This page represents a proposed policy of the MIT Kerberos project.
This is a partial list of portability assumptions made by the MIT krb5 source code.
We assume a C compilation environment equivalent to a freestanding C89 (ISO/IEC 9899:1990) implementation. Freestanding language support for C99 (ISO/IEC 9899:1999) does not have to be complete, but we use some C99 features:
- The C99
inlinefeature should be supported.
- External identifiers of at least 31 significant initial characters should be supported.
long long inttype, or some reasonably equivalent means of declaring integers of at least 64 bits of precision, should be supported.
- Variadic macros should be supported.
We require behavior that C89 formally leaves unspecified:
- Null pointers are represented as all bits zero. This means that pointer members of a structure can be initialized to null pointer values by
We require behavior that C89 formally declares to be implementation-defined:
- Characters are 8 bits wide.
- Signed integers are represented as two's-complement, and all possible bit combinations represent valid values. (The absolute value of the bounds are not the same.)
- Converting an unsigned integer to the corresponding signed integer type when the unsigned integer value is larger than the largest signed integer value will preserve the bit pattern of the representation. (Equivalently, the conversion from a negative signed integer to the corresponding unsigned integer type is invertible.)
- Integers have no padding bits.
We require some behavior that C89 formally declares to be undefined:
- Pointers to
voidcan be cast to pointers to functions.
C runtime libraries
We expect that substantially all of the C89 and SUSv3/POSIX.1 library interfaces are available. We expect POSIX signal interfaces to be available on Unix-like platforms.
We expect that IPv4 and IPv6 networking support is available, via either the BSD or Windows socket interfaces.
If the platform supports threads, we expect that normal (non-recursive) mutexes can be locked and unlocked without risk of failure, assuming correct usage.
We expect that the
snprintf() family of functions from C99 and SUSv3/POSIX.1 is available and either conforms to the standards or deviates from the standard behavior in one of a small number of ways:
- It may return -1 if the target buffer is not sufficiently large.
- It may treat
nof zero or a null target pointer as an error condition.
On Solaris, precision specifiers on string formats in
printf() family functions may count columns rather than bytes if the application is not compiled in a standard-conforming environment. We are investigating the security impact of this behavior.
inttypes.h capabilities should be available.
We require behavior that is specified by C89, but historical implementations have failed to provide:
realloc()must work on null pointers.