2 ms·

Adding so-called fat pointers to C that could be bounds checked would probably instantly eliminate a large fraction of all security issues. Of course, you can

by mhh__ 5y ago

Adding so-called fat pointers to C that could be bounds checked would probably instantly eliminate a large fraction of all security issues. Of course, you can emulate these yourself, it's just a struct but not everyone does.

flohofwoe 5y ago
Adding opaque builtin struct types to C would be kind of a big deal though and would probably creep into other parts of the language and interact with them in unexpected ways. Features like fat pointers, slices, builtin dynamic arrays/strings or tagged unions would all require builtin opaque structs. This would be a whole different language (closer to Zig).
- mhh__ 5y ago
  It really wouldn't be that hard to do. The syntax would be trivial, and the whole point is that you want it to creep so people actually use them. There's no overhead to doing it, but you save a bunch of bugs earlier, all for stopping conflating arrays with pointers, which is something not much code does these days anyway
Findecanor 5y ago
C99 introduced variable-length array parameters and variable-length array pointers together with variable-length arrays (VLA). These take another parameter or variable as a length-parameter. These became optional in C11 together with VLAs (for some reason) but are supposed to again become mandatory in C23. However (yet, for some reason) the pointers can (in the latest published draft, still) only be inside procedures: not in structs or in global variables. I think it would not be impossible for a C compiler to detect and produce a warning if an index used with such an array-pointer is not checked against the array-pointer's length variable. This would not make bounds-checks automatic, but the use of these types could make compilers point out when bounds are not checked or checked incorrectly.
- melissalobos 5y ago
  People don't really get the distinction you make here, which is a shame. Often any VLA's are outlawed which is tossing the baby out with the bathwater.
- uecker 5y ago
  Compilers can already do this: https://godbolt.org/z/jMMa8n48r https://godbolt.org/z/jMMa8n48r Yes, putting them into structs is a missing feature. It is not in the draft because no compiler can do it and their is no implementation experience. I am working on it.

by mhh__ 5y ago

flohofwoe 5y ago

Adding opaque builtin struct types to C would be kind of a big deal though and would probably creep into other parts of the language and interact with them in unexpected ways. Features like fat pointers, slices, builtin dynamic arrays/strings or tagged unions would all require builtin opaque structs. This would be a whole different language (closer to Zig).

mhh__ 5y ago
It really wouldn't be that hard to do. The syntax would be trivial, and the whole point is that you want it to creep so people actually use them. There's no overhead to doing it, but you save a bunch of bugs earlier, all for stopping conflating arrays with pointers, which is something not much code does these days anyway

Findecanor 5y ago

C99 introduced variable-length array parameters and variable-length array pointers together with variable-length arrays (VLA). These take another parameter or variable as a length-parameter. These became optional in C11 together with VLAs (for some reason) but are supposed to again become mandatory in C23. However (yet, for some reason) the pointers can (in the latest published draft, still) only be inside procedures: not in structs or in global variables. I think it would not be impossible for a C compiler to detect and produce a warning if an index used with such an array-pointer is not checked against the array-pointer's length variable. This would not make bounds-checks automatic, but the use of these types could make compilers point out when bounds are not checked or checked incorrectly.

melissalobos 5y ago
People don't really get the distinction you make here, which is a shame. Often any VLA's are outlawed which is tossing the baby out with the bathwater.
uecker 5y ago
Compilers can already do this: https://godbolt.org/z/jMMa8n48r https://godbolt.org/z/jMMa8n48r Yes, putting them into structs is a missing feature. It is not in the draft because no compiler can do it and their is no implementation experience. I am working on it.