{"id":1483,"date":"2023-12-06T21:14:13","date_gmt":"2023-12-07T02:14:13","guid":{"rendered":"http:\/\/www.rfdm.com\/blog\/?p=1483"},"modified":"2023-12-06T23:16:08","modified_gmt":"2023-12-07T04:16:08","slug":"integer-type-selection-in-c-in-safe-secure-and-correct-code-a-good-talk-from-robert-seacord","status":"publish","type":"post","link":"https:\/\/www.rfdm.com\/blog\/?p=1483","title":{"rendered":"Integer Type Selection in C++ in Safe, Secure and Correct Code: a good talk from Robert Seacord"},"content":{"rendered":"\n

Excellent talk from Robert Seacord at CppNow 2023: Integer Type Selection in C++: in Safe, Secure and Correct Code<\/a> <\/p>\n\n\n\n

Part of what I love about this talk is the ignorance of some of the audience, which I admit stunned me. Just as an example, note the audience member at around 1:09:30 arguing that using a pointer increment solves the problems Robert was discussing about loop termination. Newsflash: pointers have no special powers that solve this problem. Incrementing a pointer beyond allocated memory is UB.<\/p>\n\n\n\n

Robert started this part of the talk with this, with the idea that size<\/tt> is of type size_t<\/tt>:<\/p>\n\n\n\n

for (ssize_t i = (ssize_t)size-1; i >= 0; i--)<\/code><\/pre>\n\n\n\n
The defect that Robert points out is that some (roughly half) of the possible values of type size_t<\/tt> can’t be represented as ssize_t<\/tt>, and the cast will result in incorrect behavior for those values of size<\/tt>.  Values of size<\/tt> that are larger than the largest signed integer representable by ssize_t<\/tt> will result in i<\/tt> being initialized as a negative value, hence immediate termination of the loop.<\/p>\n\n\n\n
The audience member is arguing that pointer arithmetic solves this problem.  One, he’s making the assumption that the whole point of the code is to use i<\/tt> as an array index.  Which is not Robert’s point at all.  Any array on his slide?  Nope.<\/p>\n\n\n\n
But suppose we go along with his argument, and make the assumption that i<\/tt> is being used as an array index in the loop.  We’ll flesh this out a little more just to make a useful example of what the audience member was proposing.<\/p>\n\n\n\n
Let’s suppose Robert’s code was part of this:<\/p>\n\n\n\n
void fillCharArray(char *array, char c, size_t size)\n{\n    for (ssize_t i = (ssize_t)size-1; i >= 0; i--) {\n        array[i] = c;\n    }\n}<\/code><\/pre>\n\n\n\n
The audience member was proposing this as a fix:<\/p>\n\n\n\n
void fillCharArray(char *array, char c, size_t size)\n{\n     char *p = array;\n     const char *arrEnd = array + size;\n     for ( ; p != arrEnd; ++p) {\n         *p = c;\n     }\n}<\/code><\/pre>\n\n\n\n
Does this fix the problem?  No.  In fact, from a safety and security perspective, it’s potentially much worse.  array + size<\/tt> is undefined behavior for large size<\/tt>.  In fact it’s undefined behavior for any size<\/tt> that’s greater than the actual length of array.  And dereferencing (and worse, writing!) to what’s pointed to by p<\/tt> here is exactly how a large percentage of our published security flaws have appeared in C and C++ over the last many decades: out of bounds access.<\/p>\n\n\n\n
The separation of pointer from the length of what it points to is at the root of many problems in C (and hence C++ when C-style code is used).  It is why you often see sentinel values at the end of constant, initialized arrays where practical; loops can then terminate when they see the sentinel instead of relying on array index arithmetic.  This isn’t novel; C-style strings are just character arrays with a null (‘\\0’) as the sentinel (and string literals in C have a null implicitly appended).<\/p>\n\n\n\n
To the sane among us: ideally you never use C-style arrays at all in C++ code.  We have <array> and <vector>.  Use them.<\/p>\n","protected":false},"excerpt":{"rendered":"
Excellent talk from Robert Seacord at CppNow 2023: Integer Type Selection in C++: in Safe, Secure and Correct Code Part of what I love about this talk is the ignorance of some of the audience, which I admit stunned me. Just as an example, note the audience member at around 1:09:30 arguing that using a … <\/p>\n
Continue reading “Integer Type Selection in C++ in Safe, Secure and Correct Code: a good talk from Robert Seacord”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-1483","post","type-post","status-publish","format-standard","hentry","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1483"}],"version-history":[{"count":4,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1483\/revisions"}],"predecessor-version":[{"id":1489,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1483\/revisions\/1489"}],"wp:attachment":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}