Re: immutable string type

[Tim Rühsen]

Hi Bruno,

On 28.12.19 12:17, Bruno Haible wrote:
> Would you find it useful to have an immutable string type in gnulib?

The idea is good in fact had similar thoughts/needs a while ago. IMO,
the use cases are mostly in the testing area (especially fuzzing).

As a more general approach, a function that switches already allocated
memory into read-only memory would be handy. Like in
 - m = malloc()
 - initialize m with some data
 - if in debug mode: call memmap_readonly(m) - from this point on 'm' is
read-only and a write leads to a segmentation fault.
 - ...
 - free(m)

Maybe it would best be integrated into glibc ?

Functions like iasprintf could then be built around existing functions
as needed, e.g. as static inline or as macro.

> In the simplest case, this would a 'const char *' where the 'const' is
> actually checked by the hardware. You allocate it through
> 
>    const char *str = iasprintf (...);
> 
> You use it like any 'const char *'.
> 
> You free it through
> 
>    ifree (str);
> 
> not free (str). And when you attempt to write into it:
> 
>    ((char *) str)[0] = 'x';
> 
> it crashes.
> 
> The benefits I imagine:
>   - no worry about security flaws through multithreaded accesses,
>   - in large applications: verification that no part of the application
>     is doing side effects that it shouldn't.
> 
> The implementation uses mmap() to create a read-only and a read-write
> view of the same memory area. The contents of the string is filled through
> the read-write view. All other operations are done through the read-only
> view, because the address os the string is the one of the read-only view.
> 
> This won't work on all platforms, e.g. HP-UX. But it will work on glibc
> systems, BSD, and Solaris, at least.

Regards, Tim

signature.asc
Description: OpenPGP digital signature