Re:size_t-to-int vulnerability in Linux’s filesystem layer
by mnw21cam on Tuesday July 20, 2021 @11:28AM
(#27894939)
Add Java to that list.
[ Parent
| on HN ]
Re:size_t-to-int vulnerability in Linux’s filesystem layer
by csharptwdec19 on Tuesday July 20, 2021 @12:29PM
(#27895884)
Same for C#. Any narrowing truncation needs to be an explicit cast. Widening is typically allowed implicitly, although in the case of the 'decimal' (128 bit struct representing a 'higher precision' floating point) type you still need an explicit cast from a 'double', since there are cases where that conversion can still change the value or fail (i.e. Infinity/NaN)
Re:size_t-to-int vulnerability in Linux’s filesystem layer
by pjmlp on Tuesday July 20, 2021 @01:06PM
(#27896357)
Microsoft is considering turning on by default checked arithmetic in the 2022 Visual Studio templates, by the way.
Re:size_t-to-int vulnerability in Linux’s filesystem layer
by irogers on Tuesday July 20, 2021 @05:02PM
(#27899292)
It can catch people by surprise that Java's narrowing conversions may not preserve the sign. For example, the following is broken:
class TimestampedObject implements Comparable<TimestampedObject> { long timestamp; int compareTo(TimestampedObject other) { return (int)(timestamp - other.timestamp); } ... }
ErrorProne catches this: https://errorprone.info/bugpattern/BadComparable
Re:size_t-to-int vulnerability in Linux’s filesystem layer
by paulddraper on Tuesday July 20, 2021 @03:15PM
(#27897937)
Noo! This idea is super new and was invented by Go/Rust.