Types of memory unsafety

Two families, one shape. flush left at the end of a placement keeps each below chain level at its left edge, though the upper listing runs to two lines and the lower one is a different width; same as gives each pair boxes of one size. The statement align x middle tobj, sobj is a different thing: it hands one coordinate from the first element named to the rest, and it is needed here because the two small boxes hang beside words of different lengths. The two steps name @temporal and @spatial instead of listing eight names.

Your first buffer overflow a made-up example

int main(void) {
  int  myvalue = 0x42;
  char mystring[16];

  scanf("%s", mystring);

  if (myvalue == 0xdeadbeef)
    printf("Success!\n");
  else
    printf("%x\n", myvalue);
}

An ordinary Markdown code block on the left, a diagram on the right. ::: side puts the two beside each other, and the diagram needs to know nothing about it. Inside, same as and gap 0 hold the four frames together as one stack, and the brace spans all four and writes the direction of writing beside them.

Cipher Block Chaining, decryption

Each step is one press of the forward key. The chaining arrows carry one waypoint each (via), which is as much routing as these figures ever need.

Counter mode, encryption

The split boxes are two boxes with gap 0. IV and counter carry different tones and sit flush against each other; between iv0,n0 offset 0,1.35 puts the Enc box under the middle of the pair instead of guessing it against one of the two. The twelve arrows in the lower half carry neither @tag nor show: an edge is only as visible as its two ends, so each arrives by itself in the step where its second endpoint does.

Identity lifecycle

Without align y middle the two columns drift apart. They are separate below chains, and the captions run to one line or to two; three align lines hold the rows level.

Message authentication it is not about confidentiality

The avatars are vector drawings and follow the theme. image alice avatar-alice finds the file in assets/ exactly as ![](fig-id) does; an SVG file is spliced in as a nested <svg> and inherits --ink and --paper. The two attack arrows start at eve.right:0.28 and :0.72: the fraction after the colon slides the attachment point along that side, so the two run parallel instead of on top of each other.

The look of a thing

The editor's sidebar shows exactly these rows. It is experimental and made for a desktop-sized screen: heavily covered by automated tests, not yet widely tried by people. The classes are a closed list rather than free colours – every fill is mixed from --emph and --ink over --paper, so it survives all seven themes.

.paper in the top row looks inert and is not. It is a box's default, but under a default box {.tone-3} a box without the class cannot find its way back, and a free text gets no background at all without it – that background is what knocks a line out behind a label.

The bottom row is the five outlines that are not rectangles, plus .turn. They share a slot with .round and .sharp – a group from which only one class can hold at a time – because a hexagon has no corner radius to argue about. The same four numbers are drawn as for a rectangle, joined into a different path. .turn reads the label bottom to top: a tall narrow box has room for a word only along its length, and the alternative is one letter per line.

A .cross with no w of its own comes out square, block default or not. A plus with arms of two different lengths is not a plus. Without the exception the cross would take the minimum width one line of type needs and arrive at 66 by 37 pixels, a stretched shape instead of a sign. The row's default box … w 0.62 applies to the rectangles in it, and a cross is not one, so it passes by – the same exception bars makes for outlines. A w written on the element's own line still wins, that being a statement about this one element.

.diamond is the one outline that eats both axes. The widest room a diamond offers is a strip half its width by half its height through the middle, so the build sizes it at twice what a rectangle would need for the same string, in both directions. A sentence in a diamond therefore takes four times the area of the boxes beside it and swallows the figure; two or three words is the measure, and the explanation belongs in a note next to it. The diamond in this row carries no label for the same reason – the labelled one is in the flowchart further down. .hex also says a question is asked here; the diamond says on top of that that it goes on in two ways, which a room has been trained on since school.

Which way an outline aims is the point option, not the class name. {.chevron} point left rather than a class .chevron-left: a chevron aimed up is the same shape aimed differently, and a word for every shape times every direction would quadruple the closed list. point applies to .chevron and .wedge; on a shape with no point the build refuses it instead of reading past it.

The last row is the one channel the language spells in three places, and spells the same way in all three. .emph, .dim and .ghost are classes on an element's own line; they are the verbs a step has for them (dim a, b); and on a bars line the same three words name column numbers. Learn one form and you have all three. The fourth state – ordinary prominence – deliberately has no name: {!dim} takes the class off instead of adding a fourth, and that holds for every class and in every tail.

p5 carries @prom, and so the default default box @prom {.dim} – and {!dim} beside it. Without that mark there is no way back: a style step could only ever add a class, and many slots spell their base state as the absence of every member, so a beat could leave such a state and never reach it again.

