Into the Depths of C: Elaborating the De Facto Standards [pdf]

Post by jsnell » Tue, May 31, 2016, 8:19 AM UTC

Post by blastrat » Wed, Jun 01, 2016, 8:57 PM UTC

kerneis wrote: post #2

If you think you know C quite well, here is one of the studies the authors ran to elaborate their semantics on corner cases of the language: http://www.cl.cam.ac.uk/~pes20/cerberus/notes50-survey-discu... > If you zero all bytes of a struct and then write some of its members, do reads of the padding return zero? (e.g. for a bytewise CAS or hash of the struct, or to know that no security-relevant data has leaked into…

Post by kerneis » Wed, Jun 01, 2016, 9:11 PM UTC

blastrat wrote: post #3

kerneis wrote: post #2

If you think you know C quite well, here is one of the studies the authors ran to elaborate their semantics on corner cases of the language: http://www.cl.cam.ac.uk/~pes20/cerberus/notes50-survey-discu... > If you zero all bytes of a struct and then write some of its members, do reads of the padding return zero? (e.g. for a bytewise CAS or hash of the struct, or to know that no security-relevant data has leaked into…

I knew C quite well. Haven't written any for years. The statements "zero all bytes of a struct" and "reads of the padding" contain enough ambiguity that it answers the question. Not to mention the ambiguity in the words "read" and "write" as they pertain to C, since they already have a "std" meaning that's not the same as lvalue or rvalue, so what exactly do they mean here? And if you think you can answer the questio…

    I would expect this code to work:
    
    struct foo
    {
        char a;
        double b;
    };
    
    foo p;
    foo q;
    memset( &p, 0, sizeof( p ) );
    memset( &q, 0, sizeof( q ) );
    p.a = 1;
    q.a = 1;
    assert( memcmp( &p, &q, sizeof( foo ) ) == 0 );

Post by psewell » Wed, Jun 01, 2016, 9:59 PM UTC

kerneis wrote: post #5

blastrat wrote: post #3

Earlier quoted context omitted.

I knew C quite well. Haven't written any for years. The statements "zero all bytes of a struct" and "reads of the padding" contain enough ambiguity that it answers the question. Not to mention the ambiguity in the words "read" and "write" as they pertain to C, since they already have a "std" meaning that's not the same as lvalue or rvalue, so what exactly do they mean here? And if you think you can answer the questio…

I believe the questions in this study (I did not write it, only know the authors) were deliberately open-ended, allowing for comments on the specifics. A previous, much longer version used to contain code examples to comment, but it proved too detailed for people to complete. Moreover, the study was explicitly not about ISO C: "We were not asking what the ISO C standard permits, which is often more restrictive, or ab…

  #include 

  #include 

  typedef struct { char c; float f; int i; } st;

  int main() {

    // check there is a padding byte between c and f

    size_t offset_padding = offsetof(st,c)+sizeof(char);

    if (offsetof(st,f)>offset_padding) {

        st s; 

        unsigned char *p = 

          ((unsigned char*)(&s)) + offset_padding;

        *p = 0;

        s.c = 'A';

        s.f = 1.0;

        s.i = 42;

        unsigned char c3 = *p; 

        // does c3 hold 0, not an unspecified value?

        printf("c3=0x%x\n",c3);

    }

    return 0;

  }

Post by pkhuong » Wed, Jun 01, 2016, 10:54 PM UTC

TickleSteve wrote: post #8

I've been using C for over 20 years and I'm sure I would be caught out by these... ...but... The fact these curiosities are not an issue in day-to-day work and C is (one of) the most popular languages around today mean that they aren't too serious. When you have a knowledge of the hardware and are working at that level day-in day-out then issues like this really don't bother you that much. (I do realise that this is…