Re: A Famous Security Bug

On 24/03/2024 19:58, bart wrote:

On 24/03/2024 15:53, Michael S wrote:

#include <stdio.h>
#include <stddef.h>
>
int main(void)
{
   char* p0 = (char*)((size_t)main & -(size_t)0x10000);
   printf("%c%c\n", p0[0], p0[1]);
   return 0;
}
>
>
That would work for small programs. Not necessarily for bigger
programs.
>

 I'm not sure how that works. Are EXE images always loaded at multiple of 64KB? I suppose on larger programs it could search backwards 64KB at a time (although it could also hit on a rogue 'MZ' in program data).
 My point however was whether C considered that p0[0] access UB because it doesn't point into any C data object.

As it stands in the code, I believe it is undefined behaviour.

 If so, it would make access to memory-mapped devices or frame-buffers, or implementing things like garbage collectors, problematical.

As I wrote (more than once), the C way to handle this is "volatile". Volatile accesses are implementation-defined, and are "observable behaviour" - therefore the compiler generates code that makes exactly the read and write accesses you ask for when they are done using a volatile-qualified lvalue.