[dns-operations] Robert Graham - A Quick Review of the BIND9 Code.

[Robert Edmonds]

Jim Popovitch wrote:
> On Thu, Jul 30, 2015 at 1:55 PM, Jim Popovitch <jimpop at gmail.com> wrote:
> > On Thu, Jul 30, 2015 at 1:43 PM, Paul Vixie <paul at redbarn.org> wrote:
> >>
> >>
> >> Roland Dobbins wrote:
> >>> <http://blog.erratasec.com/2015/07/a-quick-review-of-bind9-code.html>
> >>
> >> he's completely right about the const problems in that code base. const
> >> is in C what constraints are in SQL-- more is better.
> >>
> >> he's completely wrong about turning off assertions in production-compiled code, and in his comments about the performance requirements.
> >>
> >> i disagree, stylistically, with his recommendation never to use strcpy, especially when the alternative chosen is often strlcpy, which permits undetected truncation. in his example, the compiler should have flagged the size_t to unsigned int conversion coming out of strlen.
> >>
> >> does anyone know of a linter or compiler that can detect opportunities
> >> to add 'const'?
> >
> > IIRC,  gcc -02 level optimization will auto add consts if it detects constants.
> >
> 
> Look here:  https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
> search for "-fipa-cp"

'const' is a type qualifier.  Generally, appropriate use of the 'const'
qualifier in APIs allows the compiler to detect at compile time certain
kinds of memory writes that should be forbidden by the API's contract.
If you, e.g., don't mark a function's parameter as 'const' when it
should have been, there's nothing the compiler can do if you then write
to that variable.  The type system says that write is perfectly legal.

gcc's "-fipa-cp" enables "interprocedural constant propagation", which
"analyzes the program to determine when values passed to functions are
constants and then optimizes accordingly".  That has pretty much nothing
to do with detecting opportunities for adding 'const' qualifiers to APIs
which lack them.

-- 
Robert Edmonds