What is written on the line is in the handout; what is written in a step is not. That is the whole rule, and it reads off the source: prominence on an element's own line describes the drawing, prominence in a beat is an act performed in the talk. Print therefore takes it from the opening beat rather than the last.

When type and box do not match, there are three answers. With no w the box grows to the type. With a fixed w, .shrink shrinks the type until it fits and .fit fills the box in both directions, bounded to 0.6–1.5× the base size. Text width is estimated at build time – there is no browser – so the size chosen comes out a shade too small, which is the safe direction.

The first box overflows on purpose, and the build says so: box g1 is 1.2 units wide but its label needs about 1.64. That is the answer nobody wants: a fixed w too small for the label, and neither .shrink nor .fit. It is the one warning this lecture builds with.

Six statements that expand

Six statements expand at parse time into ordinary elements. bars becomes a box per column (f-0 … f-11), a baseline and – where a second string is written – a text per label; grid a cell per field (g-<column>-<row>); plot a frame with gridlines and axes; table a box per cell; lanes a band per lane; sequence a head, a lifeline, a message and a note per entry. Everything downstream treats the result like any other element: the brace spans three columns because three columns are three ordinary boxes, and a style step tints three cells because they are boxes. What makes that work is that a coordinate may be another element's – every cell is placed against an edge of the frame the same statement lays. The other four are further on: plot two figures later, table, lanes and sequence under Four arrangements.

An edge is one of the things a coordinate can be read off. w1.cx, w1.cy, above w1 gap 0.2 – what is read is the wire's bounding box. That counts as soon as a sentence describes the wire rather than one of its ends. Pinned to a box, such a sentence keeps its distance from the box and loses it from the line the moment a fraction or a height changes, with no warning. An edge has no name until you give it one, and the name goes in front, as it does on every other statement: in the slot before the first endpoint, edge w1 mix -> log. Staying anonymous costs nothing, the slot being optional. Place in a circle – an element against an edge that itself hangs off it – and you get placement cycle with the line number.

cell counts in the height of a grid unit on both axes, exactly as pad does. A grid cell is meant to be square, and a number meaning the unit's width across and its height down would give squares only where the unit is itself square.

The spacing inside these statements is space, not gap. A placement stands on the same line, and there gap means the distance to another element. The distance between two columns is a different thing and takes a different word.

A second run of columns

series of a means: the same columns, a second run. The second bars line gets no frame, no baseline and no strip of category names – all three belong to the frame it joins, and writing one anyway is an error. It refuses a placement for the same reason. What it brings is its values, its classes and, like any other bars line, the two words that single columns out from the opening picture onwards.

One word separates the two figures, and it changes the scale. Without stacked the second run stands beside the first and a column's cell is shared between them; with stacked it stands on it, and the scale is no longer the tallest single value but the tallest stack. The same numbers are therefore flatter on the right than on the left, though no value changed. Which reading you want is a question about the content: side by side compares the years, stacked adds them up.

emph 3 dim 0 stands on the statement, not in a step. Q4 is what this is about and Q1 was only counted from February onwards; both hold the moment the figure is on screen. Written as a step, the first thing the room would see is four equal quarters, and the point would arrive on a keypress. All three prominence words – emph, dim, ghost – take column numbers here, counted from 0, and a number with no column behind it is refused. They are the same three that are classes on an element's line and verbs in a beat.

Columns laid flat the same six numbers, twice

horizontal turns the columns on their side: the bars run right, the categories stack downwards. It stands as a single word on the bars line, exactly as stacked does. The strip of category names becomes a right-aligned column in the left margin, each word set by its own measured width so the right edges form a line, and the baseline stands vertically on the left instead of lying under the bars. The numbers are made up.

Flat, the proportions are easier to read. Every bar starts at the same vertical edge, and the eye compares lengths from one shared start line more reliably than heights over a shared floor: on the left you have to visit the tops of the columns in turn, on the right you read the ranking at a glance. A run of bars sorted downwards also looks like a ranking by itself.

