Microsoft has made another huge step towards open source: Checked C

Microsoft has made another huge step towards open source: Checked C
GuideMicrosoft open-source Checked C, an extension of the C language, can be used to solve a series of security-related risks in the C language. As shown in its name, Checked C adds a check for the C language. This check can help developers check common programming errors, for example, the cache occupies buffer overruns, memory access out of bounds, and incorrect type conversion. These programming errors are often the root cause of many major security vulnerabilities, such as shell-breaking vulnerabilities, Heartbleed vulnerabilities, and Sandworm.

Checked C solves these problems by modifying the control pointer. the pointer is used by programmers to define the memory address operated by their code. When the number of pointers is large, pointer control is often prone to chaos, and the larger the project, the more difficult it is to trace them, similar to Chromium, Firefox, Office, OpenSSL, and other large code libraries, you can see a large number of such problems in their change logs. "Checked C allows programmers to better describe how they want to use pointers and the memory range to which pointers should point," Microsoft said. "This information can be used to add detection in the runtime environment, to detect data access errors, rather than making them happen without notice."

Checked C will also allow developers to detect misuse of functions that they think are available in the C language but are not actually available. In the programming world, this function is called bounds checking. It is used to check whether a variable/pointer is assigned a value within its range, C # And Rust already have such functions, and they are more than that. However, unfortunately, the widely used C and C ++ do not have such a function. Microsoft wants to make the smallest changes to the existing C/C ++ program, using Checked C can improve security, which will attract a large number of developers to start using Checked C.

The Checked C project has been put on GitHub. This is not the first time Microsoft made its own interpretation of the basic programming language. Previously, programmers of the company created a JavaScript superset named TypeScript, which has been widely recognized.

From: https://linux.cn/article-7474-1.html

Address: http://www.linuxprobe.com/microsoft-checkedc-opensource.html