Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Every time you write '+' in a C program between two signed values, do you do an overflow check beforehand? Do you know what it takes to write that overflow check?

But UB isn't the problem here. You can make two's complement wraparound the defined behavior, and programs which fail to check their arithmetic are very likely to be wrong.

This is already the case with unsigned overflow: it's defined to wrap around. Yet many many programs are vulnerable because they do something like malloc(nitems * size) and carry on thinking they must've gotten the wanted amount of memory.

Most of the time, you really have to do the right checks whether your arithmetic is signed or not. Whether wraparound is defined or not.



With two's complement wraparound being defined behaviour, you have easy ways of checking for wraparound - checking the signs of inputs vs outputs.

In any case, I'm bored of discussing this with people who haven't studied the problem.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: