5 ms·
"When sk_rcvbuf gets close to 2^31, adding the size of the packet can cause an integer overflow. And since it’s an int it becomes a negative number, therefore t
by mcguire 6y ago
"When sk_rcvbuf gets close to 2^31, adding the size of the packet can cause an integer overflow. And since it’s an int it becomes a negative number, therefore the condition is true when it should be false (for more, also check out this discussion of signed magnitude representation)."
And this is why you don't generally use signed numbers in systems code, unless you specifically need negative numbers. And why you gradually develop a paranoia about the sizes of numbers.
- FreeFull 6y agoI'm not sure how using an unsigned number would help, given that when it overflows you're still going to have some code do unexpected stuff anyway.
- mcguire 6y agoFor one thing, it's a clue you need to step back and think, "What happens when this overflows?" rather than "Oh, it's just a number." For another, that's why you get paranoid. (For a third, I strongly recommend something like Frama-C with the Weakest-Precondition module---it's very good at finding issues like these.)
- sleepydog 6y agoI'm not convinced that it would have been any more obvious to the person who made the error that the variable could overflow if it were unsigned. It's also much easier, IMO, to accidentally underflow an unsigned integer; it's so much more common to work with 0 than it is to work with +/- 2 billion.
- karagenit 6y agoI'm being pedantic, but technically wrapping from 0 to MAX_INT is still considered overflow. Underflow refers to decimal truncation e.g. by integer division.
- koheripbal 6y agowell... at least it takes twice as long to overflow.
- DethNinja 6y agoSigned or unsigned doesn’t matter much both can overflow. I actually started putting assertion checks about overflow issues almost everywhere but it requires great discipline. I wonder if there is a better solution available.
- enedil 6y agoIf you can allow yourself this kind of performance regression, you can compile in GCC or clang with `-fsanitize=signed-integer-overflow`, this will do runtime checks.
- bluedino 6y agoWhat happens when some dumbledork sets it to 2^32+1?
- jwandborg 6y agoFrom the blog post: > (if you try and set it to 2^31 the kernel returns “INVALID ARGUMENT”). I would expect the same to happen for 2^31+1.