CERT C Secure Coding Standard - last call for reviewers

J

jacob navia

Keith said:
*You* complain about this?


Yes me. You could see the size and budget difference between gcc's
team (several dozen people working full time) and my effort (two
people working part time).
When is your own lcc-win going to be fully C99 compliant?

The only feature really missing is the designator initializers
feature.
So far, you
seem to be spending most of your time inventing and implementing
extensions rather than finishing work on the implementation of the
core language.

No. I have implemented with my extensions the complex numbers
part of C99, and using the generic functions feature I implemented
all the tgmath.h in a general way.

Yes. I have been extending many things in the compiler and
doing other things like marketing, going to customers, fixing
problems, etc. I haven't been able to do everything I would wish to
do.

(That's not to minimize your apparently considerable
 
S

santosh

jacob said:
Yes me. You could see the size and budget difference between gcc's
team (several dozen people working full time) and my effort (two
people working part time).


The only feature really missing is the designator initializers
feature.


No. I have implemented with my extensions the complex numbers
part of C99, and using the generic functions feature I implemented
all the tgmath.h in a general way.

So from a C99 P.O.V. your compiler still lacks complex support and
tgmath.h?

Of course you are free to implement them with your extensions, but to
claim conformance to C99 you'll also have to provide a mode where the
standard specified syntax and semantics are also accepted.

<snip>
 
J

jacob navia

santosh said:
So from a C99 P.O.V. your compiler still lacks complex support and
tgmath.h?

Of course you are free to implement them with your extensions, but to
claim conformance to C99 you'll also have to provide a mode where the
standard specified syntax and semantics are also accepted.

<snip>

Well, they are accepted

double _Complex a,b;
// ...
a = a+b;

If my compiler uses operator overloading to implement that,
it complies with the AS IF rule, as far as I see.
 
I

Ian Collins

jacob said:
Well, they are accepted

double _Complex a,b;
// ...
a = a+b;

If my compiler uses operator overloading to implement that,
it complies with the AS IF rule, as far as I see.
That (providing a working implementation) is a good basis for a proposal
for a language extension.

From earlier exchanges, I didn't realise you could transparently
implement complex numbers with your operator overloading scheme. Do
programs using _Complex built with your compiler link with modules built
with other compilers?
 
J

jacob navia

Ian said:
That (providing a working implementation) is a good basis for a proposal
for a language extension.

From earlier exchanges, I didn't realise you could transparently
implement complex numbers with your operator overloading scheme. Do
programs using _Complex built with your compiler link with modules built
with other compilers?

Linking different compiler's object code doesn't ever work.
Specifically, you need to link with the object code the
C runtime of lcc-win, where functions like complex divide,
complex square root, etc are implemented.

Now, I am in the process of augmenting operator overloading
with inlined assembler operators. When I am finished doing this,
it will be easier to do since there will be no library calls for
the complex arithmetic operators.

Problem is, I will do this in the 64 bit versions using the
new opcodes of Intel/AMD for complex math (SSE3), and I do not
know if I will have the time to backport this into the 32 bit
versions.

In general, since all those functions are pure and no
malloc/free is invoked either directly or indirectly it
*could* work with older versions of MSVC. But mSVC 2008 is a
full of .net stuff, even when you use it as a plain C
compiler, and I do not feel like digging into the highly
optimized Microsoft implementation to find out why
the program mystreriously crashes...
 
I

Ian Collins

jacob said:
Linking different compiler's object code doesn't ever work.
Specifically, you need to link with the object code the
C runtime of lcc-win, where functions like complex divide,
complex square root, etc are implemented.
Ah, OK. I'm used to platforms where it does!
 
F

Flash Gordon

jacob navia wrote, On 21/03/08 21:47:
Well, they are accepted

double _Complex a,b;
// ...
a = a+b;

If my compiler uses operator overloading to implement that,
it complies with the AS IF rule, as far as I see.

Ah, but does it still work and produce all required diagnostics if you
put it in standard compliant mode? I seem to recall that for operator
overloading you use a syntax that in standard compliant mode requires a
diagnostic (not that there is anything wrong with extensions that
require a diagnostic in standard compliant mode).
 
