You’re not going to MAD_FREE on the stack. Duh.
Conversation
That's likely glibc what is going to be doing for their stack cache since MADV_DONTNEED is a significant performance cost for their implementation, and it doesn't become a non-issue if restricted to malloc since it still means that uninitialized memory can change between reads.
1
4
Reading uninit data being undefined instead of locking it to an unspecified value permits massive optimizations like MADV_FREE and more efficient register allocation/spilling. Similarly, other memory safety issues being undefined permits optimization / freedom of implementation.
1
5
Many programs have bugs where they read data that has just been freed, but handle it being an arbitrary value. The issue is often benign with common allocators. However, with other implementations the access will fault and they crash. It's good it's not required to let it work.
2
3
Also, signed overflow being undefined rather than defined as wrapping means that more secure implementations where it traps are permitted. Passing -fsanitize=signed-integer-overflow -fsanitize-trap=signed-integer-overflow is standards compliant and used for hardening in AOSP.
3
5
Trapping on overflow breaks lots of code that does it on purpose. Code that can’t run is more secure than code that doesn’t only in a meaningless sense.
1
That code can be fixed and the fixes are clear cut bug fixes. High quality C code is tested with ASan, TSan, UBSan, etc. and many of these issues are already being caught and fixed over time. Portable and safe C code needs to avoid relying on undefined behavior like this.
2
5
You say overflow is undefined. I say it’s defined. As a bonus CPUs say I’m right. The world needs a language that just does what the CPU does. If you don’t want that, don’t program in C.
4
2
2
C isn't defined as that language, and you're not in a position where you get to define the language. In the real world, C is deployed with various safety features taking advantage of many things being undefined and reducing portability / compatibility with those wouldn't be good.
2
5
This Tweet was deleted by the Tweet author. Learn more
The Linux kernel chooses to use a superset of standard C. It doesn't ignore the rules that it isn't disabling via those switches but rather is actively tested with ASan and UBSan, with people working to address the cases that are not permitted, usually by fixing the kernel bugs.
You’re still hung up on a false choice between a well defined spec and instrumentation/tools that alter behavior while giving you something good in return. A defined behavior for C wouldn’t stop those tools from existing.
1
The defined behavior can be trapping, which makes more sense in 2019 with software safety / security / robustness as such important issues. Hardware can and is being designed to make it efficient to catch these issues too. It can also just permit safety without using 'undefined'.
2
1
Show replies
The compilers go out of the way to support those options to use a more permissive superset of the language, while still permitting aggressive optimization. They also provide support for trapping in many of these cases, rather than defining and permitting it.
This Tweet was deleted by the Tweet author. Learn more
I think most people can agree that violations of type and memory safety are clearly bugs. I also think people can agree that integer overflow is usually a bug, and that it makes sense for a language to require marking intended overflow where it shouldn't be allowed to trap.
1
Show replies