News for hackers. Stuff that matters.

A comment on Checked C. Parent comment

Re:Checked C by camel-cdr on Thursday December 22, 2022 @02:42AM (#34090865)
btw C can already do this with VMTs:

    #define ARR_LEN(a) (sizeof (a) / sizeof *(a))

    int a[5] = { 0, 1, 2, 3, 4};
    int (*p)[ARR_LEN(a)] = &a;
    ARR_LEN(*p) // 5
[ Parent | on HN ]
Re:Checked C by ryao on Thursday December 22, 2022 @03:19AM (#34091051)
What does VMT mean? Virtual Method Table? When was this introduced to C? It looks like it was either in C89 or earlier according to both GCC and Clang.

#define ARR_LEN(a) (sizeof (a) / sizeof (a))

int main(void) { int a[5] = {0, 1, 2, 3, 4};

        int (*p)[ARR_LEN(a)] = &a;
        (*p)[6] = 1;
        return ARR_LEN(*p); // 5
}

I had no idea this was possible in C. It is unfortunate that GCC seems to ignore this information. Clang on the other hand uses it.

[ Parent | on HN ]
Re:Checked C by camel-cdr on Thursday December 22, 2022 @04:28AM (#34091484)
> What does VMT mean?

Variable modified types, they were introduces with VLAs (variable length arrays) in c99. C11 made both optional, and C2x mandates only VMTs.

[ Parent | on HN ]
Re:Checked C by camel-cdr on Thursday December 22, 2022 @04:32AM (#34091526)
About gcc ignoring it: gcc doesn't check array bounds at all, even `int x[2]; x[9] = 1;` doesn't produce a warning.
[ Parent | on HN ]
Re:Checked C by ryao on Thursday December 22, 2022 @08:37AM (#34093054)
Oddly, it does catch it for the static example posted by someone else, but that is the only place where it catches it.
[ Parent | on HN ]
Re:Checked C by uecker on Friday December 23, 2022 @05:58PM (#34111580)
You need to use UBSan, then you get the bounds checking in GCC. I added this in 2015.

https://godbolt.org/z/8ncEK3K5b

[ Parent | on HN ]
Re:Checked C by uecker on Friday December 23, 2022 @06:02PM (#34111614)
If you add warnings, it will also tell you that the ARR_LEN macro is wrong...
[ Parent | on HN ]