[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180315194205.GM1436@brightrain.aerifal.cx>
Date: Thu, 15 Mar 2018 15:42:05 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Re: #define __MUSL__ in features.h
On Thu, Mar 15, 2018 at 04:13:44PM -0300, dgutson . wrote:
> On Thu, Mar 15, 2018 at 4:00 PM, dgutson . <danielgutson@...il.com> wrote:
>
> >
> >
> > On Thu, Mar 15, 2018 at 3:53 PM, Rich Felker <dalias@...c.org> wrote:
> >
> >> On Thu, Mar 15, 2018 at 03:48:32PM -0300, Martin Galvan wrote:
> >> > 2018-03-15 15:39 GMT-03:00 Rich Felker <dalias@...c.org>:
> >> > >> (e.g. the FD* issue reported by Martin Galvan).
> >> > >
> >> > > That's not a bug. It's compiler warnings being wrongly produced for a
> >> > > system header, probably because someone added -I/usr/include or
> >> > > similar (normally GCC suppresses these).
> >> >
> >> > I'm certain we didn't add -I/usr/include or something similar. Could
> >> > you test this yourself to confirm it's not a bug?
> >>
> >> In any case it's not a bug in musl. The code is perfectly valid C. If
> >> the compiler is producing a warning for it, either ignore it or ask
> >> the compiler to stop.
> >>
> >> > The compiler warnings aren't being wrongly produced. musl will indeed
> >> > perform a signed-to-unsigned conversion here.
> >>
> >> Because that's how the C language works.
> >>
> >
> > it is a potential vulnerability:
> > https://cwe.mitre.org/data/definitions/195.html
> > https://wiki.sei.cmu.edu/confluence/display/c/INT31-C.+
> > Ensure+that+integer+conversions+do+not+result+in+
> > lost+or+misinterpreted+data
> > https://wiki.sei.cmu.edu/confluence/display/c/INT30-C.+
> > Ensure+that+unsigned+integer+operations+do+not+wrap
> >
>
> Just to add: the code doesn't not comply with MISRA 2004 because it
> violates 6.10.3. IOW, at least this issue turns musl MISRA non-compliant.
musl does not comply or aim to comply with MISRA.
MISRA certainly has a place, as a set of very strict practices that
you can verify with static checks and that force you to be very
explicit about things that might not be obvious to programmers not
really familiar with C. But it also makes C much more verbose and hard
to read if you are familiar with the language. I don't fault
people/orgs using MISRA for doing safety-critical embedded work that
has to be done in C, but I don't want to be the one dealing with it.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