J

jacob navia

Flash said:
jacob navia wrote, On 21/03/08 21:47:

Ah, but does it still work and produce all required diagnostics if you
put it in standard compliant mode? I seem to recall that for operator
overloading you use a syntax that in standard compliant mode requires a
diagnostic (not that there is anything wrong with extensions that
require a diagnostic in standard compliant mode).

1) During compilation of tgmath.h I put the compiler in non-compliant
mode even if you requested the contrary. After compiling that, I
reset it again, the AS IF rule is then followed. Unless you
modify tgmath.h what is not a good idea.

2) There is some stuff that can't be done with operator overloading,
specifically the strange syntax that C99 uses:

double _Complex b = 1+2*I;

This part has to be done in the compiler proper. It would be much
more convenient if there was a simple way to parse a complex constant
without having a full expression simplifier with complex arithmetic
in the compiler obviously. I have still not finished this part, and
if you type

double _Complex b = 1+2*I-245-56*I+56+66*I;

the operations will be done at run time and not at compile time.
Operator overloading can't help here since this is compile time.
The same problem appears in C++ by the way. The solution of
course is to be able to define compile time functions, but after
all the critic for this simple operator overloading stuff I will
not propose any further extensions here.

3) There is not a lot of complex C99 code available that would test
my implementation, and even if I have ported into the new syntax
some codes, it needs more testing.
 
K

Keith Thompson

jacob navia said:
Yes me. You could see the size and budget difference between gcc's
team (several dozen people working full time) and my effort (two
people working part time).
Understood.


The only feature really missing is the designator initializers
feature.

Last time I asked you about this, your reply was:

| Designated initializers and structure initializers with the
| dot notation are missing.
| [...]
| Besides the preprocessor is still missing the variable
| arguments feature.
No. I have implemented with my extensions the complex numbers
part of C99, and using the generic functions feature I implemented
all the tgmath.h in a general way.

Yes. I have been extending many things in the compiler and
doing other things like marketing, going to customers, fixing
problems, etc. I haven't been able to do everything I would wish to
do.

And I'm sure the folks working on gcc, even though there are more of
them, haven't been able to do everything they would wish to do.

I'm not criticizing your efforts; I'm merely questioning your attitude
regarding gcc's failure to fully comply to C99.
 
K

Keith Thompson

jacob navia said:
Flash said:
jacob navia wrote, On 21/03/08 21:47: [...]
Well, they are accepted

double _Complex a,b;
// ...
a = a+b;

If my compiler uses operator overloading to implement that,
it complies with the AS IF rule, as far as I see.

Ah, but does it still work and produce all required diagnostics if
you put it in standard compliant mode? I seem to recall that for
operator overloading you use a syntax that in standard compliant
mode requires a diagnostic (not that there is anything wrong with
extensions that require a diagnostic in standard compliant mode).

1) During compilation of tgmath.h I put the compiler in non-compliant
mode even if you requested the contrary. After compiling that, I
reset it again, the AS IF rule is then followed. Unless you
modify tgmath.h what is not a good idea.

Not a bad approach. Standard headers absolutely don't have to be
written in standard-conforming C (they don't have to be written in C,
or even exist as files).
2) There is some stuff that can't be done with operator overloading,
specifically the strange syntax that C99 uses:

double _Complex b = 1+2*I;

What strange syntax? "1+2*I" isn't single literal, it's an
expression. I is a macro that expands to _Complex_I, which in turn
expands to a constant expression of type "const float _Complex". From
there, the rest is just ordinary complex arithmetic with the usual
arithmetic conversions (C99 6.3.1.8, though the wording that describes
promotion from real to complex is a bit subtle). There's nothing
there that requires any more special handling than the initialization
of z in:

int a = 1;
int b = 2;
float _Complex c = I;
double _Complex z = a + b * c;

C99 has no complex literals (just as it has no negative literals;
``-42'' is a unary "-" applied to a constant 42).
This part has to be done in the compiler proper. It would be much
more convenient if there was a simple way to parse a complex constant
without having a full expression simplifier with complex arithmetic
in the compiler obviously. I have still not finished this part, and
if you type

double _Complex b = 1+2*I-245-56*I+56+66*I;

the operations will be done at run time and not at compile time.
Operator overloading can't help here since this is compile time.
The same problem appears in C++ by the way. The solution of
course is to be able to define compile time functions, but after
all the critic for this simple operator overloading stuff I will
not propose any further extensions here.

