I am looking for other people's attempts to create safe subset of C and
enforce it with scripts. Does anybody know about anything like this?
By "safe", I mean the following:
* Strongly typed memory. No way to reinterpret it as bunch of bytes
* Recovery from invalid and NULL pointers other than crash
* Possibility to isolate piece of code by not giving it key pointers
Library used to support such safe subset must not introduce its own flaws.
For example, it is not a good idea to use int proxies for pointers like
Unix API does, because this allows pointer guessing and consequently
prevents isolation.
Nov 13 '05
36  3895 
On Mon, 24 Nov 2003 11:34:28 +1100, Simon Biber wrote: "Robert Vazan" <ro*********@pr ivateweb.sk> wrote in message
news:pa******** *************** *****@privatewe b.sk... What, Java sandbox doesn't work? I must disable it in my browser...
It has the potential for misuse, such as spamming lots of windows or
unkillable dialog boxes... see even the javascript (yes I know it's
not Java, but it's still an example of a sandboxed language):
while(1) alert("Please Click OK");
which on many (older) browsers required a forced kill of the program.
That's acceptable. It's not fault of language. It's fault of library that
provides windows. I care about language for now. Let's keep the goal
finite.
So you need to regulate array access; how? Your supporting library must
hook into every single array access:
int int_item( const int *array, size_t index);
I think that the array would have to be structure of some sort, so that
item count can be stored somewhere. Another option is to make it easy to
automatically find out which variable holds item count. Verifier can then
look whether all branches leading to array access performed bounds
checking on index.
Then you must redefine every single library function so it accesses
arrays in terms of these accessor functions?!
There is no hope to support legacy code. Unchecked libraries can be, of
course, linked with to maintain compatibility.
On Sun, 23 Nov 2003 15:00:37 -0600, James Hu wrote: http://www.google.com/search?q=splint &btnI=I'm+Feeli ng+Lucky
Thanks. It's heuristics, so I cannot take too many ideas from it. It might
be useful on other projects.
That is rather simplistic view, and it is a naive application that
leaves such verification code enabled all the time (e.g., verifying
qsort really sorted the array after each invocation).
I don't want to verify that qsort actually sorts the array. I just want to
verify that it doesn't write to memory to which it never got pointer and
that it doesn't crash. I cannot do this with standard qsort, of course,
but I should be able to do this with code that I have written.
On Sun, 23 Nov 2003 19:17:27 -0500, Sheldon Simms wrote: I guess you figure that all those "smart programmers" are incapable of
using any other language.
I didn't want to offend you. I am also capable of using other languages,
but I have got very sensitive to quality of tools and I am consequently
very sceptical about any new language.
I can't speak for anyone else, but I wouldn't be
interested in working in crippled C.
So you compile with warnings turned off?
However, I have no problem learning a
new language if that's what the project requires.
That's how I learned most of languages that I know. However I am now
making the choice myself. Nobody requires me to use anything.
It's more of a hobby project and my priority is simplicity. I thought that
C is the right choice in this direction. I think that the safe subset will
simplify it further. It's true that the supporting library is going to
make it more complex, but I don't see how choice of language could affect
it. The only debugger for Java is in Microsoft's J++, AFAIK.
There are many debuggers for Java, usually integrated in one of the very
many IDEs for Java. There is also a command line debugger that comes with
the standard java distribution.
Sorry, I shouldn't pick up whatever rumors pass by, no matter who
distributes them.
On Mon, 24 Nov 2003 19:06:16 +0100, Robert Vazan wrote: On Sun, 23 Nov 2003 19:17:27 -0500, Sheldon Simms wrote:
I can't speak for anyone else, but I wouldn't be
interested in working in crippled C.
So you compile with warnings turned off?
Warnings don't prevent me from doing anything, and lots of things
that you want to disallow, such as treating any object as an array
of bytes, can be done perfectly safely and portably.
