Path: csiph.com!usenet.pasdenom.info!news.albasani.net!fu-berlin.de!uni-berlin.de!news.dfncis.de!not-for-mail From: =?UTF-8?B?SGFucy1CZXJuaGFyZCBCcsO2a2Vy?= Newsgroups: comp.std.c Subject: Re: Second draft, "Safe arrays and pointers for C" Date: Sun, 02 Sep 2012 22:20:42 +0200 Lines: 30 Message-ID: References: <503FC37F.8050701@animats.com> <50415632.6060606@animats.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: news.dfncis.de TQyrsOONM9GIksrQpPCVWQBRgd0LJ3tz0undF02FMb9hOueRMT+R28wyySBNRY1U2w9vLKbZer Cancel-Lock: sha1:8+4ONhk2CPuZh/UshBDiuVipw7I= User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20120604 Thunderbird/13.0 In-Reply-To: <50415632.6060606@animats.com> Xref: csiph.com comp.std.c:1650 On 01.09.2012 02:26, John Nagle wrote: > Not really. The main use case for unions is for data read > in from an external source, often a network. No, it's not, because the vast majority of usages of unions for that purpose would automatically cause undefined behaviour. > Tightening down the screws further on that would alienate too many C > programmers. Consider the common idiom > > const char* msg[] = > {"First message", "second message", "third message", 0 } And that would run afoul of reading beyond the end of the array ... how? > Or even > int main(int argc, const char* argv[]); > > Most security attacks require write access. Let's hold it right here for a moment. So what is it you're trying to avoid: attacks or program crashes? The distinction is quite important, because actual security attacks need write access a whole lot less than crashing programs would. You can expose secret data by random reading, but it's a whole lot harder to crash a program that way. > C99 VLA parameters seem to be on the way out, anyway. That hasn't become any less incorrect since the last time round.