Re: [EE] Ideas about improving safety in C language

Neil, I checked the code you mentioned. What they do is to re-implement 
the library functions with better practices, like checking all the 
pointers for NULL, etc. but they do not change the underlying data 
structure, which remain just arrays of chars and pointers to them.

I did not like that they changed the arguments and return values of the 
functions, which requires extensive changes to the existing code. For 
instance, the prototype of their 'strcmp' is:

errno_t strcmp_s (const char *dest, rsize_t dmax, const char *src, int 
*indicator);

That is, it returns an error status and the result is returned in a 
variable via a pointer (indicator).

Also:

errno_t strcat_s (char *dest, rsize_t dmax, const char *src);

You must pass the maximum size of the destination, to which you can pass 
a wrong value by mistake. In my approach, you just pass a pointer to an 
object and all the necessary information is inside it.


What I'm suggesting is implementing a new data type and the functions to 
support it.

It could be like:


typedef struct s_string_t;    // The type is just a struct that is not 
defined as a complete type (opaque to the programmer)

int s_strcmp( const s_string_t *a, const s_string_t *b );


This way the functions will have the same arguments (just of a different 
type), and the same return values.

As the data is opaque, the user cannot access it directly, only by using 
the provided functions that ought be written safely.


Of course, unless the support for the new strings is implemented in the 
compilers, it will be necessary to create macros and functions to create 
the new string objects.

For instance:

#define STATIC_S_STRING( name, max_length ) ...

#define STATIC_S_STRING_V( name, max_length, initial_value ) ...

#define STATIC_S_STRING_CONST( name, max_length, value ) ...


s_string_t *alloca_s_string( max_length );    // Creates a new string on 
the stack (local variable) that holds at most max_length characters.

s_string_t *s_string( max_length ); // Dynamically allocates a new 
string object.

Indexing is another point that will need a function call, unless the 
compiler supports the new data type.


Other than that, all the rest (normal string manipulation) is 
essentially the same as it is today.


Cheers,

Isaac




Em 15/04/2025 11:50, Neil escreveu:
> I've seen similar discussions already. And AFAIK there are individual 
> efforts.
> I've had this open in a tab for some time now, but haven't gone 
> through it yet... https://github.com/intel/safestringlib
>
> Cheers,
> -Neil.
>
>
> On 4/15/2025 10:31 AM, Isaac Marino Bavaresco wrote:
>> Hi folks,
>>
>> I was thinking about the current discussion about C/C++ language 
>> safety, and I recalled an old idea I had long ago about creating a 
>> new string format and library.
>>
>> It could be possible for one person alone to implement and use it 
>> privately, but of course it would be even better if it becomes a 
>> standard, perhaps with support from the compilers.
>>
>> I don't know whether something similar was already suggested or is 
>> being used, but I would like to know your opinion about it.
>>
>>
>> Cheers,
>>
>> Isaac
>>
>>
>> Proposed New C string format:
>>
>> Bytes:
>> <descriptor> [<references_counter>] <allocated_size_indicator> 
>> [<used_size_indicator> [<number_of_characters>]] [<characters>...]
>>
>> Descriptor: (bits) 0aabbccr (bit seven is reserved to indicate future 
>> new formats, most probably two-byte descriptors)
>>
>> It would be good to have an encoding field (to indicate ASCII, ANSI, 
>> UTF-8, UTF-16, etc.), but there is not enough bits in a byte and the 
>> fields I chose are more important. Perhaps it can be included in a 
>> two-byte descriptor format.
>>
>> Some details like the obligatory presence of an ending '\0' character 
>> or not must be discussed. If the ending '\0' is required, it would be 
>> very simple to use the new format  with the traditional C library 
>> functions.
>>
>>
>> aa = Area:
>> 00    Static
>> 01    Stack (automatic)
>> 10    Dynamic
>> 11    Dynamic with references counter
>>
>> bb = Length Indicators Bits
>> 00     8 bits
>> 01    16 bits
>> 10    32 bits
>> 11    64 bits (perhaps this value could be used for other purpose, 
>> most probably 64-bits will never be used).
>>
>> cc = Length Indicators Present
>> 00    Only Allocated Size Indicator (used for read-only or fixed size 
>> strings)
>> 01    Allocated Size and Used Size Indicators
>> 10    Allocated Size, Used Size and Number of Characters Indicators
>> 11    *Reserved*
>>
>> Size Indicators: All-ones means not informed. Could be used so the 
>> length is to be calculated when the string is accessed for the first 
>> time, saving the need for calculating the length of every string in 
>> advance. It would require '\0' ended strings. Needs more thought.
>>
>> r = Read Only
>> 0    Read-Write
>> 1    Read-Only
>>
>>
>

-- 
O software antivírus Avast realizou uma checagem de vírus neste e-mail.
www.avast.com
-- 
http://www.piclist.com/techref/piclist PIC/SX FAQ & list archive
View/change your membership options at
https://mailman.mit.edu/mailman/listinfo/piclist