As far as I know, performing those operations at run time is perfectly
legal as far as the standard is concerned. Obviously doing as much as
possible at compilation time would be a nice optimization, but that's
not a conformance issue.
3) There is not a lot of complex C99 code available that would test
my implementation, and even if I have ported into the new syntax
some codes, it needs more testing.

Thanks for acknowledging that. Perhaps some subset of the gcc test
suite would be useful. (I haven't looked at it myself; it might well
turn out to be totally useless for this purpose.)

This raises an interesting question (for the group in general, not
necessarily just for jacob). In complex.h, the macro _Complex_I

expands to a constant expression of type const float _Complex,
with the value of the imaginary unit.

Is there any portable way to do this, or must it be done via some
extension? One example: GNU libc's <complex.h> has
#define _Complex_I (__extension__ 1.0iF)

There doesn't actually *need* to be a portable way to do this, but it
seems odd to define built-in complex types but not be able to express
the value ``i'' without using (directly or indirectly) a compiler
extension. It might have been more consistent either to make
_Complex_I a new keyword, or to define a new suffix to specify complex
or imaginary constants.
 
L

lawrence.jones

jacob navia said:
Linking different compiler's object code doesn't ever work.

"Doesn't ever" is too strong -- the whole point of standard platform
ABIs and run-time libraries is to allow different compilers' object code
to be linked together and work. It's another lesson that Microsoft has
been very slow to learn, but it works just dandy in lots of other
environments (like VMS, Unix, and MVS/ESA). One of my company's main
products is written in a combination of C, C++, and Fortran, compiled by
two or three different compilers, all linked together into a single
executable. It works just fine on all major current platforms. That's
not to say that it's *easy* -- there are lots of potential traps and
pitfalls -- but it can be done.

-Larry Jones

It works on the same principle as electroshock therapy. -- Calvin
 
J

jacob navia

Keith said:
Is there any portable way to do this, or must it be done via some
extension? One example: GNU libc's <complex.h> has
#define _Complex_I (__extension__ 1.0iF)

There doesn't actually *need* to be a portable way to do this, but it
seems odd to define built-in complex types but not be able to express
the value ``i'' without using (directly or indirectly) a compiler
extension. It might have been more consistent either to make
_Complex_I a new keyword, or to define a new suffix to specify complex
or imaginary constants.

I used in my implementation

double _Complex I = {0.0,1.0};

since double _Complex *is* a structure after all.
Anyway, if it was defined as an array, it would be
the same: the above syntax is also valid.
 
W

Walter Roberson

I used in my implementation
double _Complex I = {0.0,1.0};
since double _Complex *is* a structure after all.
Anyway, if it was defined as an array, it would be
the same: the above syntax is also valid.

Hmmm, is it? You cannot typedef an array type distinct from
what it is an array of, so if _Complex were defined as an array,
it would have to be defined as a double array, leading to the
equivilent of

double double I[2] = {0.0,1.0};

Is that valid syntax? I don't have my standard here to check
against, but I thought a typedef could only be further qualified
by auto, static, register, volatile, and const ? (And of course,
array specifiers and pointer indicators.)
 
K

Keith Thompson

jacob navia said:
I used in my implementation

double _Complex I = {0.0,1.0};

since double _Complex *is* a structure after all.
Anyway, if it was defined as an array, it would be
the same: the above syntax is also valid.

To be clear: in standard C, double _Complex certainly isn't a
structure, it's an arithmetic type. In user code, the above
declaration would require a diagnostic.

Now if you're saying that while processing <complex.h> your compiler
goes into a mode in which it accepts the above extension without a
diagnostic, and actually issues the required diagnostic if it sees the
equivalent in user code, then that's fine.

However, it doesn't answer my question, which was whether it's
possible to define _Complex_I in portable C *without* using any
compiler extensions.
 
B

Ben Bacarisse

Flash Gordon said:
jacob navia wrote, On 21/03/08 21:47:

Ah, but does it still work and produce all required diagnostics if you
put it in standard compliant mode? I seem to recall that for operator
overloading you use a syntax that in standard compliant mode requires
a diagnostic (not that there is anything wrong with extensions that
require a diagnostic in standard compliant mode).

