Re:Solutions to Integer Overflow
by js8 on Saturday September 03, 2016 @10:07AM
(#12419244)
I have to ask again: Why isn't there a better hardware support for overflows on x86? Mainframe CPUs do have an option to raise an exception condition on arithmetic overflow.
[ Parent
| on HN ]
I can't comment on his assessment, but here is what Dan Luu says: http://danluu.com/integer-overflow/#fnref:H
Based on discussions I've had here, I do agree that step one is just for more people to care. If more people care, it will eventually get the attention of hardware people.
I mostly care about this issue because of the security issues that arise (overflow is somewhere around #4 or #5 on the list of top root causes of security issues), and for all that a lot of programmers think they care about security, there's still a lot of programmers that are quite cavalier about fixing the root causes of these issues rather than occasionally fixing symptoms when you think of it.
> I mostly care about this issue because of the security issues that arise (overflow is somewhere around #4 or #5 on the list of top root causes of security issues)
How many of those overflow issues crucially have to be combined with memory safety problems to be weaponizable? I suspect the ratio is over 95%.
I do also care about the correctness issues. It's hard to write correct software on top of a foundation that will happily tell you that 130 + 130 = 4. There's a fundamental mismatch between what people think the operation means, and what it really means, and that's never a good thing.