https://blog.erratasec.com/2023/02/c-can-be-memory-safe.html Errata Security Wednesday, February 01, 2023 C can be memory-safe The idea of memory-safe languages is in the news lately. C/C++ is famous for being the world's system language (that runs most things) but also infamous for being unsafe. Many want to solve this by hard-forking the world's system code, either by changing C/C++ into something that's memory-safe, or rewriting everything in Rust. Forking is a foolish idea. The core principle of computer-science is that we need to live with legacy, not abandon it. And there's no need. Modern C compilers already have the ability to be memory-safe, we just need to make minor -- and compatible -- changes to turn it on. Instead of a hard-fork that abandons legacy system, this would be a soft-fork that enables memory-safety for new systems. Consider the most recent memory-safety flaw in OpenSSL. They fixed it by first adding a memory-bounds, then putting every access to the memory behind a macro PUSHC() that checks the memory-bounds: [Screen] A better (but currently hypothetical) fix would be something like the following: size_t maxsize CHK_SIZE(outptr) = out ? *outlen : 0; This would link the memory-bounds maxsize with the memory outptr. The compiler can then be relied upon to do all the bounds checking to prevent buffer overflows, the rest of the code wouldn't need to be changed. An even better (and hypothetical) fix would be to change the function declaration like the following: int ossl_a2ulabel(const char *in, char *out, size_t *outlen CHK_INOUT_SIZE(out)); That's the intent anyway, that *outlen is the memory-bounds of out on input, and receives a shorter bounds on output. This specific feature isn't in compilers. But gcc and clang already have other similar features. They've only been halfway implemented. This feature would be relatively easy to add. I'm currently studying the code to see how I can add it myself. I could just mostly copy what's done for the alloc_size attribute. But there's a considerable learning curve, I'd rather just persuade an existing developer of gcc or clang to add the new attributes for me. Once you give the programmer the ability to fix memory-safety problems like the solution above, you can then enable warnings for unsafe code. The compiler knew the above code was unsafe, but since there's no practical way to fix it, it's pointless nagging the programmer about it. With this new features comes warnings about failing to use it. In other words, it becomes compiler-guided refactoring. Forking code is hard, refactoring is easy. As the above function shows, the OpenSSL code is already somewhat memory safe, just based upon the flawed principle of relying upon diligent programmers. We need the compiler to enforce it. With such features, the gap is relative small, mostly just changing function parameter lists and data structures to link a pointer with its memory-bounds. The refactoring effort would be small, rather than a major rewrite. This would be a soft-fork. The memory-bounds would work only when compiled with new compilers. The macro would be ignored on older systems. This memory-safety is a problem. The idea of abandoning C/C++ isn't a solution. We already have the beginnings of a solution in modern gcc and clang compilers. We just need to extend that solution. By Robert Graham # # No comments: Post a Comment Newer Post Older Post Home Subscribe to: Post Comments (Atom) Errata Security On Twitter * Robert Graham (@ErrataRob) * David Maynor (@Dave_Maynor) Popular Posts * You are committing a crime right now Are you reading this blog? If so, you are committing a crime under 18 USC 1030(a) (better known as the " Computer Fraud & ... * [Screenshot] How The Intercept Outed Reality Winner Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ... * SideJacking with Hamster NOTE: you can download the program at http://www.erratasec.com/ sidejacking.zip ; make sure to read the instructions. Others have done a be... * [super-vs] Extracting the SuperFish certificate I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how dow... * That NBC story 100% fraudulent Yesterday (Feb 5 2014) On February 4th, NBC News ran a story claiming that if you bring your mobile phone or laptop to the Sochi Olympics... * [Screenshot] Bash 'shellshock' scan of the Internet NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now ... * Bash 'shellshock' bug is wormable Early results from my scan: there's about 3000 systems vulnerable just on port 80, just on the root "/" URL, without Host fiel... * Some notes about HTTP/3 HTTP/3 is going to be standardized. As an old protocol guy, I thought I'd write up some comments. Google (pbuh) has both the most popu... * [gpu-cracki] Confirmed: LinkedIn 6mil password dump is real Today's news is that 6 million LinkedIn password hashes were dumped to the Internet. I can confirm this hack is real: the password I use... * Notes on the Ashley-Madison dump Ashley-Madison is a massive dating site that claims 40 million users. The site is specifically for those who want to cheat on their spouse. ... Blog Archive [Blog Archive ] - Awesome Inc. theme. Powered by Blogger.