3 ms·

I assume from your comment that you know how to write code that does not have such bugs. Could you please share? In particular: how do you write a library that

by 112233 2y ago

I assume from your comment that you know how to write code that does not have such bugs. Could you please share? In particular: how do you write a library that guaranteed will not have integer overflow on any existing or future architectures and compilers?

steveklabnik 2y ago
> how do you write a library that guaranteed will not have integer overflow on any existing or future architectures and compilers? By following the behavior in the standard, and not trying to imagine how the standard is implemented. For example, C23 includes https://en.cppreference.com/w/c/header/stdckdint https://en.cppreference.com/w/c/header/stdckdint, which you can safely use to check for overflows. It's also in C++23. If you're not on the latest standards, there are techniques to do so as well, these macros codify existing practice: https://stackoverflow.com/questions/199333/how-do-i-detect-unsigned-integer-overflow https://stackoverflow.com/questions/199333/how-do-i-detect-u...
- 112233 2y ago
  Thank you for these references. It is how you say, and, for c++ would involve handling 16 bit "int", char larger than 8 bits and in the case of pre-20 compilers you cannot even assume two's compliment. I am sure such correct code can be written, but expecting everyone to play along with standard and ignore that 100% of existing compilers have much saner behaviour, might be very difficult.
  - steveklabnik 2y ago
    I’m not sure what “100% of compilers have much saner behavior” means. I do agree that avoiding UB is difficult.
bluGill 2y ago
Same way any other language. That Rust defines what happens doesn't change the fact that it is a bug when it happens (in most cases). Which is to say not nearly as well as I would like.
- 112233 2y ago
  Agree. However, it's one thing to have bug in my code and sitting with a cold coffee staring at debug prints trying to find the incorrect operation. It is quite another thing to have a big chunk of code simply missing from the compiled binary, because complier found a path that reaches integer overflow and thus decided that the code is unreachable.

by 112233 2y ago

steveklabnik 2y ago

> how do you write a library that guaranteed will not have integer overflow on any existing or future architectures and compilers? By following the behavior in the standard, and not trying to imagine how the standard is implemented. For example, C23 includes https://en.cppreference.com/w/c/header/stdckdint https://en.cppreference.com/w/c/header/stdckdint, which you can safely use to check for overflows. It's also in C++23. If you're not on the latest standards, there are techniques to do so as well, these macros codify existing practice: https://stackoverflow.com/questions/199333/how-do-i-detect-unsigned-integer-overflow https://stackoverflow.com/questions/199333/how-do-i-detect-u...

112233 2y ago
Thank you for these references. It is how you say, and, for c++ would involve handling 16 bit "int", char larger than 8 bits and in the case of pre-20 compilers you cannot even assume two's compliment. I am sure such correct code can be written, but expecting everyone to play along with standard and ignore that 100% of existing compilers have much saner behaviour, might be very difficult.
- steveklabnik 2y ago
  I’m not sure what “100% of compilers have much saner behavior” means. I do agree that avoiding UB is difficult.

bluGill 2y ago

Same way any other language. That Rust defines what happens doesn't change the fact that it is a bug when it happens (in most cases). Which is to say not nearly as well as I would like.

112233 2y ago
Agree. However, it's one thing to have bug in my code and sitting with a cold coffee staring at debug prints trying to find the incorrect operation. It is quite another thing to have a big chunk of code simply missing from the compiled binary, because complier found a path that reaches integer overflow and thus decided that the code is unreachable.