Re:A Special Kind of Hell: intmax_t in C and C++
by elgatonegro on Monday December 07, 2020 @02:08AM
(#25330004)
You didn’t address any of his points and your rebuttals come across as little more than frantic handwaving. Moreover, as has been pointed in this post, VLAs don’t necessarily need to have security implications since they can be implemented outside the stack. Yet you keep bringing up Google and KSPP as if they are arbiters of truth instead of corporate entities with their own agendas.
You are also spreading misinformation. VLAs being optional does not mean they have been removed from the standard as you keep claiming.
You should read the link contents before posting them here.
"In particular, the order of parameters in function declarations should be arranged such that the size of an array appears before the array. The purpose is to allow Variable-Length Array (VLA) notation to be used."
Notation for what?
"Application Programming Interfaces (APIs) should be self-documenting when possible."
And why is that?
"This not only makes the code's purpose clearer to human readers, but also makes static analysis easier. Any new APIs added to the Standard should take this into consideration. "
On top of that, if you bother to actually read the ongoing C2X mailings, there are no plans to bring VLAs back to life, besides adopting the syntax to describe function parameters.
Most devs that take security seriously actually take the effort to know the details of the devil that we have to deal with.