C++ Annex K safe C11 functions

Hello

This file lists part of Annex K “stdint.h”

But main C++ page doesn’t mention Annex K. Is Annex K really fully supported?

Some background
C11 standard, ISO/IEC 9899:2011 added Annex K safe functions like strncpy_s STDC_LIB_EXT1 Jonny

Hello

This file lists part of Annex K “stdint.h”
https://clang.llvm.org/doxygen/stdint_8h_source.html

But main C++ page doesn’t mention Annex K. Is Annex K really fully supported?

That’s generally not up to us; that’s part of the C standard library, not part of the compiler.

The one part of Annex K that is part of the compiler, according to the usual division of responsibilities, wherein the compiler provides the freestanding headers and the C standard library provides the rest, is the definition of rsize_t in <stddef.h> and the definition of RSIZE_MAX in <stdint.h>, and Clang provides those if STDC_WANT_LIB_EXT1 is defined. However, we do not define STDC_LIB_EXT1 because, as noted, that’s not up to us, and we have no idea what your C standard library supports.

So in that sense, we implement the part of Annex K that is in our domain.

Some background
https://clang.llvm.org/compatibility.html
https://clang.llvm.org/cxx_status.html

I’m not sure what these are supposed to show: Annex K is optional in C, and not part of C++.

Thank you for your reply Richard.

    Hello

    This file lists part of Annex K "stdint.h"
    https://clang.llvm.org/doxygen/stdint_8h_source.html

    But main C++ page doesn't mention Annex K. Is Annex K really fully
    supported?

That's generally not up to us; that's part of the C standard library, not part of the compiler.

The one part of Annex K that *is* part of the compiler, according to the usual division of responsibilities, wherein the compiler provides the freestanding headers and the C standard library provides the rest, is the definition of rsize_t in <stddef.h> and the definition of RSIZE_MAX in <stdint.h>, and Clang provides those if __STDC_WANT_LIB_EXT1__ is defined. However, we do not define __STDC_LIB_EXT1__ because, as noted, that's not up to us, and we have no idea what your C standard library supports.

I use glibc, it doesn't support Annex K. We are keen to use Annex K functionality, so looking around for options.

Do you know if Clang has any intention to develop support for a libc C11 with Annex K Support?

I'm looking around, and came across this project
https://github.com/rurban/safeclib/blob/master/README

So in that sense, we implement the part of Annex K that is in our domain.

    Some background
    https://clang.llvm.org/compatibility.html
    https://clang.llvm.org/cxx_status.html

I'm not sure what these are supposed to show: Annex K is optional in C, and not part of C++.

It would be good if what you state could be added to the compatibility page, that Annex K is supported only for stdint.h, but that clang requires a libc which supports C11 Annex K functions/implementation.

Cheers, Jonny

I think clang could offer builtins which provide some of the Annex K building blocks, and let libc implementations provide the rest (using the clang builtins when available).

I’m interested in implementing these builtins, unless someone beats me to it. User code often uses Annex K to provide guarantees that are now redundant with trivial automatic variable initialization (llvm.org/rL349442), and I’d like to reduce the hit they’re taking. Here are some notes I wrote for myself a little while ago:

Providing the primitives for memset_s would be great. It is a genuinely useful part of Annex K. I will note that the majority of Annex K is of little practical use though, due to the global (not thread local) customizable constraint handler. set_constraint_handler_s and friends don’t play nice when you don’t control the entire codebase / process, especially in multithreaded situations.

Hi! Sounds great
How about setting uninitialised variables to 0xdeadbeef or 0xabbaabba so its easily identifiable when they crop up in use?
We used to clear buffers to 0x11111111 and stack to 0x22222222 I recall

The URL should be llvm.org/r349442 BTW

Jonny

Hi! Sounds great
How about setting uninitialised variables to 0xdeadbeef or 0xabbaabba so its easily identifiable when they crop up in use?
We used to clear buffers to 0x11111111 and stack to 0x22222222 I recall

This isn’t relevant to the Annex K discussion, let’s keep this thread focused. We discussed initialization values in the original thread as well as the code review, it’s worth reading through that to see why I chose the values I did (mainly so pointers are invalid, and they’re repeated byte-values so the code generation is better).

