20-CS Programming Languages Fall 2018

Transcription

1 20-CS Programming Languages Fall 2018 Answer all questions Be sure to put your name on the paper in the space provided! Name Signature 1. It is claimed in that If your entire application has been compiled without unchecked warnings using javac -source 1.5, it is type safe. The following code compiles without unchecked warnings: interface I { public void op (); class A implements I { int number; public A (int n) { number = n; public void op () { System.out.println(number*2); public void ret () { System.out.println(number*3); class B implements I { String str; public B (String n) { str = n; public void op () { System.out.println(2*Integer.parseInt(str)); public class prob1 { public static void main (String args[]) { Vector <I> v = new Vector <I> (); v.add(new A(10)); v.add(new B("20")); for (Iterator c = v.iterator(); c.hasnext(); ) ((A)c.next()).ret(); a. What happens when the code is run with java prob1? 30 is printed then an exception is raised b. Fix the code in some way so that it runs correctly - full credit if the fix results in an output that is intended, partial credit if not. Many fixes are possible. One is to turn interface I into an abstract class and add a dummy ret then change the cast to I instead of A. This may be acceptable if classes A and B are not to be altered except for extending instead of implementing. If classes A and B are in a library just wrap a try-catch around the ((A)c.next).ret() statement. and do something like print no ret for that class in the catch. c. What is the root cause of the problem? Casting

2 2. The following code c++ code is intended to create and display a list of objects for which display, value, and compare functions are defined. The defined List class has two methods: insert for putting an object into a List object, called list, and show for displaying the value of all objects contained in list. class valuefunc { long long value (void *object) { return 0; ; class displayfunc { virtual void display (void *object) { ; ; class comparefunc { int compare (void *obj1, void *obj2) { return 0; ; class A { int number; A (int x) { number = x; int valueof () { return number; ; class valuea : public valuefunc { long long value (void *object) { cout << ((A*)object)->valueOf() << " "; ; class comparea : public comparefunc { int compare (void *obj1, void *obj2) { valuea *v = new valuea(); return (v->value(obj1) == v->value(obj2))? 1 : 0; ; class displaya : public displayfunc { void display (void *object) { cout << ((A*)object)->valueOf() << " "; ; class List { bool startoflist; comparefunc *cmpfunc; displayfunc *dispfunc; protected: Node *tail, *current; // True after "startoflist()" is called // Compare function // Display function // Tail for the list, current to walk through List (comparefunc *cf, displayfunc *df) { cmpfunc = cf; dispfunc = df;... void insert(void *t) {... void display() { for (Node *p=tail->next ; p->next!= tail->next ; p = p->next) dispfunc->display(p->object); dispfunc->display(tail->object); cout << "\n"; ; int main(int argc, char **argv) { List *lst = new List(new comparea(), new displaya()); lst->insert(new A(12)); lst->insert(new A(264)); lst->insert(new A(112)); cout << "List = "; lst->display(); a. Fix (mark) the code so that list elements and 112 will be shown when this is run (see the last page for the complete Node and List classes but what is on this page should be sufficient for solving the problem). Added virtual in EXACTLY ONE PLACE.

3 3. The following code can be compiled with gcc prob3.c -o prob3 That is, without enforcement of any protections. Upon execution, prob3 produces a shell with the prompt [\u@\h \W]$. How does this demonstrate that the C language is not memory safe? typedef unsigned long int u64; void g() { system("/bin/sh"); u64 *f (u64 *x) { *(&x+6) = (u64*)g; return x; void h() { u64 *s = (u64*)0x123; f(s); int main () { h(); printf("safe\n"); return 0; The shell is the result of an invocation of function g. But when the code runs there is no direct way in which g is invoked: just main which calls h() which calls f() which should return to h() then to main where safe is printed. The only way g could be invoked is if its address replaced another return address on the stack. Since (u64*)g is the address of g it is likely that the address was replaced by the line *(&x+6) = (u64*)g;. Allowing return address replacements is an example of a memory unsafe situation - if code like this appears as aan internet facing application it is likely that an attacker will will be able to craft an input that will cause such a replacement. This code can be successfully compiled even if all stack protections are in place!

4 4. The code below has two threads assigning a value to variable number of a single A object. class A { public int number; public A (int x) { number = x; class B extends Thread { int count = 0, force; A a; public B (A x, int f) { a = x; force = f; public void run () { for (int i=0 ; i < ; i++) { a.number = force; if (a.number!= force) { System.out.println("\nB("+count+"): Hey, I did t do that!"); count++; try { sleep(1); catch (Exception e) { public class prob4 { public static void main (String args[]) { A a = new A(10); (new B(a, 0)).start(); (new B(a, 1)).start(); try { Thread.sleep(2000); catch (Exception e) { a. In the run method of the B class there is a line a.number = force; which is followed immediately by the test if (a.number!= force)... At first glance this test would seem to always be false. Why should a.number sometimes be different from force? One B thread executes the line a.number = force then is suspended by the other B thread then executes the same line. When the first B thread resumes it sees a value for a.number that is different from the one it set. b. How would you fix this problem, still allowing both B threads to be active concurrently? synchronized void act () { a.number = force; if (a.number!= force) System.out.println("\nB("+(count++)+"): Hey, I did t do that!");... public void run () { for (...) { act(); try { c. What is the maximum number of times Hey, I did t do that! will be printed if not fixed? Indefinite

5 5. Consider the following Scheme code: (define call/cc call-with-current-continuation) (define cont1 ()) (define cont2 ()) (define main (lambda () (if (= (call/cc (lambda (k) (begin (set! cont2 k) 0))) 0) (func1) (func2)))) (define func1 (lambda () (display func1-) (if (= (call/cc (lambda (k) (begin (set! cont1 k) 0))) 0) (cont2 1) (func1)))) (define func2 (lambda () (display func2-) (if (= (call/cc (lambda (k) (begin (set! cont2 k) 0))) 0) (cont1 1) (func2)))) a. What is the purpose of main? To set cont1 to a continuation grabbed in func1 and to set cont2 to a continuation grabbed in func2 then to get out of the way while func1 and func2 call each other s continuations. b. What output do you expect to see when this is run by invoking (main)? Note: output is derived solely from invocations of the function display. func1-func2-func1-func2-... c. How many continuations are grabbed during execution? Indefinitely many over time but only two are active at any one time. These two point to stacks that become indefinitely long. d. When does the program stop? When some resource is exhausted

6 class Node { void *object; Node *next; // Object carried by the node // The next node in a list of nodes Node(void *obj, Node *lst) { object = obj; next = lst; ; void *getobject() { return object; class List { bool startoflist; comparefunc *cmpfunc; displayfunc *dispfunc; protected: Node *tail, *current; // True after "startoflist()" is called // Compare function // Tail for the list, current to walk through List (comparefunc *cf, displayfunc *df) { tail = NULL; current = tail; cmpfunc = cf; dispfunc = df; startoflist = true; ; void insert(void *t) { startoflist = false; if (t == NULL) return; if (tail == NULL) { tail = new Node(t, NULL); tail->next = tail; current = tail; else { Node *h = new Node(t, tail->next); tail->next = h; tail = h; void display() { for (Node *p=tail->next ; p->next!= tail->next ; p = p->next) dispfunc->display(p->object); dispfunc->display(tail->object); cout << "\n";