3 ms·

> Modular arithmetic is perfectly well-defined. Yes (and thanks for the link!), I was in fact thinking more of this non-UB case (not signed overflow UB) as an

by _vvhw 5y ago

> Modular arithmetic is perfectly well-defined. Yes (and thanks for the link!), I was in fact thinking more of this non-UB case (not signed overflow UB) as an example of where it's clearly defined as wraparound but can be chained into an exploit nevertheless, not technically UB but a vulnerability nevertheless. Not all exploits bother to go as far as a UAF. Unchecked arithmetic can be low hanging fruit. > That didn't surprise me at all It surprises me that Rust doesn't just enable checked arithmetic by default with an opt-out for performance, rather than enabling it by default for performance with an opt-out for safety. Zig's choice here is the safer choice from a security perspective.

octoberfranklin 5y ago
Checked arithmetic is a much bigger performance hit than most people expect. It means that every arithmetic operation is potentially a branch/jump instruction. This wrecks a lot of pipelining/out-of-order-execution schemes. I once worked on an exotic architecture where the integer types had a "NaN" value just like floating point numbers do; it had both modular and checked arithmetic, but the checked versions would return NaN instead of branching. It also had 37-bit integers. Yes, 37-bit. Fun times.
- _vvhw 5y ago
  > Checked arithmetic is a much bigger performance hit than most people expect. You're right about the branching cost. I believe there's a better way to solve that than disabling checked arithmetic everywhere. This comes out of something I learned working on TigerBeetle [1], a new distributed database that can process a million financial transactions per second. We differentiate between the control plane (where we want crystal clear control flow and literally thousands of assertions, see NASA's "The Power of 10: Rules for Developing Safety-Critical Code") and the data plane (where the loops are hot). There are few places where we wouldn't want checked arithmetic in TigerBeetle enabled by default. However, where the branch mispredict cost relative to the amount of data being checked is too high, Zig enables us to mark the block scope as ReleaseFast to disable checked arithmetic. > It also had 37-bit integers. Yes, 37-bit. Fun times. Wow, fun times indeed! We just disabled 32-bit support for TigerBeetle because it was getting too hard to reason about padding. I can't imagine 37-bit, LOL! [1] https://www.tigerbeetle.com https://www.tigerbeetle.com

by _vvhw 5y ago

octoberfranklin 5y ago

Checked arithmetic is a much bigger performance hit than most people expect. It means that every arithmetic operation is potentially a branch/jump instruction. This wrecks a lot of pipelining/out-of-order-execution schemes. I once worked on an exotic architecture where the integer types had a "NaN" value just like floating point numbers do; it had both modular and checked arithmetic, but the checked versions would return NaN instead of branching. It also had 37-bit integers. Yes, 37-bit. Fun times.

_vvhw 5y ago
> Checked arithmetic is a much bigger performance hit than most people expect. You're right about the branching cost. I believe there's a better way to solve that than disabling checked arithmetic everywhere. This comes out of something I learned working on TigerBeetle [1], a new distributed database that can process a million financial transactions per second. We differentiate between the control plane (where we want crystal clear control flow and literally thousands of assertions, see NASA's "The Power of 10: Rules for Developing Safety-Critical Code") and the data plane (where the loops are hot). There are few places where we wouldn't want checked arithmetic in TigerBeetle enabled by default. However, where the branch mispredict cost relative to the amount of data being checked is too high, Zig enables us to mark the block scope as ReleaseFast to disable checked arithmetic. > It also had 37-bit integers. Yes, 37-bit. Fun times. Wow, fun times indeed! We just disabled 32-bit support for TigerBeetle because it was getting too hard to reason about padding. I can't imagine 37-bit, LOL! [1] https://www.tigerbeetle.com https://www.tigerbeetle.com