News for hackers. Stuff that matters.
Re:Why did the OpenSSL punycode vulnerability happen by tester756 on Wednesday November 02, 2022 @07:39PM (#33444419)
>Doing this sort of thing efficiently may also mean that you're tempted to remove something like a bounds check. After all, if you already know that the value is 5 bytes, why check on every access? People really want parsers to be fast.

In what kind of software bounds check has this big perf. penalty?

The only people I've heard talking about such a stuff were firmware devs.

>Further, in C, buffers don't have lengths attached to them. In every other language you typically don't work with null terminated strings. So now you have to manage sizes of things throughout your parser.

Cannot C have some wrapper over those poor strings

that leads to better safety?

Re:Why did the OpenSSL punycode vulnerability happen by insanitybit on Wednesday November 02, 2022 @07:48PM (#33444526)
> In what kind of software bounds check have this significant perf. penalty?

All kinds. But a lot of it is just that parsers are extremely easy to benchmark and benchmarks promote optimization.

> Cannot C have some wrapper over those poor strings

Sure, but there's nothing native.

Re:Why did the OpenSSL punycode vulnerability happen by tester756 on Wednesday November 02, 2022 @07:51PM (#33444564)
>Sure, but there's nothing native.

But why? strings are used by all programmers everyday

I struggle to understand why you wouldn't want to make them state of the art, or decent at least.

Re:Why did the OpenSSL punycode vulnerability happen by thephyber on Wednesday November 02, 2022 @08:15PM (#33444854)
> > Sure, but there's nothing native.

> But why? strings are used by all programmers everyday

Different kinds of strings can have extremely different performance profiles.

A statically allocated string of ASCII (single byte) characters.

A dynamically allocated string of unicode (multibyte) characters where the length of allocation is not known ahead of time is very different. C requires the developer to know the differences and knows how to deal with them treat them.

Re:Why did the OpenSSL punycode vulnerability happen by insanitybit on Wednesday November 02, 2022 @07:53PM (#33444586)
C is an extremely conservative language. You don't even get booleans unless you're in C99 and import it.
Re:Why did the OpenSSL punycode vulnerability happen by int_19h on Thursday November 03, 2022 @06:43AM (#33449193)
You do get them without #include <stdbool.h>, you'll just have to contend with ugly spellings like _Bool and _True.
Re:Why did the OpenSSL punycode vulnerability happen by anjbe on Thursday November 03, 2022 @07:00AM (#33449307)
bool, true, and false as native keywords are on track to show up in C23. https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2393.pdf
Re:Why did the OpenSSL punycode vulnerability happen by pjmlp on Thursday November 03, 2022 @08:38AM (#33450090)
Because WG14 doesn't care about security, for them C is basically a portable macro assembler with added conveniences.