lib/: Some improvements to sizes of array parameters#1134
lib/: Some improvements to sizes of array parameters#1134alejandro-colomar wants to merge 4 commits into
Conversation
839aa80 to
fea5bcf
Compare
|
Queued after the release of 4.17.0. |
fea5bcf to
40bd936
Compare
40bd936 to
91af1e4
Compare
133e9cc to
b0589f7
Compare
b0589f7 to
087d85e
Compare
94a7203 to
34c2c09
Compare
34c2c09 to
dc7167f
Compare
dc7167f to
0926e79
Compare
0926e79 to
31afd7d
Compare
10dad35 to
88778fd
Compare
d2a0110 to
6ec4643
Compare
37e3e7b to
e23d3d1
Compare
e23d3d1 to
7f95395
Compare
9c468a5 to
daf2521
Compare
daf2521 to
79d59a1
Compare
79d59a1 to
bc4d815
Compare
bc4d815 to
747d09c
Compare
747d09c to
34b5d02
Compare
34b5d02 to
ec80a04
Compare
0b7ff25 to
8d4aa1e
Compare
8d4aa1e to
835b911
Compare
835b911 to
083c113
Compare
083c113 to
4c7f5de
Compare
| inline ssize_t readlinknul(const char *restrict link, char *restrict buf, | ||
| ssize_t size); | ||
| inline ssize_t readlinknul(ssize_t size; | ||
| const char *restrict link, char buf[restrict size], ssize_t size); |
There was a problem hiding this comment.
That's trippy.
Will it work with things other than gnu gcc? Clang?
There was a problem hiding this comment.
It works with any version of GCC.
It doesn't work with Clang, because Clang refuses to implement this. The rationale they use is that they won't implement a feature that none of their users use, which would be a circular problem. By using the feature, we'd be giving them a reason to implement it.
There was a problem hiding this comment.
The GCC documentation for the feature is here:
https://gcc.gnu.org/onlinedocs/gcc/Variable-Length.html
There was a problem hiding this comment.
This syntax is already in use in the Linux manual pages
https://www.man7.org/linux/man-pages/man3/memcpy.3.html
and has been proposed for standardization in ISO C:
There was a problem hiding this comment.
We have to remember that Clang has done very little effort to enforce array bounds, while GCC is quite good (and getting better).
We need features that improve array-bounds safety, and if Clang doesn't allow that, Clang needs to be improved. We can't stay behind.
There was a problem hiding this comment.
I'm also a bit concerned about this point. Didn't we discuss already that we may not support this project in Clang? Or did I imagine the conversation?
There was a problem hiding this comment.
I think it was this conversation, which we also held in private (email).
There was a problem hiding this comment.
Yeah, I remember it now so I checked the email, but I don't see we arrived to any conclusion.
There was a problem hiding this comment.
No, we didn't. I would like to reach some. Feel free to reply in that mail (or here). :)
Cc: @hallyn
4c7f5de to
fd10e1a
Compare
'n' is just as meaningful as 'nmemb', and is in more common use in C projects (including this one). Signed-off-by: Alejandro Colomar <alx@kernel.org>
GNU C has an extension which allows to forward-declare parameters, so that array notation can be used with sizes that are defined after the array itself. This improves the safety of such arrays, by telling the compiler the bounds of the array. This feature has been proposed for standardization in C2y as n3394. Link: n3394 <https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3394.pdf> Cc: Martin Uecker <uecker@tugraz.at> Signed-off-by: Alejandro Colomar <alx@kernel.org>
Link: n3394 <https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3394.pdf> Signed-off-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
fd10e1a to
cdab5b5
Compare
| inline char * | ||
| seprintf(char *dst, const char *end, const char *restrict fmt, ...) | ||
| seprintf(char dst[], const char end[]; | ||
| char dst[dst?end-dst:0], const char end[0], const char *restrict fmt, ...) |
Check notice
Code scanning / CodeQL
Short global name Note
| inline int | ||
| stprintf(char *restrict s, ssize_t size, const char *restrict fmt, ...) | ||
| stprintf(ssize_t size; | ||
| char s[restrict size], ssize_t size, const char *restrict fmt, ...) |
Check notice
Code scanning / CodeQL
Short global name Note
The first commit is just readability stuff, but the second one is an important safety improvement.
Cc: @uecker, @kees
Revisions:
v1b
v1c
v1d
v1e
v1f
v1g
v1h
v1i
v1j
v2
v2b
v2c
v2d
v2e
v2f
v2g
v2h
v2i
v2j
v2k
v2l
v2m
v2n
v3
v3b
v3c
v3d
v4
v4b
v4c
v5
v6
v6b
v6c
v6d
v6e
v6f
v6g
v6h
v6i
v6j
v6k
v6l
v6m
v6n
v7