Safe subset of C?

R

Robert Vazan

It has the potential for misuse, such as spamming lots of windows or
unkillable dialog boxes... see even the javascript (yes I know it's
not Java, but it's still an example of a sandboxed language):
while(1) alert("Please Click OK");
which on many (older) browsers required a forced kill of the program.

That's acceptable. It's not fault of language. It's fault of library that
provides windows. I care about language for now. Let's keep the goal
finite.
So you need to regulate array access; how? Your supporting library must
hook into every single array access:

int int_item( const int *array, size_t index);

I think that the array would have to be structure of some sort, so that
item count can be stored somewhere. Another option is to make it easy to
automatically find out which variable holds item count. Verifier can then
look whether all branches leading to array access performed bounds
checking on index.
Then you must redefine every single library function so it accesses
arrays in terms of these accessor functions?!

There is no hope to support legacy code. Unchecked libraries can be, of
course, linked with to maintain compatibility.
 
R

Robert Vazan


Thanks. It's heuristics, so I cannot take too many ideas from it. It might
be useful on other projects.
That is rather simplistic view, and it is a naive application that
leaves such verification code enabled all the time (e.g., verifying
qsort really sorted the array after each invocation).

I don't want to verify that qsort actually sorts the array. I just want to
verify that it doesn't write to memory to which it never got pointer and
that it doesn't crash. I cannot do this with standard qsort, of course,
but I should be able to do this with code that I have written.
 
R

Robert Vazan

I guess you figure that all those "smart programmers" are incapable of
using any other language.

I didn't want to offend you. I am also capable of using other languages,
but I have got very sensitive to quality of tools and I am consequently
very sceptical about any new language.
I can't speak for anyone else, but I wouldn't be
interested in working in crippled C.

So you compile with warnings turned off?
However, I have no problem learning a
new language if that's what the project requires.

That's how I learned most of languages that I know. However I am now
making the choice myself. Nobody requires me to use anything.

It's more of a hobby project and my priority is simplicity. I thought that
C is the right choice in this direction. I think that the safe subset will
simplify it further. It's true that the supporting library is going to
make it more complex, but I don't see how choice of language could affect
it.
There are many debuggers for Java, usually integrated in one of the very
many IDEs for Java. There is also a command line debugger that comes with
the standard java distribution.

Sorry, I shouldn't pick up whatever rumors pass by, no matter who
distributes them.
 
S

Sheldon Simms

So you compile with warnings turned off?

Warnings don't prevent me from doing anything, and lots of things
that you want to disallow, such as treating any object as an array
of bytes, can be done perfectly safely and portably.
 
K

Kelsey Bjarnason

I didn't want to offend you. I am also capable of using other languages,
but I have got very sensitive to quality of tools and I am consequently
very sceptical about any new language.


So you compile with warnings turned off?

Having warnings enabled doesn't cripple C; it just lets you know when
you've done something that probably isn't actually C at all. :)
 
J

James Hu

I don't want to verify that qsort actually sorts the array. I just
want to verify that it doesn't write to memory to which it never got
pointer and that it doesn't crash. I cannot do this with standard
qsort, of course, but I should be able to do this with code that I
have written.

There are already tools that do this. A web search for memory
debugging tools will provide many hits.

-- James
 
C

Christian Bau

Kelsey Bjarnason said:
Having warnings enabled doesn't cripple C; it just lets you know when
you've done something that probably isn't actually C at all. :)

If it isn't C at all you would get an error. If you get a warning, it's
most likely perfectly legal C that in some non-obvious way does
something entirely different from what you intended.
 
D

Dan Pop

In said:
If it isn't C at all you would get an error. If you get a warning, it's
most likely perfectly legal C that in some non-obvious way does
something entirely different from what you intended.

Many compilers generate mandatory diagnostics as warnings. The following
hardly qualifies as a perfectly legal C program:

fangorn:~/tmp 214> cat test.c
int main()
{
char *p = 1;
return sizeof(void);
}
fangorn:~/tmp 215> gcc -ansi -pedantic test.c
test.c: In function `main':
test.c:3: warning: initialization makes pointer from integer without a cast
test.c:4: warning: sizeof applied to a void type
fangorn:~/tmp 216>

Dan
 
R

Robert Vazan

There are already tools that do this. A web search for memory
debugging tools will provide many hits.

They aren't suitable for release code. And even in debug code, they crash
the program. It's just that they crash it near to point of error.
 
R

Robert Vazan

Warnings don't prevent me from doing anything, and lots of things

You can get warning that not all members of enum are enumerated in switch
statement. You can get warning about missing return statement even if you
know that end of function is unreachable.
that you want to disallow, such as treating any object as an array of
bytes, can be done perfectly safely and portably.

The only thing that you can do portably is copying those bytes to new
location. Reflection and metadata can do much more and they are type-safe.
 
A

Alex

Christian Bau said:
If it isn't C at all you would get an error. If you get a warning, it's
most likely perfectly legal C that in some non-obvious way does
something entirely different from what you intended.

AFAIK "diagnostics" need only be output from the compiler,
not specifically as "errors" or "warnings".

Alex
 
S

Sheldon Simms

You can get warning that not all members of enum are enumerated in switch
statement. You can get warning about missing return statement even if you
know that end of function is unreachable.

Indeed. How is C crippled by such warnings?
The only thing that you can do portably is copying those bytes to new
location. Reflection and metadata can do much more and they are type-safe.

What does that have to do with C?
 
K

Kelsey Bjarnason

[snips]

If it isn't C at all you would get an error.

Really? Hmm.

[kelseyb@baldur]$ gcc test.c
test.c: In function `main':
test.c:3: warning: `return' with a value, in function returning void
test.c:2: warning: return type of `main' is not `int'

The code:

void main()
{
return 0;
}


Seems I get a warning, not an error with warnings enabled. So, you're
suggesting that void main() is, in fact, C? As I recall, the standards
explicitly state that main returns int, not void, not double, not pointer
to char, but int, and anything else ain't C.
 
J

James Hu

They aren't suitable for release code. And even in debug code, they crash
the program. It's just that they crash it near to point of error.

Not all of them behave as you describe. I am offering you the
suggestion to encourage you to not re-invent the wheel.

-- James
 
J

Joona I Palaste

AFAIK "diagnostics" need only be output from the compiler,
not specifically as "errors" or "warnings".

So does this:

"ISO says I have to issue a diagnostic here. So to keep them happy I'll
do so."

qualify as a mandatory diagnostic for a case for which the ISO C
standard mandates one?
 
D

Dave Vandervies

So does this:

"ISO says I have to issue a diagnostic here. So to keep them happy I'll
do so."

qualify as a mandatory diagnostic for a case for which the ISO C
standard mandates one?

Wouldn't that depend on whether it's documented by the compiler as
a diagnostic?

Perhaps a better wording would be "...So to keep them happy I'm doing
so.". That way it's clear from the message that it is in fact the
required diagnostic.


dave
(In a pedantic mood today, it seems. Not that that's a Bad Thing.)
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,744
Messages
2,569,484
Members
44,903
Latest member
orderPeak8CBDGummies

Latest Threads

Top