Adding so-called fat pointers to C that could be bounds checked would probably instantly eliminate a large fraction of all security issues.
Of course, you can emulate these yourself, it's just a struct but not everyone does.
Of course, you can emulate these yourself, it's just a struct but not everyone does.
I think it would not be impossible for a C compiler to detect and produce a warning if an index used with such an array-pointer is not checked against the array-pointer's length variable.
This would not make bounds-checks automatic, but the use of these types could make compilers point out when bounds are not checked or checked incorrectly.
https://godbolt.org/z/jMMa8n48r
Yes, putting them into structs is a missing feature. It is not in the draft because no compiler can do it and their is no implementation experience. I am working on it.
There's no overhead to doing it, but you save a bunch of bugs earlier, all for stopping conflating arrays with pointers, which is something not much code does these days anyway