And only flat is there room for the names at all. A category called “DNS cache poisoning” cannot be written under an upright column, so the left-hand figure carries numbers and the room looks them up in a legend that does not exist here. The second string is what makes it possible: a | in it splits on that instead of on spaces, so a label may be as many words as it needs. | already separates the cells of a table row and the names in a lanes list.

A frame to draw in

A plot is a frame to draw in, not a chart library. It lays down gridlines, axis labels and the two axis titles, plus a conversion, so that roc@0.35 names a value in the plot's own units. That is resolved into an ordinary roc.left+n only once the block has been read, so a point may name a plot written further down.

w and h are counted in grid units, and a grid cell is not square. That is the trap. At unit=150x58 a plot … w 1.9 h 1.5 comes out 285 by 87 pixels: the two numbers are a quarter apart, the picture more than three times. aspect W:H states the proportion the reader actually sees and lets the build work the missing number out. This ROC curve is therefore written aspect 1:1 and comes out square, as two axes carrying the same unit should – the chance diagonal runs at 45 degrees, the only slope at which it says what it is called. 4:3, 1:1 or a single number (that many wide to one tall) are all allowed; w, h and aspect together is an error, because two of the three can contradict each other. The same word and the same rule apply on bars.

The curves are ordinary edges. .smooth draws the same waypoints as a curve running through them instead of as straight segments – an interpolating spline, so a waypoint stays exactly where it was written. The skew warning stays quiet here, its premise not holding: on a curve two nearly level points are the shape rather than two ends that missed each other.

“weaker” is an edge label beside the line, and the ground travels with it. A fill class on an edge draws a ground behind the label; without a side top, side bottom, side left or side right it stays on the line and knocks it out, which is what the flowchart further down does with “yes” and “no”. With one of them it moves clear and takes the ground along. For the name of a curve that is the only choice: on the line it would knock out exactly what it names. The ground still has work to do, because the diagonal and two gridlines run under the curve.

The word is short, and that is not a matter of taste here. The label is moved clear along the normal at the middle of the curve, but the curve goes on climbing, so a long label runs back into its own line at both ends instead of staying beside it. Beside a horizontal or vertical edge the question does not arise, and there a label may be as long as it needs to be.

One size, two frames two plots that can be compared

same as on a plot or bars line copies the whole frame. The right-hand plot writes no size of its own but points at the left one, so the two figures match to the pixel. Two figures meant to be compared have to be ones the eye can lay over each other; two frames a hair apart cannot do that.

The copy happens as the line is read, not at layout time – unlike a box's. Gridlines, axis labels and columns are placed from w and h the moment the line is read, so a size arriving later would move the frame and leave everything in it standing. The statement being copied from has to stand above the one copying it, and the build names what went wrong: a name that appears further down, one pointing at something other than a plot or bars, or one that is not in the block at all. same as beside w, h or aspect is an error, and so is same as on a series of line, a series drawing in a frame it does not lay.

Frames of one size are not yet one scale. x and y stand on each plot line for themselves, and nothing checks that two frames carry the same ranges – above they are written out twice, and that is the place to re-read before handing the slide over. bars has no range to write at all: every bars statement scales to its own highest value, so two frames of one size can hold columns that cannot be compared.

Three roles, one incident a swimlane

The bands are equal, their contents are not, and that is why they are no container. A container measures itself against what it holds, so three bands with different numbers of boxes would come out different lengths at both ends – the one thing a swimlane diagram must not say. lanes lays the frame, divides it into bands of equal height and writes the names turned on end in front of the left edge; the bands are .clear so that everything in them reads over them. It needs no time axis: the reading direction is the axis.

Every hand-off changes band, and .elbow is the routing for it. The class draws two waypoints itself – a rail halfway across the gap, on the axis the two ends are further apart on – instead of the same double bend written out by hand on every edge. A straight line would do something else: it would run diagonally through a band it never enters, and the room reads that as involvement.

The one edge label sits beside the line, not on it. “same sender” describes what travels along the line, and a sentence with a rule through the middle of it is read as two fragments before it is read as a sentence. side top lifts it over the line; on a vertical edge it would be side left and side right, and which pair applies is known only once the edge has been routed – so the wrong pair is a warning at build time rather than an error at parse time. The label is moved clear by what it measures across the line: beside a horizontal edge its height, beside a vertical one its width, there with a margin, because a gap across a line of type needs more air than one above it. This label needs no ground: there is nothing but band under it. What a ground does, and how large it may be, is at the ROC curves above.