On Mon, 24 Nov 2003 19:06:16 +0100, Robert Vazan wrote: On Sun, 23 Nov 2003 19:17:27 -0500, Sheldon Simms wrote:
I guess you figure that all those "smart programmers" are incapable of
using any other language.
I didn't want to offend you. I am also capable of using other languages,
but I have got very sensitive to quality of tools and I am consequently
very sceptical about any new language.
I can't speak for anyone else, but I wouldn't be
interested in working in crippled C.
So you compile with warnings turned off?
Having warnings enabled doesn't cripple C; it just lets you know when
you've done something that probably isn't actually C at all. :)
On 2003-11-24, Robert Vazan <ro*********@pr ivateweb.sk> wrote: On Sun, 23 Nov 2003 15:00:37 -0600, James Hu wrote: That is rather simplistic view, and it is a naive application that
leaves such verification code enabled all the time (e.g., verifying
qsort really sorted the array after each invocation).
I don't want to verify that qsort actually sorts the array. I just
want to verify that it doesn't write to memory to which it never got
pointer and that it doesn't crash. I cannot do this with standard
qsort, of course, but I should be able to do this with code that I
have written.
There are already tools that do this. A web search for memory
debugging tools will provide many hits.
-- James
In article <pa************ *************** *@lightspeed.bc .ca>,
Kelsey Bjarnason <ke*****@lights peed.bc.ca> wrote: On Mon, 24 Nov 2003 19:06:16 +0100, Robert Vazan wrote:
On Sun, 23 Nov 2003 19:17:27 -0500, Sheldon Simms wrote:
I guess you figure that all those "smart programmers" are incapable of
using any other language.
I didn't want to offend you. I am also capable of using other languages,
but I have got very sensitive to quality of tools and I am consequently
very sceptical about any new language.
I can't speak for anyone else, but I wouldn't be
interested in working in crippled C.
So you compile with warnings turned off?
Having warnings enabled doesn't cripple C; it just lets you know when
you've done something that probably isn't actually C at all. :)
If it isn't C at all you would get an error. If you get a warning, it's
most likely perfectly legal C that in some non-obvious way does
something entirely different from what you intended.
In <ch************ *************** ******@slb-newsm1.svr.pol. co.uk> Christian Bau <ch***********@ cbau.freeserve. co.uk> writes: In article <pa************ *************** *@lightspeed.bc .ca>,
Kelsey Bjarnason <ke*****@lights peed.bc.ca> wrote:
On Mon, 24 Nov 2003 19:06:16 +0100, Robert Vazan wrote:
> On Sun, 23 Nov 2003 19:17:27 -0500, Sheldon Simms wrote:
>
>> I guess you figure that all those "smart programmers" are incapable of
>> using any other language.
>
> I didn't want to offend you. I am also capable of using other languages,
> but I have got very sensitive to quality of tools and I am consequently
> very sceptical about any new language.
>
>> I can't speak for anyone else, but I wouldn't be
>> interested in working in crippled C.
>
> So you compile with warnings turned off?
Having warnings enabled doesn't cripple C; it just lets you know when
you've done something that probably isn't actually C at all. :)
If it isn't C at all you would get an error. If you get a warning, it's
most likely perfectly legal C that in some non-obvious way does
something entirely different from what you intended.
Many compilers generate mandatory diagnostics as warnings. The following
hardly qualifies as a perfectly legal C program:
fangorn:~/tmp 214> cat test.c
int main()
{
char *p = 1;
return sizeof(void);
}
fangorn:~/tmp 215> gcc -ansi -pedantic test.c
test.c: In function `main':
test.c:3: warning: initialization makes pointer from integer without a cast
test.c:4: warning: sizeof applied to a void type
fangorn:~/tmp 216>
Dan
--
Dan Pop
DESY Zeuthen, RZ group
Email: Da*****@ifh.de
On Tue, 25 Nov 2003 01:01:10 -0600, James Hu wrote: There are already tools that do this. A web search for memory
debugging tools will provide many hits.
They aren't suitable for release code. And even in debug code, they crash
the program. It's just that they crash it near to point of error.
