4 ms·

I still think that the Deputy's project (from UC Berkeley) approach (https://barnowl.org/research/pubs/07-hotos-linux.pdf https://barnowl.org/research/pubs/07-h

I still think that the Deputy's project (from UC Berkeley) approach (https://barnowl.org/research/pubs/07-hotos-linux.pdf https://barnowl.org/research/pubs/07-hotos-linux.pdf) is the most practical for adding bounds checks to existing C code. Basically annotate functions and data structures with the, usually available, bounds information, e.g.: f(int *a, int n) -> f(int *count(n) a, int n); or struct { int len; int *values; } -> struct { int len; int *count(len) values; } And other annotations for unions, etc. This actually works quite well in practice - the cited paper involved us applying these annotations to a complete, bootable linux kernel. You do have to be willing to tolerate limited code changes and a few "trust me" casts Disclaimer: I worked on the overall project, though not significantly on the Deputy part.

WalterBright 8y ago
Depends on if one would rather write: int s[3]; int *p; f(s, sizeof(s)/sizeof(s[0])); f(p, n); f(int *count(n) a, int n); (which has a mistake, n should be size_t not int), or: int s[3]; int* p; int[] a; f(p[0..n]); // convert pointer to phat pointer f(a); // or use existing phat pointer f(s); // static arrays just work f(int[] a); // the declaration of f()
- davidgay 8y ago
  The point was not to design the "nicest" way of adding safe arrays to C, but a way that captures existing uses and preserves binary compatibility, including preserving memory layouts. For instance: uint16_t count; uint16_t *COUNT(count) buffer; uint16_t *BND(buffer, buffer + count) pos; // pos is within the specified bounds which captures that buffer is a known-size array, and that pos ranges within buffer's contents. Of course, writing from scratch, one might prefer uint16_t[] buffer; uint16_t pos; // An offset within buffer but that's not much help when incrementally modifying an existing code base, or interacting with some external library one either doesn't have source for or doesn't wish to modify.
  - WalterBright 8y ago
    > that's not much help when incrementally modifying an existing code base I am doing exactly that now that I converted the Digital Mars C++ and the DMD D programming language compilers to D - converting the pointer based array code to [] based arrays. Doing it incrementally is very doable and easy. It's not viral like const is. A slice can be trivially created: a[] = p[0 .. length]; and the other way: p = a.ptr; length = a.length;

WalterBright 8y ago

Depends on if one would rather write: int s[3]; int *p; f(s, sizeof(s)/sizeof(s[0])); f(p, n); f(int *count(n) a, int n); (which has a mistake, n should be size_t not int), or: int s[3]; int* p; int[] a; f(p[0..n]); // convert pointer to phat pointer f(a); // or use existing phat pointer f(s); // static arrays just work f(int[] a); // the declaration of f()

davidgay 8y ago
The point was not to design the "nicest" way of adding safe arrays to C, but a way that captures existing uses and preserves binary compatibility, including preserving memory layouts. For instance: uint16_t count; uint16_t *COUNT(count) buffer; uint16_t *BND(buffer, buffer + count) pos; // pos is within the specified bounds which captures that buffer is a known-size array, and that pos ranges within buffer's contents. Of course, writing from scratch, one might prefer uint16_t[] buffer; uint16_t pos; // An offset within buffer but that's not much help when incrementally modifying an existing code base, or interacting with some external library one either doesn't have source for or doesn't wish to modify.
- WalterBright 8y ago
  > that's not much help when incrementally modifying an existing code base I am doing exactly that now that I converted the Digital Mars C++ and the DMD D programming language compilers to D - converting the pointer based array code to [] based arrays. Doing it incrementally is very doable and easy. It's not viral like const is. A slice can be trivially created: a[] = p[0 .. length]; and the other way: p = a.ptr; length = a.length;