linux-kernel - Re: somebody dropped a (warning) bomb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 8 Feb 2007 11:53:38 -0800 (PST)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Jan Engelhardt <jengelh@...ux01.gwdg.de>
cc:	Jeff Garzik <jeff@...zik.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: somebody dropped a (warning) bomb

On Thu, 8 Feb 2007, Jan Engelhardt wrote:
> 
> I generally have to agree with you about the unsigned char* vs char*. It 
> is a problem of the C language that char can be signed and unsigned, and 
> that people, as a result, have used it for storing 
> "shorter_than_short_t"s.
> 
> What C needs is a distinction between char and int8_t, rendering "char" 
> an unsigned at all times basically and making "unsigned char" and 
> "signed char" illegal types in turn.

No, it's really more fundamental than that.

Exactly because "char *" doesn't have a defined sign, only a TOTALLY 
INCOMPETENT compiler will warn about its signedness.

The user has clearly stated "I don't care about the sign". If a compiler 
complains about us passing "unsigned char *" (or, if "char" is naturally 
unsigned on that platform, "signed char *") to strcmp then that compiler 
IS BROKEN. Because "strcmp()" takes "char *", which simply DOES NOT HAVE a 
uniquely defined sign. 

That's why we can't have -Wpointer-sign on by default. The gcc warning is 
simply *crap*.

If you were to have

	extern int strcmp(signed char *);

and would pass *that* an "unsigned char", it would be a real and valid 
sign error. But just plain "char *" isn't signed or unsigned. It's 
"implementation defined", and as such, if the programmer used it, the 
programmer clearly doesn't care. If he cared, he would just state the 
signedness explicitly.

It really is that simple. gcc is broken. The C language isn't, it's purely 
a broken compiler issue.

The other things in the kernel I'd be willing to fix up. But I simply 
refuse to work around a known-buggy warning.

		Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/