3 ms·
>this is not possible without... Hence the (almost) > Are unsigned indexes fit to be used? More fit than signed ones, clearly shown in the example in the art
by nuancebydefault 3y ago
>this is not possible without...
Hence the (almost)
> Are unsigned indexes fit to be used?
More fit than signed ones, clearly shown in the example in the article where a check was removed by the compiler's optimizer.
- UncleMeat 3y agoI don't think that the (almost) is right here. UaF is a huge source of UB in C and C++. There are two ways to make UaF almost impossible: either a total adoption of Rust-style lifetime checking, which is not a possible transition for the large majority of existing code, or runtime checks that have large and unacceptable performance overhead. The overhead doesn't come from some a few weird corner cases that you can avoid in ordinary development. The overhead would come from core components.
- nuancebydefault 3y agoI agree with all you wrote. Indeed full C array out of bounds checks or avoidance would not the way to go, for reasons you mentioned. Not to mention so many other modes of memory unsafety. But it is not exactly the point I tried to make. In the example code the article presents, there was an opportunity for C to improve the language to make it safer. Instead, the compiler writers decided to make sure this unwanted optimization would not happen by making the compiler more clever and hence heavier, so as to avoid this particular case of UB when using an improved compiler. Still, the C/C++ committee would wave away any critique with: don't use this language in the wrong (UB) way and complain.