<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" media="screen" href="/styles/xslt/rss.xslt"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:media="http://search.yahoo.com/mrss/" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:c9="http://channel9.msdn.com">
<channel>
	<title>Comment Feed for Channel 9 - David LeBlanc: Inside SafeInt</title>
	<atom:link rel="self" type="application/rss+xml" href="http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt/RSS"></atom:link>
	<image>
		<url>http://ecn.channel9.msdn.com/o9/previewImages/100/471099_100x75.jpg</url>
		<title>Channel 9 - David LeBlanc: Inside SafeInt</title>
		<link></link>
	</image>
	<description>SafeInt&amp;nbsp;is a C&amp;#43;&amp;#43; header containing the SafeInt class, non-throwing functions to check common operations, and the associated internal mechanisms. SafeInt is currently
 used extensively throughout Microsoft, with substantial adoption within Office and Windows.&amp;nbsp;David LeBlanc is a software engineer and security expert. You may know him from the

Writing Secure Code books. David and Michael Howard have helped raise the bar for software security inside Microsoft for several years now. David has mostly remained out of the limelight since he&#39;s much more interested in writing secure code than talking
 about writing secure code. Well, now David&#39;s going to be famous. Sorry, David. 
The great Ale Contenti joins us in this conversation to provide some context and ask some hard questions. Ale is a dev lead on the C&amp;#43;&amp;#43; libraries team.

You&#39;ve seen him a few times on 9. As you can imagine, he probably uses SafeInt in his own work.Here, we dig into the thinking behind SafeInt, how it works, how it&#39;s composed, when to use it, when not to use it and how it will evolve to meet new demands and support other compilers (SafeInt now supports gcc). Enjoy!
</description>
	<link></link>
	<language>en</language>
	<pubDate>Tue, 18 Jun 2013 05:21:31 GMT</pubDate>
	<lastBuildDate>Tue, 18 Jun 2013 05:21:31 GMT</lastBuildDate>
	<generator>Rev9</generator>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Another really interesting C&#43;&#43; video, thank you Charles! This class is really useful and beautifully written. I'll definitely start using it from now on in my projects as it&nbsp;is very easy to update&nbsp;existing code to take advantage&nbsp;of the&nbsp;features this class
 provides.&nbsp;</p>
<p>The C&#43;&#43; world is decidedly full of surprises, I'm looking forward for more C/C&#43;&#43; videos!</p>
<p>By the way, I'd love to see more videos&nbsp;going deep into some&nbsp;win32 stuff. There have been some&nbsp;interesting changes&nbsp;in these APIs during the last few years, and some new APIs will be included in Windows Seven (Web Service, Direct2D, etc.).</p>
<p>posted by LordKain</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633808387900000000</link>
		<pubDate>Wed, 17 Jun 2009 12:33:10 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633808387900000000</guid>
		<dc:creator>LordKain</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Nice interview! I love these kind of things <img src='http://ecn.channel9.msdn.com/o9/content/images/emoticons/emotion-1.gif' alt='Smiley' /></p>
<p>posted by littleguru</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633809388170000000</link>
		<pubDate>Thu, 18 Jun 2009 16:20:17 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633809388170000000</guid>
		<dc:creator>littleguru</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Ah, wonders of computing. Ideas are simple, yet 90&#43;% of all the&nbsp;implementation work&nbsp;is about discovering and handling all the border cases <img src='http://ecn.channel9.msdn.com/o9/content/images/emoticons/emotion-1.gif' alt='Smiley' /></p>
<p>Btw, what were those&nbsp;(two?) good books mentioned in passing on the subject of partial template specialization (a.k.a. template meta programming)?</p>
<p>posted by sokhaty</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633809480320000000</link>
		<pubDate>Thu, 18 Jun 2009 18:53:52 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633809480320000000</guid>
		<dc:creator>sokhaty</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Hi sokhaty,</p>
<p>A&nbsp;book I really like on C&#43;&#43; templates is: C&#43;&#43; Templates: The Complete Guide (Hardcover), by David Vandevoorde, Nicolai M. Josuttis</p>
<p>Also, the classic Effective STL, by Scott Meyers is another great book.</p>
<p>David also suggests: <span id="btAsinTitle">STL Tutorial and Reference Guide, by David R. Musser, Gillmer J. Derge, Atul Saini.</span></p>
