Re: [musl] Potential bug in __res_msend_rc() wrt to union initialization.

["Jₑₙₛ Gustedt" <jens.gustedt@inria.fr>]

Hi,
actually the introduction of `{}` versus `{0}` in C23 was not meant to
provide any difference in semantics, just to make the syntax nicer and
consistent with C++.

on Tue, 19 Mar 2024 12:08:32 -0400 you (Rich Felker <dalias@libc.org>)
wrote:

> On Tue, Mar 19, 2024 at 08:55:22AM -0700, Mike Cui wrote:
> > On Tue, Mar 19, 2024 at 8:42 AM Rich Felker <dalias@libc.org> wrote:
> >   
> > > On Tue, Mar 19, 2024 at 08:04:31AM -0700, Mike Cui wrote:  
>  [...]  
>  [...]  
>  [...]  
>  [...]  
>  [...]  
>  [...]  
>  [...]  
> > > types.
> > >
> > > No, the part below that you didn't reply to covers unions:
> > >
> > >  
> > The full 6.7.9 ¶10:
> > 
> > 10 If an object that has automatic storage duration is not
> > initialized explicitly, its value is indeterminate. If an object
> > that has static or thread storage duration is not initialized
> > explicitly, then:
> > - if it has pointer type, it is initialized to a null pointer;
> > - if it has arithmetic type, it is initialized to (positive or
> > unsigned) zero;
> > - if it is an aggregate, every member is initialized (recursively)
> > according to these rules, and any padding is initialized to zero
> > bits;
> > - if it is a union, the first named member is initialized
> > (recursively) according to these rules, and any padding is
> > initialized to zero bits;
> > 
> > The second part that you quoted applies to "static or thread storage
> > duration". The first sentence specifically says that anything not
> > initialized is indeterminate.
> > The only other paragraph which invokes 6.7.9 p10 is 6.7.9p21, which
> > also does not apply to unions. (p21 ensures that the "ns" array of
> > unions in the code would be zeroed out, but not the "sa" which a
> > single union allocated on the stack.)  
> 
> ¶19 says:
> 
>     "all subobjects that are not initialized explicitly shall be
>     initialized implicitly the same as objects that have static
>     storage duration."
> 
> The term "subobject" does not seem to be defined, so there's some
> ambiguity, but I would read ¶19 as applying the above text about
> static unions to automatic ones.
> 
> In any case, what clang wants to do here seems like a big gratuitous
> footgun. We'll make the code in musl safe against this but I suspect
> it will have lots of bad effects elsewhere...

To avoid such differences in interpretation, the simplest solution
seems to be to always put the biggest union member first, or to even
add an artificial first one `char [size-of-the-union] __dummy;`, such
that this is always 0-byte initialized if there is any initialization
at all.

Jₑₙₛ

-- 
:: ICube :::::::::::::::::::::::::::::: deputy director ::
:: Université de Strasbourg :::::::::::::::::::::: ICPS ::
:: INRIA Nancy Grand Est :::::::::::::::::::::::: Camus ::
:: :::::::::::::::::::::::::::::::::::: ☎ +33 368854536 ::
:: https://icube-icps.unistra.fr/index.php/Jens_Gustedt ::