit or when you allocate too many automatic variables. For scientific computing, the ability to fearlessly declare a local matrix like "float A[n][n];" for arbitrary values of "n" would be invaluable.

by bhaak 8y ago

Buffer overflows. That's far from perfect. It's much too easy to produce buffer overflows in C, be it due to the design of C strings or just because of the manual handling of dynamic memory.

sebcat 8y ago

The BERI CPU, the CHERI ISA and CheriBSD has an interesting approach to this, where they have capability-based addressing at the pointer level, supported by hardware. https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

simion314 8y ago

There is no String class,type in C. You could create a String and make it safe but slower, you need to keep in mind when C was created and for what purpose was it created.

pjmlp 8y ago
When C was created there was already 10 years experience writing safe OSes in ESPOL, NEWP, PL/I, PL/S, Mesa, BLISS and a couple of other variants, outside Bell Labs. The big difference was that those OSes versus UNIX costed real money.
- simion314 8y ago
  So those OS were great but nobody wanted to pay for the greatness? I am not that old so I do not know that history but in University we learned programming with C because the hardware and C are close. Any idea why there was no popular safe array or safe string library for C? Maybe at that time there was no internet and everyone had to create his own abstractions?
  - pjmlp 8y ago
    Some of those OS are still being sold, like IBM i, IBM z and Unisys ClearPath MCP. Bell Labs was forbidden to sell their research, so they offered UNIX for a symbolic price to universities (vs what other OS used to cost), alongside source code tapes and a liberal license. This gave birth to several startups that tried to create a business using UNIX instead of the alternatives, given the authors experience with UNIX at the university, e.g. Sun and SGI among others. Later when the US goverment dictated AT&T split, AT&T was allowed to charge for UNIX and that is when they decided to go after BSD, because 10 years later, under such conditions, UNIX was slowing eating mainframes, given the success of Sun, SGI, Aix, .... There are no safe array or safe string libraries, because they all fall appart under scrutiny, given C's approach to secure code.
    - simion314 8y ago
      >There are no safe array or safe string libraries, because they all fall appart under scrutiny, given C's approach to secure code. I do not understand, maybe give an example. About the history I am not sure that proves that UNIX and C advantage was only because of that, it could be a factor but there are merits to C and UNIX that if you want to disprove you can;t just do it by mentioning that history. I mean Windows API used C.
      - pjmlp 8y ago
        > I do not understand, maybe give an example. Because since those libraries are not built-in types, you always need to convert back to a ptr and length values at some point when interoperating with other C code. And given the lack of bounds checking, you are back at square one. > I mean Windows API used C. Windows API used C, because by the time Windows came around UNIX was already well established in the enterprise. C spread outside UNIX, because many of us were using C dialects, e.g. Small-C, on personal computers when bringing work home from job/university.
        jstimpfle 8y ago
        > Because since those libraries are not built-in types, you always need to convert back to a ptr and length values at some point when interoperating with other C code. And that's exactly why C wins, in my opinion. Because that means interoperability. Storing a pointer + length pair in a fixed layout struct is bad from a normalization standpoint. They are independent data. If you don't separate them you will end up with data redundancies as soon as you have parallel arrays. If you use dynamic vectors and in C++ or similar languages and you ask yourself which is the object that you should call .size() on, that's when you notice that it's morally wrong to bundle pointer + length.
bhaak 8y ago
I didn't say class or type but "C strings". You can't rip them out and replace them with something better without massive code legacy issues. And then you still haven't dealt with other sources of buffer overflows in C.
- simion314 8y ago
  There are no C strings, there are C arrays that can be made to be of char data. C++ has a string type , Qt has a QString type and you can inter-operate with code that wants C char array. If you were creating the C language and compiler at that time with that hardware would have you not implemented pointers and created Java ?

enriquto 8y ago

Buffer overflows of your own data are your responsibility. The main problem is that there is no effective way in the language to control (prevent, or at least detect) stack overflows. For example, when you reach a recursion limit or when you allocate too many automatic variables. For scientific computing, the ability to fearlessly declare a local matrix like "float A[n][n];" for arbitrary values of "n" would be invaluable.