<p><span>HTH, and glad you liked the video! <img src='http://ecn.channel9.msdn.com/o9/content/images/emoticons/emotion-1.gif' alt='Smiley' /></span></p>
<p><span>Ale Contenti<br /></span><span>VC&#43;&#43; Dev Lead.</span></p>
<p>posted by alecont</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633810564110000000</link>
		<pubDate>Sat, 20 Jun 2009 01:00:11 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633810564110000000</guid>
		<dc:creator>alecont</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Ale, thanks a&nbsp;ton for the pointers! Now I have to read them <img src='http://ecn.channel9.msdn.com/o9/content/images/emoticons/emotion-1.gif' alt='Smiley' /></p>
<p>posted by sokhaty</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633813223530000000</link>
		<pubDate>Tue, 23 Jun 2009 02:52:33 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633813223530000000</guid>
		<dc:creator>sokhaty</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p><font size="2">Nice video! It is a bit of a pity so many people are moving away C&#43;&#43; just when we are finding out how powerful it really is.
</font></p>
<p>&nbsp;</p>
<p><font size="2">One question about the code though: </font></p>
<p><font size="2">When casting from a large signed type to a smaller type (int to unsigned char), SafeInt now does a two-sided compare. Why not cast the int to a uchar, and check if its the same when cast again to an int? That's one if statement less. Should
 be smaller and&nbsp;a tiny bit faster. </font></p>
<p>posted by jan.devaan</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633875214030000000</link>
		<pubDate>Wed, 02 Sep 2009 20:50:03 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633875214030000000</guid>
		<dc:creator>jan.devaan</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Interesting question. I am not as good with perf as I would like, but in a situation like this, we're essentially counting instructions. Here's how it breaks down:</p>
<p>&nbsp;</p>
<p>Method 1 (suggested) (11 instructions) 32-bit, not optimized</p>
<p>&nbsp;&nbsp; unsigned char tmp = (unsigned char)i;<br />009A143E&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; al,byte ptr [i] <br />009A1441&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; byte ptr [tmp],al <br />&nbsp;&nbsp; if(tmp != i)<br />009A1444&nbsp; movzx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eax,byte ptr [tmp] <br />009A1448&nbsp; cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eax,dword ptr [i] <br />009A144B&nbsp; je&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IntToUchar2&#43;31h (9A1451h) <br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return false;<br />009A144D&nbsp; xor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; al,al <br />009A144F&nbsp; jmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IntToUchar2&#43;3Bh (9A145Bh) </p>
<p>&nbsp;&nbsp; uc = (unsigned char)i;<br />009A1451&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eax,dword ptr [uc] <br />009A1454&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cl,byte ptr [i] <br />009A1457&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; byte ptr [eax],cl <br />&nbsp;&nbsp; return true;<br />009A1459&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; al,1 </p>
<p>&nbsp;</p>
<p>Method 2 (original) (10 instructions)<br />&nbsp;&nbsp; if(i &lt; 0 || i &gt; 255)<br />009A13DE&nbsp; cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dword ptr [i],0 <br />009A13E2&nbsp; jl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IntToUchar&#43;2Dh (9A13EDh) <br />009A13E4&nbsp; cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dword ptr [i],0FFh <br />009A13EB&nbsp; jle&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IntToUchar&#43;31h (9A13F1h) <br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return false;<br />009A13ED&nbsp; xor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; al,al <br />009A13EF&nbsp; jmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IntToUchar&#43;3Bh (9A13FBh) </p>
<p>&nbsp;&nbsp; uc = (unsigned char)i;<br />009A13F1&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eax,dword ptr [uc] <br />009A13F4&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cl,byte ptr [i] <br />009A13F7&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; byte ptr [eax],cl <br />&nbsp;&nbsp; return true;<br />009A13F9&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; al,1 </p>
<p>&nbsp;</p>
<p>Suggested method in release build:</p>
