From owner-freebsd-toolchain@FreeBSD.ORG Mon Nov 7 01:20:51 2011 Return-Path: Delivered-To: freebsd-toolchain@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CB2F9106566B; Mon, 7 Nov 2011 01:20:51 +0000 (UTC) (envelope-from imp@bsdimp.com) Received: from harmony.bsdimp.com (bsdimp.com [199.45.160.85]) by mx1.freebsd.org (Postfix) with ESMTP id 7F63A8FC08; Mon, 7 Nov 2011 01:20:51 +0000 (UTC) Received: from 63.imp.bsdimp.com (63.imp.bsdimp.com [10.0.0.63]) (authenticated bits=0) by harmony.bsdimp.com (8.14.4/8.14.3) with ESMTP id pA71Kmhn062380 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES128-SHA bits=128 verify=NO); Sun, 6 Nov 2011 18:20:49 -0700 (MST) (envelope-from imp@bsdimp.com) Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Warner Losh In-Reply-To: Date: Sun, 6 Nov 2011 18:20:44 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <3AE02E7D-A4BD-492D-97E4-9BA7538ECE89@bsdimp.com> References: <20111105102102.GA54596@freebsd.org> <20111106172835.GO2258@hoeg.nl> <20111106203316.GA73216@freebsd.org> <4EB6F38E.2080006@FreeBSD.org> <20111106205805.GA78142@freebsd.org> <242747B7-3EAE-4988-A975-DC58B0997A6F@bsdimp.com> To: Rui Paulo X-Mailer: Apple Mail (2.1084) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0.1 (harmony.bsdimp.com [10.0.0.6]); Sun, 06 Nov 2011 18:20:49 -0700 (MST) Cc: Alexander Best , freebsd-toolchain@FreeBSD.org, Dimitry Andric Subject: Re: [poc] buildkernel + clang + -Werror X-BeenThere: freebsd-toolchain@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Maintenance of FreeBSD's integrated toolchain List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Nov 2011 01:20:51 -0000 On Nov 6, 2011, at 5:47 PM, Rui Paulo wrote: > On Nov 6, 2011, at 4:36 PM, Warner Losh wrote: >=20 >> On Nov 6, 2011, at 2:13 PM, Rui Paulo wrote: >>> The only argument against this tautological check that I agree with = is when the code is explicitly trying to be safe. If the developer = checks for "i < 0" when indexing an array he/she is trying to guard = against possible pitfalls in the future when someone suddenly decides to = change the variable type to become signed. One possible security = vulnerability was avoided because that developer checked for negative = values. >>> I'm against turning this off by default, but it should not cause an = error. >>=20 >> Except when you pass args back and forth between signed and unsigned = and back again. If you check < 0 in the middle, that's one more = security bug you thought you had fixed, but really you've done nothing = with. >=20 >=20 > Of course, but in the context of the compiler checks this argument = doesn't apply. It is also useful for code where the default differs from system to = system. For example, char are signed on some architectures, and = unsigned on others. This warning would expose cases where the < 0 check = was done for safety from those where it was done in error. Warner=