Hacker News Reader

Comment by WalterBright | Hacker News Reader

Another way to do it:

https://www.digitalmars.com/articles/C-biggest-mistake.html

i.e. just change:

    void foo(char* a)

to:

    void foo(char[] a)

and that passes a phat pointer (pointer and length) instead of just a pointer, enabling array bounds checking.

View on HN

This comment could mislead people: The linked article explicitly says that * and [] are identical when used in function arguments. It then goes on to suggest a possible syntactical change for the C language where the [] syntax would be a fat pointer.

OP wrote the linked article...

Yes, but the comment could mislead people, so I clarified it.

The article you reference actually proposes new syntax:

  void foo(char a[..])

for passing an array pointer and length, and to eventually deprecate:

  void foo(char a[])

Personally I like this suggestion, but as the article is 12 years old, I'm obviously in a minority.

Psst, he didn’t just reference the article, he wrote it.

Thanks for pointing that out! Still, his comment here doesn't quite match the article and certainly confused me. Is he now suggesting:

  void foo(char[] a)

instead of what he originally proposed, which is:

  void foo(char a[..])

If so, that does seem cleaner. I still like the overall suggestion.

> 12 years old

Which is amazing. It's a simple, backwards compatible solution to buffer overflows. I know it works because it's been used in D for 20 years and has made buffer overflows a thing of the past.

It's also nice because it implicitly documents the difference between a pointer to a single object and a pointer to an array of objects. Just this is a huge win, when used consistently.

The problem is backward compatibility with external linking because this expects another word on the call stack. It also relies on the programmer to be smart about bounds, which, they’re already intentionally ignoring, so, I don’t know. However, there are some attempts at a hardware solution to provide memory safety without modifying the stack: https://en.m.wikipedia.org/wiki/Intel_MPX. At array creation time, the pointer bounds are loaded into a register and the address is translated between a safe address and a real address. I don’t actually know if this works in a transparent backward-compatible way, as in, ignoring unregistered pointers and translating without being told to. I should also mention that AddressSanitizer also does something similar in software, and is becoming ubiquitous. The performance/size penalties are significant, bu it seems to me that the hardware translation should be fast if it is separately integrated with the existing cache address translation and memory bus.

> The problem is backward compatibility with external linking because this expects another word on the call stack.

It's completely compatible if you use the [..] syntax.

> performance/size penalties

For the proposed scheme, they are essentially non-existent. This is because the array bounds is usually already being passed as a separate argument.

Arrays that rely on a sentinel to determine the end (like 0-terminated strings) one can just not use the new syntax.

Reply on news.ycombinator.com