Leaves first, and the brackets follow a tree

A tree is built from the leaves. They are the fixed points, and every level above stands between its own children with an offset upwards. Written the other way round the compiler copes – it reads the whole block and resolves the dependencies in whatever order works out, not in line order – but the tool you then reach for does not: align x middle rt, i1, i2 hands the first named element's coordinate to the rest, so it would not put the root over its children but stack both children on the root's centre line.

The brackets are the same word six times. .elbow leaves one end on the axis the two are further apart on, runs a rail halfway across the gap and arrives on the same axis; both attachment points are forced onto that axis, whatever the automatic choice would otherwise have taken. The rail is measured between the two elements' facing edges, not between their centres, so it lies on one line for both children of an issuer and the pair reads as one bracket rather than as two connectors. By hand that would be twelve waypoints, recomputed every time a level changes its spacing. Put the rail somewhere else with via; both on one line is an error. .elbow shares a slot with .smooth: how a line is drawn is a question with exactly one answer.

The dashed box stands around the whole set before the set is assembled. It is written into the same beat as the issuers (show @issuers, scope), though its other two members arrive a beat later. Without the written show the usual rule applies: an outline is only as visible as its members and fits itself to the ones you can see, so it would first have grown around the issuer alone and then opened downwards. Naming it gets you both the visibility and the full extent. That is what the exception is for, and it is expressly not for the ordinary case.

One line per row a table

Five rows by three columns is fifteen boxes, each with its own name, width and placement, and a below chain to re-aim whenever a row is inserted. table writes them: the heading is one string split on |, the data rows are the bare strings under it, col gives a width per column and row the height of one row. The attribute tail {.clear .bare .left} lands on the cells and not on the frame, which is what makes a table here a text block rather than a grid of little boxes. The rule under the heading is an ordinary edge between two coordinates, each half from the frame and half from the first cell.

Every cell carries two generated tags, @t-row-N and @t-col-N. So a row is one beat and a column is one beat, one line of source each – where otherwise every beat would carry three cell names to keep in step with the table by hand. Row 0 is the heading, so count from 1 when you mean data.

The last beat is the one that reaches the handout. A figure that lights one row after another and then stops comes out of the printer with its last row glowing, reporting a moment in the talk rather than the table. A fourth beat here takes the emphasis off again and tints the countermeasures column instead – the picture that says something without a talk around it. That it costs a beat is why the prominence verbs need no such thing: prominence a step sets is an act in the talk, and print takes its prominence from the opening beat. Prominence on an element's own line describes the drawing, and reaches the handout.

A protocol down the page a sequence

A protocol is the drawing a lecture asks for again and again, and the one that is hardest to change written out by hand. Written out, every message carries its own y coordinate: inserting one in the middle means moving everything under it, renumbering all of them and re-guessing how far each lifeline runs – counted on this very figure, thirteen written lines for one inserted message. And a note box taller than the guessed spacing cuts silently into the label beneath it.

sequence therefore owns exactly one thing: the vertical rhythm. Every entry states how tall it is – a message as tall as its label, a note as tall as its text – and the statement stacks them. A box pushes down what stands under it, and an inserted line is an inserted line. Across, the statement measures itself the same way: all heads are as wide as the widest label, so a row of equal participants does not stand there ragged. w, header and space are overrides nobody normally writes.

A message may also name itself, and the name goes in front. tunnel c -- s "…" – in exactly the slot an edge carries its name in, before the first endpoint. It is worth doing on the lines something else points at: a generated name like x-4 counts messages and moves the moment one is added above it, where a written name stays put. Staying anonymous costs nothing, and most messages do.

Everything else it answers by keeping a name on every part, not by adding words. Each head keeps the name its actor line gives it; each lifeline is <actor>-life, each message wa-N (counted from 0, so the number drawn is N+1), its number wa-n-N, its smaller second line wa-sub-N, each note wa-note-N. Plus tags for the sets: @wa-msg-N for one message with its number and second line, @wa-msgs for all of them, @au-msgs for all that touch the authenticator, @wa-notes, @wa-actors, @wa-lives. The brace and the handwritten annotation above are therefore ordinary lines hung off wa-3 and wa-2, and the statement knows nothing about either.

There is no alt / else. Enclosing a group of messages and naming it is what container … pad n already draws, and two of the nine figures in the measured corpus wanted it. A word that freezes with the first release deserves more cases than that.