On Mon, 24 Nov 2003 15:29:41 -0500, Sheldon Simms wrote: Warnings don't prevent me from doing anything, and lots of things
You can get warning that not all members of enum are enumerated in switch
statement. You can get warning about missing return statement even if you
know that end of function is unreachable.
that you want to disallow, such as treating any object as an array of
bytes, can be done perfectly safely and portably.
The only thing that you can do portably is copying those bytes to new
location. Reflection and metadata can do much more and they are type-safe. This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics | |
by: Irmen de Jong |
last post by:
Pickle and marshal are not safe. They can do harmful
things if fed maliciously constructed data.
That is a pity, because marshal is fast.
I need a fast and safe (secure) marshaler.
Is xdrlib the only option?
I would expect that it is fast and safe because
it (the xdr spec) has been around for so long.
Or are there better options (perhaps 3rd party libraries)?
|
by: les_ander |
last post by:
Hi,
I have many set objects some of which can contain same group of object
while others can be subset of the other. Given a list of sets,
I need to get a list of unique sets such that non of the set is an
subset of another or contain exactly the same members.
Tried to do the following:
s1=set()
s2=set()
s3=set()
|
by: Chris Dutrow |
last post by:
I searched around on the net for a bit, couldn't find anything though.
I would like to find some code for a function where I input A Range Of
Integers
For example: Function( 1, 100 );
And the function will return me an array holding a random subset of integers
in that range of a size that I specify
So the Function would Probabaly look something like this:
|
by: Dan Bass |
last post by:
I know that XslTransform's Transform is thread safe according to the MSDN,
and that Load is not. I've therefore applied this simply Mutex to it and
would just like to confirm this is okay.
XslTransform xslt = null;
Mutex mut = new Mutex();
public override string MapMessage ( string messageSource )
{
|
by: Jon Paul Jones |
last post by:
For some time now, I have been looking for a build system for ASP.NET that
will merge the file based ease of deployment of classic ASP with the type
saftey and prebuilt nature of ASP.NET with codebehind. The team that I work
on manages several web sites and we have many different projects (not VS
projects) going on in each site simultaneously. Each of these projects may
have different deployment schedules. In a classis ASP world this was...
| | |
by: Babar K. Zafar |
last post by:
Hi guys!
I know this subject has been beaten to death and I am not going to
whine about lacking features for proper restricted execution in the
Python runtime. It's the OS job, I get it.
Anyways, I thought about using a restricted *subset* of the language
for simple configuration scripts and storing data in a user-friendly
way. I'm fully aware about the dangers of introducing "eval" into the
picture so I took different route and...
|
by: jacob navia |
last post by:
We have discussed often the proposition from Microsoft
for a safer C library.
A rationale document is published here by one of the members of
the design team at microsoft:
http://msdn.microsoft.com/msdnmag/issues/05/05/SafeCandC/default.aspx
jacob
|
by: jecheney |
last post by:
Hi,
Im currently using the following code for reading/writing to a network
socket.
private StreamReader clientStreamReader;
private StreamWriter clientStreamWriter;
....
TcpClient tcpClient = new
TcpClient(server_host_name, server_port);
|
by: Szabolcs |
last post by:
I am not familiar with the UTF-8 encoding, but I know that it encodes
certain characters with up to four bytes. Is it safe to use UTF-8
encoded comments in C++ source files? For example, is there a remote
possibility that some multi-byte character, when interpreted
byte-by-byte, will contain */ and close the comment? Or is there
something else that can go wrong?
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
| | |
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed.
This is as boiled down as I can make it.
Here is my compilation command:
g++-12 -std=c++20 -Wnarrowing bit_field.cpp
Here is the code in...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: conductexam |
last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one.
At the time of converting from word file to html my equations which are in the word document file was convert into image.
Globals.ThisAddIn.Application.ActiveDocument.Select();...
|
by: adsilva |
last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
| | |
by: muto222 |
last post by:
How can i add a mobile payment intergratation into php mysql website.
| |
