uecker

I use X remoting every day. Being told that I do not need it and it would not work anyway, is what makes me angry. Then I hate that decades of protocol compatibility are broken, which i think is sad …

There were C implementations with bounds checking or implementations that trap on use of an invalid pointer or on read of uninitialized variables etc. A large part of UB was introduced for such rea…

Two's complement does not mean signed overflow became defined. So the check is still wrong. And no, I do not think making it defined would lead to more correct programs. You then simply have real…

It should be "C and C++ Implementations" because nothing in the standard requires UB to be exploited for optimization instead of adding run-time checks.

There are plenty of similar things in C++. I do not think C++ is safer than C. std::vector does not do bounds by default checking last time I checked.

Note that not all claims you find about UB on the internet are true. For example, in C, UB can not time-travel before observable behavior. And in general UB can not time-travel before any function ca…

Well, the argument brought up is that users want it this way, so this is existing practice which is implemented and should be standardized. So please complain and file bugs. Also use the compiler and …

I agree there should be a warning. But it is not trivial to teach a compiler when to warn or not to not generate too many false positives. Not as good as warning, but UBSan catches this at run-time: …

I think C is a perfectly fine language for modern projects and one can write good software with it. In fact, most software I use on daily basis is written C and extremely reliable: Linux, git, xcfe, t…

What "best evidence"? I find it strange that coal deaths from air pollution predicted by epidemiological considerations is taken for granted while similar predictions for nuclear from uncont…

I would say that calling this a "hydroelectric catastrophe" is misleading. The main motivation for building this dam was apparently to control flooding.

We will see. In a regulatory context, "the implementation is the spec" usually does not convince.

We will make VM-types, i.e. pointers to VLAs, mandatory in C23.

You need to pass a pointer to an array: https://godbolt.org/z/jYzY79ac4 When passing an array it decays into a pointer and the size is lost. We can also change sizeof to recover…

These are dependent types which C++ does not have at all. The C support is fairly weak though... But most programming language people I know agree that dependent types are they way to guard against o…

You may be interested in this: https://github.com/uecker/noplate.git

See also here for my experiments, but it relies on UBSan for bounds checking: https://github.com/uecker/noplate.git …

Sure, you could also put a lot of complicated macros into headers. But in practice it is not a problem because this is not how you would do it in C. But in C++ you put the definition of a class into t…

That the size is information is used more for checking is generally ongoing work. Inside a function it can be propagated by the compiler. The old GCC extension can also be hidden behind a macro, so t…

The freeze is in effect, but issues can still be addressed with NB comments. There was a NB related to this topic and WG14 asked me to create a new revision of this paper.

g is UB which is why one can use it easily for checking. h is fine because a is larger than 7. If it were smaller the call could be diagnosed. If you overwrite the pointer inside the function, then th…

While most C compilers ignore this the size in C can definitely be used for checking and this is intended, e.g. see the C2X charter: https://www.open-std.org/jtc1/sc22/wg14&#…

I do not think security was an issue at this time. I assume you mean this proposal: https://www.bell-labs.com/usr/dmr/www/vararray.pdf I like it and it is on my list t…

A a C programmer, I think Rust got memory correctness right. Unfortunately, I do not like the rest of the language ;-(

WG14 can still vote it into C23.

In C headers are not a problem. They are simple and effective. C++ made the mistake of putting implementations into headers for generic programming.

Yes, and with pointer-to-array syntax the bounds checking already works today: https://godbolt.org/z/oc6MTWjYd For your syntax we will probably just also add it is an option.…

Did you try inline as well? Why are they not as flexible as the macro? Couldn't the swap not also process two arrays?

What is wrong with promoting unsigned short to int?

Why? I do not find the wording in the C standard less clear than the C++ wording (where the result is unspecified for unrelated pointers).