Fil-C used to as well. It's not a fundamental limitation; it's more policy: if the programmer takes a pointer to `name`, and then uses arithmetic to get to the `is_admin` field, do we allow it or not? If we allow it, then this hypothetical example becomes a security vulnerability. If we disallow it, then a huge number of C/C++ programs stop working.
This "name overflows to is_admin" example doesn't come up in real code or real CVEs. It does come up in HN comments on Fil-C threads though.
CHERI is less compatible than Fil-C, in terms of how many changes you have to make to code to make it work, and this is an example of a policy decision that causes that result.
This "name overflows to is_admin" example doesn't come up in real code or real CVEs. It does come up in HN comments on Fil-C threads though.
CHERI is less compatible than Fil-C, in terms of how many changes you have to make to code to make it work, and this is an example of a policy decision that causes that result.