On: Adam Langley's Pond: Secure Async Messaging

[agwa]

> also, is code like this https://github.com/agl/pond/blob/master/server/server.go#L15... just extreme defensive programming? or is there some other reason for the check (eg is not everything locked)?

That's checking for integer overflow - an often-overlooked source of many security vulnerabilities.

That's a signed integer though, and I don't know if signed integer overflow has defined behavior in Go. In C that would be undefined behavior, allowing the compiler to do potentially nutty things, so you would want to do the overflow check before the increment. (Edit: considering who the author of this code is, I would assume that Go has sane defined behavior on signed integer overflow ;-)

[packetslave → agwa]

From the Go language spec:

"For signed integers, the operations +, -, *, and << may legally overflow and the resulting value exists and is deterministically defined by the signed integer representation, the operation, and its operands. No exception is raised as a result of overflow. A compiler may not optimize code under the assumption that overflow does not occur. For instance, it may not assume that x < x + 1 is always true."

  func main() {
    var foo int8 = 127
    fmt.Println(foo + 1)
  }

prints -128

[agwa → packetslave]

Cool, thanks for the info!

Looking at the spec, I see that signed integers are elsewhere defined to be represented using 2's complement, so this is completely kosher.