OK.

BTW, I don't think Clang has its own libc does it? Could the other Annex K be added in a libc.

Or at a push, in Clang's libc++ (I know it is meant to be C11 standard, not C++, but C++ usually includes C functions anyway)

Jonny

Hi! Sounds great
How about setting uninitialised variables to 0xdeadbeef or 0xabbaabba so its easily identifiable when they crop up in use?
We used to clear buffers to 0x11111111 and stack to 0x22222222 I recall

This isn’t relevant to the Annex K discussion, let’s keep this thread focused. We discussed initialization values in the original thread as well as the code review, it’s worth reading through that to see why I chose the values I did (mainly so pointers are invalid, and they’re repeated byte-values so the code generation is better).

OK.

BTW, I don't think Clang has its own libc does it?

Correct, clang doesn’t have its own libc. It does have some interception headers for some things, and plenty of builtins.

Could the other Annex K be added in a libc.

What do you mean?

Or at a push, in Clang's libc++ (I know it is meant to be C11 standard, not C++, but C++ usually includes C functions anyway)

I’d rather not. I want to implement builtins, and let libc implementations use them as they wish.

Hi! Sounds great
How about setting uninitialised variables to 0xdeadbeef or 0xabbaabba
so its easily identifiable when they crop up in use?
We used to clear buffers to 0x11111111 and stack to 0x22222222 I recall

This isn’t relevant to the Annex K discussion, let’s keep this thread
focused. We discussed initialization values in the original thread as
well as the code review, it’s worth reading through that to see why I
chose the values I did (mainly so pointers are invalid, and they’re
repeated byte-values so the code generation is better).

OK.

BTW, I don’t think Clang has its own libc does it? Could the other Annex
K be added in a libc.

Yes, a libc implementation can certainly implement Annex K (or at least the non-freestanding parts of it) itself. It would also be feasible for a third-party library to provide an implementation of Annex K, and to interject wrapper headers between user code and the underlying libc providing the extra symbols.

Or at a push, in Clang’s libc++ (I know it is meant to be C11 standard,
not C++, but C++ usually includes C functions anyway)

While C++ includes most of the C standard library, it excludes these parts; even if libc++ chose to provide an implementation of the functions inherited from C, it should still not include these ones.

Sounds good. I've not created a clang ticket on https://bugs.llvm.org/enter_bug.cgi to track adding the safe C11 functions. Let me know if you'd like me to file it.

Cheers, Jonny

Hi JF

Was just wondering how things were going adding these memset_s (and the others you mentioned).?

Jonny

Hi JF

Was just wondering how things were going adding these memset_s (and the others you mentioned).?

I haven’t started. It’s on my short list of things to do.

Long time Annex K observer here: I would just like to add my 2 cents.

I would very much like to see some kind of minimal compiler support for the bounds checking functions - memcpy_s, memmove_s, strcpy_s, strncpy_s, strcat_s - since overruns in their non-bounds-checked equivalents have been responsible for hundreds of security vulnerabilities over the years. It doesn’t have to be fully annex K compliant for my concerns, just has to obey the buffer boundaries. Some kind of minimal compiler support would also make cross platform programming much easier, since as of right now I use the bounds checking versions in code compiled for MSVC, and have to either #ifdef it out or lose the extra checking.

It has been mentioned in a recent thread about fortify, but what exactly
do you *miss* for implementing them on top of the existing
__builtin_object_size? That's what can already be used to implement
_FORTIFY=2 and I don't think Annex K is much different beyond all the
runtime crash junk.

Joerg