When I looked at the briefly released Linux version, there seemed to
be a problem with this method. It looked as if operator overloading
was required for _Complex to work. At that time,

double _Complex x = 1.0;

was rejected when the -ansic flag was set with an error:

Error <path>/complex.c: complex.c: 10 operands of = have
illegal types 'struct long double _Complex' and 'double'

Similarly, just writing 'x + 2' produced:

Error <path>/complex.c: complex.c: 8 operands of + have illegal types
'struct long double _Complex' and 'int'
 
B

Ben Bacarisse

Keith Thompson said:
jacob navia said:
Yes me. You could see the size and budget difference between gcc's
team (several dozen people working full time) and my effort (two
people working part time).
Understood.


The only feature really missing is the designator initializers
feature.

Last time I asked you about this, your reply was:

| Designated initializers and structure initializers with the
| dot notation are missing.
| [...]
| Besides the preprocessor is still missing the variable
| arguments feature.

At the time of the brief Linux release, there were some problems with
compound literals as well.
 
F

Flash Gordon

"Doesn't ever" is too strong -- the whole point of standard platform
ABIs and run-time libraries is to allow different compilers' object code
to be linked together and work. It's another lesson that Microsoft has
been very slow to learn,

It works just fine in the MS world as long as the compilers have been
designed to allow it. On one product I'm involved in the bulk is written
in Borland Delphi 5 but one module is written with MS VC++ 6.0 (this as
done back when these were current technologies).

MinGW can also link to DLLs written in Visual Studio, MinGW even have a
FAQ on how to interface between Visual Studio and MinGW.

This is part of the point of the specification for DLLs under Windows!
but it works just dandy in lots of other
environments (like VMS, Unix, and MVS/ESA). One of my company's main
products is written in a combination of C, C++, and Fortran, compiled by
two or three different compilers, all linked together into a single
executable. It works just fine on all major current platforms. That's
not to say that it's *easy* -- there are lots of potential traps and
pitfalls -- but it can be done.

The main pitfall is implementations that are not designed to work with
the implementation provided by OS provider.
 
F

Flash Gordon

Keith Thompson wrote, On 22/03/08 00:48:
jacob navia said:
Flash said:
jacob navia wrote, On 21/03/08 21:47: [...]
Well, they are accepted

double _Complex a,b;
// ...
a = a+b;

If my compiler uses operator overloading to implement that,
it complies with the AS IF rule, as far as I see.
Ah, but does it still work and produce all required diagnostics if
you put it in standard compliant mode? I seem to recall that for
operator overloading you use a syntax that in standard compliant
mode requires a diagnostic (not that there is anything wrong with
extensions that require a diagnostic in standard compliant mode).
1) During compilation of tgmath.h I put the compiler in non-compliant
mode even if you requested the contrary. After compiling that, I
reset it again, the AS IF rule is then followed. Unless you
modify tgmath.h what is not a good idea.

Not a bad approach. Standard headers absolutely don't have to be
written in standard-conforming C (they don't have to be written in C,
or even exist as files).

<snip>

I agree with Keith that there is absolutely nothing wrong with this
approach.
 
Y

ymuntyan

To be clear: in standard C, double _Complex certainly isn't a
structure, it's an arithmetic type. In user code, the above
declaration would require a diagnostic.

Now if you're saying that while processing <complex.h> your compiler
goes into a mode in which it accepts the above extension without a
diagnostic, and actually issues the required diagnostic if it sees the
equivalent in user code, then that's fine.

However, it doesn't answer my question, which was whether it's
possible to define _Complex_I in portable C *without* using any
compiler extensions.

What does it mean "to define _Complex_I in portable C"? Can
you define 1.0L in portable C?

Yevgen
 
H

Harald van Dijk

What does it mean "to define _Complex_I in portable C"?

Can you give a correct definition of the standard library macro
_Complex_I that would be usable on any C99-conforming compiler?
Can you define 1.0L in portable C?

In that sense, 1.0L is already portable C.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,763
Messages
2,569,562
Members
45,037
Latest member
MozzGuardBugs

Latest Threads

Top