Date: Wed, 09 Jan 2013 12:02:29 +0100 From: John Spencer <maillist-musl@...fooze.de> To: musl@...ts.openwall.com CC: Luca Barbato <lu_zero@...too.org>, basile@...nsource.dyc.edu Subject: NULL glibc defines NULL as __null: a magic variable supplied by GCC and compatibles which always has pointer context. musl defines NULL to 0 in C++. this is correct per the standard, but breaks a lot of software on 64bit archs, because it promotes to int. for example there are 140 variadic functions in glib/gtk, most of them depend on a so-called sentinel value (nullptr end marker). examples: http://developer.gnome.org/gobject/2.35/gobject-The-Base-Object-Type.html#g-object-new http://developer.gnome.org/gobject/2.35/gobject-The-Base-Object-Type.html#g-object-get any C++ program that uses those variadic functions and uses NULL as the sentinel, will invoke UB and consequently segfault on musl, with a very hard-to-debug backtrace (you cannot inspect variadic arguments in gdb (unless you know exactly what kind of asm gcc creates and how to read it), but exactly those arguments will end up being bogus). the first such bug i encountered (in audacity) costed me several hours of debugging distributed over 2 days. note that most example code involving these variadic functions is written in C, and happily uses NULL, as the problems surrounding NULL are not exactly well-known. http://gustedt.wordpress.com/2010/11/07/dont-use-null/ so the C++ guys basically just copypaste existing C code snippets (which are theoretically broken, but work in any real world implementation), and since it works in their environment they assume the code is correct. after having fixed audacity, i tackled the segfaults encountered in evince. here not even evince itself is broken, but also poppler, on which it depends. i've fixed the bugs in evince since, but still need to tackle the UB in poppler. frankly speaking i'm not very willing to go into the trouble of debugging any C++ gtk application, and reporting the bugs i found. when i discussed this with evince developers, they were asking all the time "why does it work for me ? why didn't it break for anyone ?" i told them that in C++ NULL expands to 0 and it worked because of luck. after discussing with them for about half an hour, i got them to the point where they agreed to merge a patch if i come up with one. had i told them that i use another libc which does things differently regarding NULL, i am not sure if i could have convinced them to change their code. at this point the issue in evince is not fixed, i still need to create a patch based on their current git master, subscribe to their ML, send them the patch and hope that they haven't changed their mind. so for me, there are 3 options how to deal with issue in the future: 1) go into the trouble of debugging all future C++ apps i will port, potentially spending hours to fix each of them, and then even more hours discussing this topic on their mailing lists. since sabotage will very likely only support a small subset of these programs, there will remain a lot of others that stay broken. the gentoo guys or whoever is going to port them will have a *very* hard time figuring out why it crashes for them on musl. this approach is in my eyes insane, as it will need a huge investment of time and nerves, and the number of broken C++ apps is theoretically infinite. (as a side note: when i googled for g_signal_emit, i found multiple bug reports to multiple projects, of which the backtraces showed exactly the kind of varargs UB that i encountered. all of them were not fixed, but merely worked around. apparently the developers of these projects didnt find the real cause of their bugs. this is not unlikely, as it is very hard to find out whats going on. https://bugs.launchpad.net/compiz/+bug/932382 https://trac.transmissionbt.com/ticket/1135 ... ) 2) change musl so it is compatible with those apps. this would mean: #if defined(__GNUC__) && defined(__cplusplus__) #define NULL __null #elif defined (__cplusplus__) #define NULL 0 #else #define NULL (void *) 0 /* for C code */ #end this change is the easiest solution: any problem will be magically fixed. 3) create some kind of code analysis tool that will scan C++ code for usage of NULL that emits warnings for each occurence of NULL used in a variadic function call. the results could then be used to created automated patches and used in distros based on musl and sent to the corresponding package maintainers. i suspect it is possible to convince the authors of the "cppcheck" program to add such a check, as i alreaded contacted them in the past and they seemed very cooperative. this could be tackled as a side-project even if we decide for option 2. i'm welcoming any comments on the issue. i'm especially interested what the gentoo developers think.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.