Software Development

#13: Post edited by

alx‭ · 2023-02-19T11:26:49Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
~~ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.~~
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
the following would have defined behavior, I guess:
```c
bool bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and "reading the representation is never Undefined Behavior" (or so I've been told).
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
the following would have defined behavior, I guess:
```c
bool bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#12: Nominated for promotion by

Alexei‭ · 2023-02-19T09:02:28Z (almost 2 years ago)

Copy Link

Raw

Markdown

#11: Post edited by

alx‭ · 2023-02-17T23:03:25Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
the following would have defined behavior, I guess:
```c
bool bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#10: Post edited by

alx‭ · 2023-02-17T23:03:01Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#9: Post edited by

alx‭ · 2023-02-17T21:25:16Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
~~This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>~~

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to my mind while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#8: Post edited by

alx‭ · 2023-02-17T21:02:42Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
~~int32_t x, y;~~
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
~~* y = x;~~
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* return x;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#7: Post edited by

alx‭ · 2023-02-17T21:00:23Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
~~The following would have defined behavior, I guess:~~
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
while the following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#6: Post edited by

alx‭ · 2023-02-17T20:59:50Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
~~if (i == 0) // <- UB~~
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (x == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
Moreover, while the following is UB:
```c
bool foo2(void)
{
int32_t x;
return (x == x); // <- UB
}
```
The following would have defined behavior, I guess:
```c
int bar2(void)
{
int32_t x;
return (memcmp(&x, &x, sizeof(x)) == 0);
}
```
The above should always return `true`, I guess, since the representation of a value, even if it's invalid, is the same, independent of how many times you read it (so far, I don't think ISO C considers quantum variables ;), as long as we don't invoke UB.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#5: Post edited by

alx‭ · 2023-02-17T20:52:31Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
~~Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me.~~
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me. It's like being able to look outside of the cave, but not being allowed to use that information.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#4: Post edited by

alx‭ · 2023-02-17T20:51:17Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
Being able to know the representation of an invalid value doesn't match very well with the concept of the abstract machine, it seems to me.
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#3: Post edited by

alx‭ · 2023-02-17T20:47:58Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
~~int foo(void)~~
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int bar(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#2: Post edited by

alx‭ · 2023-02-17T20:47:37Z (almost 2 years ago)

Copy Link

Raw

Markdown

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int foo(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

What does it mean that we can use memcmp(3) on invalid values?
ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.
The following code invokes UB:
```c
int foo(void)
{
int32_t x;
if (i == 0) // <- UB
return 0;
return 1;
}
```
However, the following seems to be allowed:
```c
int foo(void)
{
int32_t x, y;
if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
/*
* Could we do the following?
*
* y = x;
* return y;
*/
return 0;
}
return 1;
}
```
But does that memcmp(3) call give us any guarantees about the value stored in `x`? That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`? Or is it still UB to use the value after knowing its representation?
And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?
---
This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

#1: Initial revision by

alx‭ · 2023-02-17T20:46:54Z (almost 2 years ago)

Copy Link

Raw

Markdown

memcmp(3) memory containing invalid values

What does it mean that we can use memcmp(3) on invalid values?

ISO C allows comparing an invalid value through memcmp(3), because it doesn't read the value, but rather its representation, and reading the representation is never Undefined Behavior.

The following code invokes UB:

```c
int foo(void)
{
    int32_t  x;
    if (i == 0)  // <- UB
        return 0;
    return 1;
}
```

However, the following seems to be allowed:

```c
int foo(void)
{
    int32_t  x, y;
    if (memcmp(&x, "\0\0\0\0", sizeof(x)) == 0) {
        /*
         * Could we do the following?
         *
         *     y = x;
         *     return y;
         */
        return 0;
    }
    return 1;
}
```

But does that memcmp(3) call give us any guarantees about the value stored in `x`?  That is, if we know that the representation is `0`, can we assume that the value of `x` is precisely `0`?  Or is it still UB to use the value after knowing its representation?

And if it's still UB to read the variable even when we know that the representation is a valid one, what's the point in allowing one to memcmp(3) a variable with an invalid value, such as an uninitialized local variable, or a freed pointer?

---

This question came to me while discussing about use-after-free issues with realloc(3): <https://inbox.sourceware.org/gcc/3098fd18-9dbf-b4e9-bae5-62ec6fea74cd@opteya.com/T/>

c language-lawyer character-type

Communities

Post History