points by pizlonator 2 years ago

Things like CHERI, Fil-C, and CCured make pointers just carry their bounds.

It’s not an unfixable problem.

I wish we were talking about fixing it, not making excuses.

lenerdenator 2 years ago

The problem with fixes on things this low-level is that they carry the potential to break lots of code. Since broken code has to be fixed, you then get into the "why not just rewrite it in <insert new hotness here>?" argument, which is headed off by just not fixing it.

C/C++ maintainers knew this and didn't want to see their lives' work made less significant. Now the issue's been forced by (among other things) one of the world's most influential software customers, the US Federal Government, implying that contract tenders for software written in languages like Rust will have an advantage over those written in languages that don't take memory safety as seriously.

  • pizlonator 2 years ago

    CHERI claims that the amount of changes are exceedingly small.

    Fil-C is getting there.

    So, C has a path to survival.

    > The problem with fixes on things this low-level is that they carry the potential to break lots of code. Since broken code has to be fixed, you then get into the "why not just rewrite it in <insert new hotness here>?" argument, which is headed off by just not fixing it.

    “Lots” is maybe an overstatement.

    Also, if there was a way to make C++ code safe with a smaller amount of changes than rewriting in a different language then that would be amazing.

    The main shortcoming of CHERI is that it requires new HW. But maybe that HW will now become more widely demanded and so more available.

    The main shortcoming of Fil-C is that it’s a personal spare time project I started on Thanksgiving of last year so yeah

    • marcosdumay 2 years ago

      > CHERI claims that the amount of changes are exceedingly small.

      Oh, man. Yes, they do. Many people have been claiming that for decades.

      When can we expect one of them to claim it's done?

      (To be fair, the amount of changes required has been diminishing through those decades.)

      • pizlonator 2 years ago

        I think the hardest part about CHERI is just that it's new HW. That's a tough sell no matter how seamless they make it.

      • pjmlp 2 years ago

        CHERI has hardware in the form of ARM Morello and CHERI RISC-V running FreeBSD, easily to check their claims.

jcranmer 2 years ago

CHERI is effectively a mix of option a and b in my categorization, necessitating hardware changes and ABI changes and limited amounts of software changes. I'm not familiar with the other options in particular, but they likely rely on a mix of ABI changes and/or software changes given the general history of such "let's fix C" proposals.

ABI breaks are not a real solution to the problem. When you talk about changing the ABI of a basic pointer type, this requires a flag day change of literally all the software on the computer at once, which has not been feasible for decades. This isn't an excuse; it's the cold hard reality of C/C++ development.

There is no solution that doesn't require some amount of software change. And the C committee is looking at fixing it! That's why C23 makes support for variably-modified types mandatory--it's the first step towards getting working compiler-generated bounds checks without changing the ABI and with relatively minimal software change (just tweak the function prototype a little bit).

vlovich123 2 years ago

Wouldn’t you have to recompile all your dependencies or run into ABI issues? For example, let’s say I allocate some memory & hand it over to a library that isn’t compiled with fat pointers. The API contract of the library is that it hands back that pointer later through a callback (e.g. to free or do more processing on). Won’t the pointer coming back be thin & lose the bounds check?

  • pizlonator 2 years ago

    Compile everything memory safely and then no problem.

im3w1l 2 years ago

How much code out there does stuff to the effect of

  union MyObject {
    void* ptr;
    unsigned long data;
  }
  (...)
  MyObject obj;
  obj.ptr = (void*)some_function;
  (...)
  store_context(obj.data);

And what would happen to such code if pointers are suddenly fat?

  • pizlonator 2 years ago

    CHERI handles that by dynamically dropping the capability when you switch to accessing memory as int.

    Fil-C currently has issues with that, but seldom - maybe I've found 3 such unions while porting OpenSSL, maybe 1 when porting curl, and zero when porting OpenSSH (my numbers may be off slightly but it's in that ballpark).