Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Keith Thompson <kst-u@mib.org>
Newsgroups: comp.lang.c
Subject: Re: Mars lander crash
Date: Sun, 11 Dec 2016 11:55:00 -0800
Organization: None to speak of
Lines: 44
Message-ID: <ln7f76utpn.fsf@kst-u.example.com>
References: <o2e7s1$ea6$1@dont-email.me> <o2e8sg$hp7$1@dont-email.me> <o2ecu8$v73$1@dont-email.me> <o2eel2$614$1@dont-email.me> <o2eg20$b90$1@dont-email.me> <o2emds$5ek$1@dont-email.me> <o2epuf$juu$1@dont-email.me> <o2es0l$sea$1@dont-email.me> <o2jgbu$ih7$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Injection-Info: mx02.eternal-september.org; posting-host="d0d5c56ca22fa2e528cedb366e6a556f"; logging-data="4039"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/uguHr1ZyFHUDIS2HFqtLn"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux)
Cancel-Lock: sha1:sDsUfA4vCrr09vTCeV5J1TCSVFk= sha1:MBVGlBfoRQ/TnJaNFpLpbC4GSus=
Xref: csiph.com comp.lang.c:98872

David Brown <david.brown@hesbynett.no> writes:
[...]
> By now you must have realised that it is /impossible/ for C to have a 
> standard method of detecting integer overflows (and buffer overruns, 
> though these are new to the thread here).  Please do not continue 
> arguing for them - it cannot and will not happen, and I believe you 
> already know this and understand some of the reasons for that (even if 
> you don't agree with all of the reasons).

I don't know how you reached that conclusion.

Standard C of course does not specify overflow checking.  But leaving
aside the question of whether it's a good idea, either a future C
standard or a C implementation with extensions certainly could.

As proof of concept, I present Ada.  Ada has exceptions as a language
feature, very similar to C++ exceptions.  It also requires arithmetic
operations to be checked, raising an exception if the result is out of
range.  (Ada also has modular types, similar to C unsigned types, with
wraparound semantics.)

For example, you might have:

    declare
        N: Integer := Integer'Last;
    begin
        N := N + 1;
        Put_Line("Overflow not detected");
    exception
        when Constraint_Error =>
            Put_Line("Overflow detected");
    end;

and the program *must* print "Overflow detected" in a conforming
implementation.

Why do you think something similar (perhaps using signals rather than
exceptions?) would be impossible in C?

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"