Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Melzzzzz Newsgroups: comp.programming Subject: Re: Research to Create Automated Buffer Overflow Protection Date: Tue, 26 Aug 2014 20:39:41 +0200 Organization: None Lines: 40 Message-ID: References: <4i3Lv.231350$m41.167051@fx34.am4> <1n77920ibcpbp.wgyjm4i9snuc.dlg@40tude.net> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Trace: solani.org 1409078381 14296 eJwFwYERAEEEA8CWHBGjnGek/xJ+N4OPW2ASqdQKsZ3N8Xor9hom8rzhAnFUBOdMJL6yHxbGELA= (26 Aug 2014 18:39:41 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Tue, 26 Aug 2014 18:39:41 +0000 (UTC) X-User-ID: eJwFwYEBgDAIA7CXoELRc7YC/59gkg+dqmAycnPb2Z6n7mx2GGo+aOyKjsXt1SLe4TGMFPUDLiUR5A== X-Newsreader: Claws Mail 3.10.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Cancel-Lock: sha1:xcCk2I2bo98u+rLqlsbeN+PXD44= X-NNTP-Posting-Host: eJwFwQcBwEAIBDBLzOORQxn+JTRxBaPD4DA/v7UmppSjikkaiVhW+lSK31Tmoh4uGwhbjh8R1RCn Xref: csiph.com comp.programming:4717 On Tue, 26 Aug 2014 19:35:26 +0200 "Dmitry A. Kazakov" wrote: > On Tue, 26 Aug 2014 18:16:47 +0100, Richard Heathfield wrote: > > > The only ways to get rid of C, in decreasing order of severity are: > > > > (a) catastrophic global war, pestilence, or famine; > > (b) legislation of an alarmingly authoritarian nature; > > (c) the provision of an even more powerful language that is even > > more prone to being abused. > > (d) liability to the damages caused by software faults. Bad programmers write bad programs in any language. There is no such language that protects from software faults... > > > (b) > > bounds-checking imposes a performance penalty that at least some > > people are not prepared to tolerate. > > The necessity of bounds-checking is greatly overestimated. There is > no need to check for the bounds if the language constructs prevent > indices or iterators going out of the bounds. C lacks such > constructs, e.g. safe looping over the elements of a container or > array. In many if not most of the cases this does not involve any > explicit index at all and if it does, the index is guaranteed within > the bounds. Such primitives would offer a better performance over > crude C's pointer arithmetic as well. How so? Performance should be the same... Problem with C arrays is that they are converted to raw pointers and length information is lost. Errors come out because wrong array length is passed around or not at all... -- Click OK to continue...