[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240718173129.GP10433@brightrain.aerifal.cx>
Date: Thu, 18 Jul 2024 13:31:30 -0400
From: Rich Felker <dalias@...c.org>
To: Thorsten Glaser <tg@...bsd.de>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH 1/1] FD_SET() and FD_ISSET() warn on
-Wsign-conversion
On Thu, Jul 18, 2024 at 04:54:23PM +0000, Thorsten Glaser wrote:
> Rich Felker dixit:
>
> >What's really frustrating about these kinds of garbage warnings is
> >that they encourage (as in the proposed patch) writing casts that
> >*remove type-safety* and make very-wrong code silently compile "fine",
> >for the purpose of suppressing a warning that's supposedly about a
> >type-safety issue.
>
> The warning *can* be useful, though.
Yes, it can, but empirically this kind of warning leads to people
writing wrong casts that either suppress other useful diagnostics or
outright introduce bugs.
> You could always hide a cast-y version behind __extension__({…})
> if GCC or compatible is detected (ugh).
How about nope. :-)
> For *this* specific case, it might be sufficient to instead cast
> the constant term to signed (I can’t believe I found a case where
> using signed ints, despite the UB danger, is the possible fix):
>
> #define FD_SET(d,s) ((s)->fds_bits[(d) / (int)(8 * sizeof(long))] |= \
> (1UL << ((d) % (int)(8 * sizeof(long)))))
Use of signed ints generates worse code (not just bitshift/mask, needs
fixup for C's wrong definition of signed integer division) and has
more-dangerous behavior in the event of a negative input (small
negative offset likely to clobber data in an exploitable way rather
than giant positive offset likely to crash).
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
