You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I (@nealkruis) am going to start documenting things here as a draft while I wrap my head around all the different 32-bit representations.
In CSE, most record data members (especially those set through the user input language) are stored as 32-bit values.
CSE exploits the IEEE 754 definition of NaN to encode payload information about record members to indicate:
If the value is set by the user or not
If the value is supposed to be autosized
If the value is defined by the user as an expression (and which expression it corresponds to)
If the value is a choice input (and which choice value it contains)
This exploit relies on relatively consistent implementations across compilers. However, per cppreference.com:
In IEEE 754, the most common binary representation of floating-point numbers, any value with all bits of the exponent set and at least one bit of the fraction set represents a NaN. It is implementation-defined which values of the fraction represent quiet or signaling NaNs, and whether the sign bit is meaningful.
The only real risk in this approach is when a floating point operation yields a signaling or quiet NaN value and CSE attempts to process its payload into a meaning that is not intended. In order to prevent this, we need to attempt to limit payload interpretations to bit patterns that are not commonly used as signaling or quiet NaNs in common compiler implementations.
Nomenclature:
0 bit must be zero
1 bit must be one
X bit may be either zero or one
Z all bits must contain at least one zero
N all bits must contain at least one one
B all bits must contain at least one zero and at least one one
Here are the rules (as far as I can tell):
0 00000000 00000000000000000000000: 0
1 00000000 00000000000000000000000: -0
0 11111111 00000000000000000000000: inf
1 11111111 00000000000000000000000: -inf
X ZZZZZZZZ XXXXXXXXXXXXXXXXXXXXXXX: Normal floating point number
I (@nealkruis) am going to start documenting things here as a draft while I wrap my head around all the different 32-bit representations.
In CSE, most record data members (especially those set through the user input language) are stored as 32-bit values.
CSE exploits the IEEE 754 definition of NaN to encode payload information about record members to indicate:
Here's a good primer on floating point bit patterns. The 32 bits are divided into:
This exploit relies on relatively consistent implementations across compilers. However, per cppreference.com:
The only real risk in this approach is when a floating point operation yields a signaling or quiet NaN value and CSE attempts to process its payload into a meaning that is not intended. In order to prevent this, we need to attempt to limit payload interpretations to bit patterns that are not commonly used as signaling or quiet NaNs in common compiler implementations.
Nomenclature:
0
bit must be zero1
bit must be oneX
bit may be either zero or oneZ
all bits must contain at least one zeroN
all bits must contain at least one oneB
all bits must contain at least one zero and at least one oneHere are the rules (as far as I can tell):
0 00000000 00000000000000000000000
: 01 00000000 00000000000000000000000
: -00 11111111 00000000000000000000000
: inf1 11111111 00000000000000000000000
: -infX ZZZZZZZZ XXXXXXXXXXXXXXXXXXXXXXX
: Normal floating point number0 11111111 10000000000000000000000
:std::numeric_limits<float>::quiet_NaN()
0 11111111 01000000000000000000000
:std::numeric_limits<float>::signaling_NaN()
This leaves the following bit sets for CSE's "NANDLES":
X 11111111 1NNNNNNNNNNNNNNNNNNNNNN
: Quiet NaNsX 11111111 0XNNNNNNNNNNNNNNNNNNNNN
: Signaling NaNsNANDLES (current):
1 11111111 00000000000000000000000
: Unset (Note: this is also-inf
)1 11111111 00000001111111111111111
: Autosizing1 11111111 0000000BBBBBBBBBBBBBBBB
: Expressions (bottom 16 bits = expression index)0 11111111 XXXXXXXXXXXXXXXXXXXXXXX
: Choices (top 7 bits = choice index; Note: Overlap withinf
, std quiet NaN, and Signaling NaN)The text was updated successfully, but these errors were encountered: