Portability assumptions - Revision history

TomYu at 20:43, 24 May 2012

2012-05-24T20:43:25Z

TomYu at 20:11, 24 May 2012

2012-05-24T20:11:18Z

TomYu: /* C compiler */ Add signed<->unsigned conversion stuff. Clean up wording.

2012-02-22T23:09:52Z

‎C compiler: Add signed<->unsigned conversion stuff. Clean up wording.

TomYu at 22:58, 22 February 2012

2012-02-22T22:58:23Z

Ghudson: Updates resulting from January 2012 discussion

2012-02-15T19:44:36Z

Updates resulting from January 2012 discussion

TomYu at 02:54, 1 October 2010

2010-10-01T02:54:16Z

TomYu: New page: {{policy-draft}} This is a partial list of portability assumptions made by the MIT krb5 source code. It currently duplicates some content from Supported platforms, which will be repl...

2010-09-28T22:00:42Z

New page: {{policy-draft}} This is a partial list of portability assumptions made by the MIT krb5 source code. It currently duplicates some content from Supported platforms, which will be repl...

New page

{{policy-draft}}

This is a partial list of portability assumptions made by the MIT krb5 source code. It currently duplicates some content from [[Supported platforms]], which will be replaced with a pointer to this page in the future.

== C compiler ==

We assume a C compilation environment equivalent to a freestanding C89 (ISO/IEC 9899:1990) implementation. Freestanding language support for C99 (ISO/IEC 9899:1999) does not have to be complete, but we use some C99 features:

* The C99 <code>inline</code> feature should be supported.
* External identifiers of at least 31 significant initial characters should be supported.
* The <code>long long int</code> type, or some reasonably equivalent means of declaring integers of at least 64 bits of precision, should be supported.

We require behavior that is formally unspecified by C89:

* Null pointers are represented as all bits zero. This means that a pointer members of a structure can be initialized to null pointer values by <code>calloc()</code> or <code>memset()</code>.

We require behavior that is formally implementation-defined by C89:

* Characters are 8 bits wide.
* Integers are represented as two's-complement.
* Integers have no padding bits.

We require some behavior that is formally undefined by C89:

* Pointers to <code>void</code> can be cast to pointers to functions.

== C runtime libraries ==

We expect that substantially all of the C89 and SUSv3/POSIX.1 library interfaces are available.

We expect that the <code>snprintf()</code> family of functions from C99 and SUSv3/POSIX.1 is available and either conforms to the standards or deviates from the standard behavior in one of a small number of ways:

* It may return -1 if the target buffer is not sufficiently large.
* It may treat <code>n</code> of zero or a null target pointer as an error condition.

On Solaris, precision specifiers on string formats in <code>printf()</code> family functions may count columns rather than bytes if the application is not compiled in a standard-conforming environment. We are investigating the security impact of this behavior.

The C99 <code>stdint.h</code> or <code>inttypes.h</code> capabilities should be available.

@@ Line 19: / Line 19: @@
 * Characters are 8 bits wide. (This is a POSIX requirement.)
-* Signed integers are represented as two's-complement, and all possible bit combinations represent valid values. (The absolute value of the bounds are not the same.)
+* Signed integers are represented as two's-complement, and all possible bit combinations represent valid values. (The absolute value of the bounds are not the same. C99 allows a two's-complement integer representation with sign bit one and value bits all zero to be a trap representation.)
 * Converting an unsigned integer to the corresponding signed integer type when the unsigned integer value is larger than the largest signed integer value will preserve the bit pattern of the representation. (Equivalently, the conversion from a negative signed integer to the corresponding unsigned integer type is invertible.)
 * Integers have no padding bits.

@@ Line 18: / Line 18: @@
 We require behavior that C89 formally declares to be implementation-defined:
-* Characters are 8 bits wide.
+* Characters are 8 bits wide. (This is a POSIX requirement.)
 * Signed integers are represented as two's-complement, and all possible bit combinations represent valid values. (The absolute value of the bounds are not the same.)
 * Converting an unsigned integer to the corresponding signed integer type when the unsigned integer value is larger than the largest signed integer value will preserve the bit pattern of the representation. (Equivalently, the conversion from a negative signed integer to the corresponding unsigned integer type is invertible.)
 * Integers have no padding bits.
 We require some behavior that C89 formally declares to be undefined:

@@ Line 12: / Line 12: @@
 * Variadic macros should be supported.
-We require behavior that is formally unspecified by C89:
+We require behavior that C89 formally leaves unspecified:
 * Null pointers are represented as all bits zero. This means that pointer members of a structure can be initialized to null pointer values by <code>calloc()</code> or <code>memset()</code>.
-We require behavior that is formally implementation-defined by C89:
+We require behavior that C89 formally declares to be implementation-defined:
 * Characters are 8 bits wide.
 * Integers have no padding bits.
-We require some behavior that is formally undefined by C89:
+We require some behavior that C89 formally declares to be undefined:
 * Pointers to <code>void</code> can be cast to pointers to functions.

@@ Line 1: / Line 1: @@
 {{policy-draft}}
-This is a partial list of portability assumptions made by the MIT krb5 source code.  It currently duplicates some content from [[Supported platforms]], which will be replaced with a pointer to this page in the future.
+This is a partial list of portability assumptions made by the MIT krb5 source code.
 == C compiler ==

@@ Line 10: / Line 10: @@
 * External identifiers of at least 31 significant initial characters should be supported.
 * The <code>long long int</code> type, or some reasonably equivalent means of declaring integers of at least 64 bits of precision, should be supported.
 We require behavior that is formally unspecified by C89:
@@ Line 27: / Line 28: @@
 == C runtime libraries ==
-We expect that substantially all of the C89 and SUSv3/POSIX.1 library interfaces are available.
+We expect that substantially all of the C89 and SUSv3/POSIX.1 library interfaces are available.  We expect POSIX signal interfaces to be available on Unix-like platforms.
 We expect that the <code>snprintf()</code> family of functions from C99 and SUSv3/POSIX.1 is available and either conforms to the standards or deviates from the standard behavior in one of a small number of ways:
@@ Line 41: / Line 42: @@
 * <code>free()</code> and <code>realloc()</code> must work on null pointers.

@@ Line 13: / Line 13: @@
 We require behavior that is formally unspecified by C89:
-* Null pointers are represented as all bits zero. This means that a pointer members of a structure can be initialized to null pointer values by <code>calloc()</code> or <code>memset()</code>.
+* Null pointers are represented as all bits zero. This means that pointer members of a structure can be initialized to null pointer values by <code>calloc()</code> or <code>memset()</code>.
 We require behavior that is formally implementation-defined by C89:
@@ Line 37: / Line 37: @@
 The C99 <code>stdint.h</code> or <code>inttypes.h</code> capabilities should be available.