The real question is adoption friction. The annotation requirement means this won't just slot into existing codebases — someone has to go through and mark up every buffer relationship. Google turning on libcxx hardening in production with The incremental path matters more than the theoretical coverage. I'd love to see benchmarks on a real project — how many annotations per KLOC, and what % of OOB bugs it actually catches in practice vs. what ASAN already finds in CI.
-fbounds-safety: Enforcing bounds safety for C
41–50 of 129 posts
Re: -fbounds-safety: Enforcing bounds safety for C
#42template struct Slice { T* data = nullptr; size_t size = nullptr; T& operator[](size_t index) { if (index >= size) crash_the_program(); return data[index]; } }; If you're considering this extension, just use C++ and 5 lines of standard, portable, no-weird-annotations code instead.
Even better, starting with C++26, and considered to be done with DR for previous versions, hardned runtimes now have a portable way to be configured across compilers, instead of each having their own approach. However, you still need something like -fbounds-safety in C++, due to the copy-paste compatibility with C, and too many people writing Orthodox C++, C with Classes, Better C, kind of code, that we cannot get ri…
[dead]
Re: -fbounds-safety: Enforcing bounds safety for C
#43Earlier quoted context omitted.
What are you hoping it will achieve?
The internet went down because cloudflare used a bad config... a config parsed by a rust app. One of these days the witch hunt against C will go away.
A service going down is a million times better than being exploited by an attacker. If this is a witch hunt then C is an actual witch.
Re: -fbounds-safety: Enforcing bounds safety for C
#44[dead]
Re: -fbounds-safety: Enforcing bounds safety for C
#45[dead]
There is GWPAsan that has lower overhead than asan but still is not super popular.
Re: -fbounds-safety: Enforcing bounds safety for C
#46Exciting! It doesn't imply that we should now sprinkle the new annotations everywhere. We still should keep working with proper iterators and robust data structures, and those would need to add such annotations.
Re: -fbounds-safety: Enforcing bounds safety for C
#47template struct Slice { T* data = nullptr; size_t size = nullptr; T& operator[](size_t index) { if (index >= size) crash_the_program(); return data[index]; } }; If you're considering this extension, just use C++ and 5 lines of standard, portable, no-weird-annotations code instead.
Or just do it in C. #define span(T) struct span_##T { size_t len; T *data; } #define span_access(T, x, i) (*({ \ span(T) *_v = (x); \ auto _i = (i); \ if (((size_t)_i) >= _v->len) abort(); \ &_v->data[_i]; \ })) https://godbolt.org/z/TvxseshGc
The fact that pointer types can't be used with this pattern without typedef still seems kinda primitive to me.
Re: -fbounds-safety: Enforcing bounds safety for C
#48I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"m not sure how extensively it is used.
Maybe this: https://fil-c.org/pizlix >Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available. The author, @pizlonator, is active on HN.
https://github.com/hsaliak/filc-bazel-template i created this recently to make it super easy to get started with fil-c projects. If you find it daunting to get started with the setup in the core distribution and want a 3-4 step approach to building a fil-c enabled binary, then try this.
Re: -fbounds-safety: Enforcing bounds safety for C
#49Xcode (AppleClang) has had -fbounds-safety for a while now. What is the delay getting this into merged into LLVM?
Re: -fbounds-safety: Enforcing bounds safety for C
#50[dead]
I looked at trying to implement -fbounds-safety and -Wunsafe-buffer on a reasonably large codebase (4,000 C and C++ files), and it's basically impossible.
You have to instrument every single file. It can be done in stages though. Just turn the flag on one-by-one for each file. The xnu kernel is _mostly_ instrumented with -fbounds-safety.