3 ms·
Depends. The underlying issue for this bug is that the code involved crosses language boundaries (the Windows kernel and win32 libraries written in C and the ap
by layer8 2y ago
Depends. The underlying issue for this bug is that the code involved crosses language boundaries (the Windows kernel and win32 libraries written in C and the application in C++). The code where the lifetime failure occurs is Windows code, not application code. However, the Windows code is correct in the context of the C language. The error is caused by an APC that calls exception-throwing C++ code, being pushed onto the waiting-in-C thread. This is a case of language-agnostic OS mechanisms conflicting with language-specific stack unwinding mechanisms.
This could only be made safe by the OS somehow imposing safety mechanisms on the binary level, or by wrapping all OS APIs into APIs of the safe language, where the wrappers have to take care to ensure both the guarantees implied by the language and the assumptions made by the OS APIs. (Writing the OS itself in a memory-safe language isn’t sufficient, for one because it very likely will still require some amount of “unsafe” code, and furthermore because one would still want to allow applications written in a different language, which even if it also is memory-safe, would need memory-correct wrappers/adapters.)
This is similar to the distinction between memory-safe languages like Rust where the safety is established primarily on the source level, not on the binary level, and memory-safe runtimes like the CLR (.NET) and the JVM.
- jpc0 2y ago> the Windows kernel and win32 libraries written in C and the application in C++ To my knowledge the kernel and win32 is in fact written in C++ and only the interface has C linkage and follows C norms. So this error occurred going C++ > C > C++ never mind languages with different memory protection mechanisms like Rust > C > C++.
- rurban 2y agoNo, the windows kernel is written in pure C.
- cryptonector 2y agoI believe it's C++, but not allowed to use exceptions.
- rurban 2y agoWe know that it's pure C, because it leaked.
- cryptonector 2y agoAll of it is C?
- layer8 2y agoIt’s an unholy combination of C, C++, and Microsoft extensions at worst. But apart possibly from some COM-related DLLs, the spirit is clearly C, and C++ exceptions are generally not expected. (There may be use of SEH in some parts.) Of course, you can write C++ without exception safety too, but “C++ as a better C” and exception-safe C++ are effectively like two different languages.
- ryao 2y agoI filed bugs against both GCC and LLVM asking for compiler warnings that would inform developers of the risk: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118263 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118263 https://github.com/llvm/llvm-project/issues/121427 https://github.com/llvm/llvm-project/issues/121427
- protomolecule 2y ago>The error is caused by an APC that calls exception-throwing C++ code The article doesn't say it was a C++ exception. Could've been a SEH exception.