I created and pushed a change draft for
Issue #401, âImproved address object designâ.
https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ChangeDrafts/Accepted/sarif-v2.0-issue-401-address-rework.docx
The original design was ambiguous about what
address.offset was based on: the parent object, or
address.baseAddress?
-
We renamed offset to
offsetFromParent to clear up that ambiguity.
-
We removed baseAddress because once itâs clear that âoffsetâ is based on the parent object, thereâs no need to duplicate the information in the child object.
-
We added some more kind values ("header",
"table") and we (really Michael) made the definitions of
"section" and
"segment" more precise. We (this time, really me
😊) also added text acknowledging that the meanings of these terms are OS-dependent, and recommending that SARIF producers use the term most appropriate for the target OS.
-
Finally, an innovation: we introduced a property
effectiveAddress, which, when not present, can in certain circumstances be calculated by adding the offsets all the way up the ancestor chain. (The precise algorithm is in the spec.) This has two benefits:
-
It allows the consumer to see the final address without having to walk all the way up the ancestor chain. This at first
seems duplicative in the same way that
baseAddress was (although even if that were true,
effectiveAddress saves the consumer more work than
baseAddress did because baseAddress duplicated information in a
single address object rather than a whole chain of them). BUT! Itâs not really duplicative, becauseâ
- The
effectiveAddress property allows a consumer to see the final address even if some of the information required to calculate it is missing from the ancestor addresses. This allows you to say, for example, âHere is the address of this entry in the
exception handler table; the table entry is a child of the table, which is itself a child of some other thingâ â without having to specify the address of the exception handler table if you donât think thatâs relevant.
This draft also includes a small amount of residual editorial feedback.
As always, the provisional draft and its HTML version are up to date:
https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ProvisionalDrafts/sarif-v2.0-csd02-provisional.docx
https://github.com/oasis-tcs/sarif-spec/blob/master/Documents/ProvisionalDrafts/sarif-v2.0-csd02-provisional.htm
Please take a look. We still plan to open the CSD 2 ballot on Monday.
Thanks,
Larry