<p>01041050 0F B6 C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; movzx&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ecx,al&nbsp; (3 clock)<br />01041053 3B C8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ecx,eax&nbsp; (1 clock)<br />01041055 75 03&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; jne&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; main&#43;5Ah (104105Ah) (1 clock)</p>
<p><br />Current method in release build:</p>
<p>01041018 3D FF 00 00 00&nbsp;&nbsp; cmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; eax,0FFh (1 clock)<br />0104101D 77 06&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ja&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; main&#43;25h (1041025h)&nbsp; (1 clock)</p>
<p>&nbsp;</p>
<p>I also checked this in 64-bit, and it is the same instructions. In the suggested approach, we have an extra movzx, and it consumes a register, which would tend to cause surrounding code to optimize less efficiently on x86 (probably negligble on x64, but
 same effect). Due to the movzx being expensive (relative to cmp), the suggested approach is 6 cycles to the current approach's 2 cycles, or 3x worse. If the surrounding code were register constrained, as x86 often is, then you might need to push something
 on the stack to free a register, which would be more overhead.</p>
<p>&nbsp;</p>
<p>To be fair, I chalk this up to pure, blind luck. While I did try to write the code to be as efficient as possible, readability and correctness were of higher importance. It is entirely possible that other operations may not be as efficient as possible. I
 think I did try to avoid temporary variables where possible, for just this reason, though in some cases it couldn't be avoided, and the effect would often be diluted by how expensive large multiplication and division operations are.</p>
<p>&nbsp;</p>
<p>A large chunk of work that has not yet been done is to take all 64 combinations for each and every operation type and see exactly how they optimize, and dink with it to see if it can be better. As an aside, we considered using intrinsics for x64 multiplication,
 which would have been a lot faster, but decided not to in this release due to schedule constraints.</p>
<p>&nbsp;</p>
<p>In addition, unless you happened to be using SafeInt inside of a rendering engine, or something else where a couple of cycles matter, a couple of cycles here and there are not going to add up to anything, considering that an allocation could cost several
 10's of thousands of cycles, loading a COM object is much, much bigger, and so on.</p>
<p>&nbsp;</p>
<p>Thanks for the question - I got to learn a bit about assembly that I didn't know before today.</p>
<p>posted by David LeBlanc</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633892756420000000</link>
		<pubDate>Wed, 23 Sep 2009 04:07:22 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633892756420000000</guid>
		<dc:creator>David LeBlanc</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Oh - I forgot to edit a couple of things - the suggested approach adds up to 5 clocks, not 6, which makes it 2.5x slower, not 3x.</p>
<p>posted by David LeBlanc</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633892761270000000</link>
		<pubDate>Wed, 23 Sep 2009 04:15:27 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c633892761270000000</guid>
		<dc:creator>David LeBlanc</dc:creator>
	</item>
	<item>
		<title>Re: David LeBlanc: Inside SafeInt</title>
		<description>
			<![CDATA[
<p>Thanks for correct</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p><a href="http://computerslookup.com"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt=""></a><a href="http://mycomputersland.com"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt="computersland"></a><a href="http://itcomputerzone.com"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt="itcomputer"></a>
<a href="http://computerslookup.com"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt="computerslookup"></a>
<a href="http://itcomputerzone.com/hardware/best-laptop-video-card.html"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt="laptop video card"></a>
<a href="http://sevenwebhosting.org"><img src="http://1.bp.blogspot.com/_6R1aYLOwKHg/TD8SNeT-XXI/AAAAAAAAADo/IWjMd6H91Xk/s1600/nucc" border="0" alt="sevenwebhosting.org"></a></p>
<p>posted by petersan</p>]]>
		</description>
		<link>http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c634157861550000000</link>
		<pubDate>Tue, 27 Jul 2010 00:09:15 GMT</pubDate>
		<guid isPermaLink="true">http://channel9.msdn.com/Shows/Going+Deep/David-LeBlanc-Inside-SafeInt#c634157861550000000</guid>
		<dc:creator>petersan</dc:creator>
	</item>
</channel>
</rss>