3 ms·
Note that Microsoft’s approach to taming the C language is a bit different from Git’s approach (https://github.com/git/git/blob/master/banned.h https://github.c
by klodolph 6y ago
Note that Microsoft’s approach to taming the C language is a bit different from Git’s approach (https://github.com/git/git/blob/master/banned.h https://github.com/git/git/blob/master/banned.h). Microsoft’s approach involves replacing the relevant functions with their Annex K variants, which is why the list is so long!
For example, you see memcpy() on Microsoft’s list. That doesn't mean that Microsoft simply “banned memcpy”, it means that Microsoft wants their developers to use an alternative function called memcpy_s(). The _s suffix means “secure”. These functions are defined in Annex K of the C standard, which is an optional part of the C standard. If you look at memcpy_s(), it may seem a bit weird:
errno_t memcpy_s( void *restrict dest, rsize_t destsz,
const void *restrict src, rsize_t count );
Note that this is more than plain bounds checking, and I believe it’s also intended to be used with static analysis tools to ensure that it’s being called correctly—and the API is designed to make static analysis tools easier to write!
As far as I can tell, Microsoft is really the only major user of Annex K. There may be a couple other users, but Microsoft is the big one. Microsoft reportedly pushed for the inclusion of Annex K into the C standard, implemented it in their own C toolchain, and wrote a bunch of tooling to work with the Annex K functions inside their massive legacy C codebase.
You see, sometimes you have to do things a bit different if you have tons of legacy code and aren’t willing to spend the (prohibitively expensive) effort to rewrite it all with newer, safer techniques (use your imagination—like C++ or Rust). The _s Annex K functions are designed to replace the unsafe variants in a somewhat predictable, mechanical fashion so you can send a bunch of programmers into your legacy code base to fix security holes. And it does work.
Git is a much newer C code base, is much smaller than Microsoft’s C code, not as old, and doesn’t run in the kernel. In Git, you’d be expected to manipulate strings with strbuf (https://github.com/git/git/blob/master/strbuf.h https://github.com/git/git/blob/master/strbuf.h) which is generally much safer and easier to use than the C stdlib. It’s just so much easier to make decisions like this in a new codebase like Git’s.
- ngcc_hk 6y agoEmbrace extend ... extinguish of the insecure one. Is security an excuse or is t the industry consensus or just Microsoft direction ? Old thinking I guess. But just ... What others do in this sphere.
- JW_00000 6y agoThe "extension" here (the _s functions) is standardized; while in the EEE strategy the extensions cannot be standardized: the whole point of the "extension" phase in EEE is to prevent interoperability.
- moonchild 6y agoExcept that the microsoft versions of the functions are incompatible with the standardized versions. (I don't think that that was done in bad faith, however; only that wg14 decided to change the definitions from the microsoft-proposed ones, and microsoft didn't feel willing to break compatibility.)
- Cyph0n 6y agoCisco uses the _s variants heavily in IOS-XR. I wasn’t aware that this family of functions was part of a specific addition to the C standard.
- lelanthran 6y ago> Microsoft’s approach involves replacing the relevant functions with their Annex K variants, which is why the list is so long! No, Microsoft's approach involves replacing the relevant functions with functions that are semantically different (and incompatible to) the Annex K functions. [EDIT: In case anyone is wondering, the Annex K functions that Microsoft provides will compile error-free on a conforming implementation (function signatures are the same), but because they are incompatible with what each parameter means sometimes they will crash].
- skohan 6y agoIs there any reason for MS to do this besides vendor lock-in?
- klodolph 6y agoI think what happened is Microsoft started using these before standardization, the definitions got changed during the standardization process, and Microsoft didn’t follow (presumably, to avoid breaking code). This is not really an unusual turn of events, and not something peculiar to Microsoft. Standards development is rarely “standards-first”. Instead, you implement your proposal, put it into use, and then go through the standards process. This is usually the way it should be done, and it’s how WHATWG did HTML5, it’s how Google did HTTP/2, etc.
- lelanthran 6y agoYes, but at the time the Annex K definitions were out, there were so few people actually using Microsoft's implementation that Microsoft could have changed the implementation to behave the way the standard prescribes. After all, ISTR the interface remains the same for most (if not all) the Annex K functions.
- klodolph 6y agoSo few people other than Microsoft themselves, yes. And for various reasons I don’t think Annex K was going to get popular, and making improvements to standards compliance wasn’t going to change that.
- siggen 6y agoThis is true. Visual Studio makes recommendations during compilation when you use these functions to replace them with them with the more secure variants.
- siggen 6y agoTo add to this, there are a couple of string types in Windows API in addition to C-strings, e.g., BSTR, UNICODE_STRING, etc., which are similar to strbuf and require usage of Windows API functions to manipulate or read.