size_t-to-int vulnerability in Linux’s filesystem layer

Re:size_t-to-int vulnerability in Linux’s filesystem layer by jeffbee on Tuesday July 20, 2021 @11:30AM (#27894959)

I don't see any warnings for this narrowing parameter conversion.

  #include "stddef.h"

  short foo(short a) { return a % 42; }
  
  size_t bar(void) {
      size_t sz = ~0UL;
      return foo(sz);
  }

https://godbolt.org/z/3ec9v8Pa4

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by gruez on Tuesday July 20, 2021 @12:04PM (#27895481)

On MSVC, default project settings I get:

    warning C4267: 'argument': conversion from 'size_t' to 'short', possible loss of data

https://godbolt.org/z/nYeWT7zv6 (/W3 is the default warning level when creating a new project)

I saw these warnings so often that I assumed that every compiler had them.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by xeeeeeeeeeeenu on Tuesday July 20, 2021 @11:37AM (#27895049)

It warns if you add -Wconversion. Unfortunately, that flag generates lots of false positives (at least in gcc), so using it isn't always a good idea.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by morio on Tuesday July 20, 2021 @12:18PM (#27895720)

What kind of false positives are you seeing with gcc?

Personally I have never seen gcc spitting out a false positive. IMO it's always a good idea to explicitly downcast even if you know that it's 'safe'. That way someone else will see instantly what's going on. The fact that Rust requires it should tell us something.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by xeeeeeeeeeeenu on Tuesday July 20, 2021 @02:00PM (#27897025)

For example, I've just reported this: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101537

You can find more cases in the bugtracker. To be fair, it seems many of them were fixed in recent releases.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by Cloudef on Wednesday July 21, 2021 @12:38AM (#27902395)

The 1 and 0 are ints. It most likely complaints because the sign isn't same.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by jeffbee on Tuesday July 20, 2021 @12:01PM (#27895409)

It isn't ever a good idea. C programmers are just supposed to know about the conversion and promotion rules, every time they add a line, even though the rules are actually insanely complicated. Compiler warnings can't overcome this because programmers have no way of just discovering one of GCC's 726 warning flags, only a few of which are enabled by -Wall and -Wextra, most of which are way too noisy to serve a useful purpose.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by ototot on Tuesday July 20, 2021 @12:34PM (#27895944)

In my own small projects, I always add -Wconversion to build configuration. I think the false positive is affordable when you start from small piece of code.

[ Parent | on HN ]

Re:size_t-to-int vulnerability in Linux’s filesystem layer by saurik on Tuesday July 20, 2021 @11:38AM (#27895053)

Yeah; AFAIK you need something like clang-tidy's cppcoreguidelines-narrowing-conversions check (which everyone should definitely be using). (edit: But I'm wrong! That check is apparently similar to the -Wconversion mentioned by someone else.)

[ Parent | on HN ]