Hacker News Reader

Comment by admax88q | Hacker News Reader

The funny thing is that the memory allocator typically knows the size of the string.

You call free(foo) not free(foo, 12) or free(foo, strlen(foo));

But there's no standard way to ask for this size. Why doesn't strcpy just check with the allocator about how much memory is available and refuse to write past that.

View on HN

Because the programmer can do pointer arithmetic, treat non-char[] memory as char[] memory and probably other weird stuff that makes this more complicated than it sounds, I guess.

just make a type where doing pointer math and other such use cases are a compiler error?

Just use a language where types automatically know their size? I thought the point was to make existing code safer by exploiting information that's already there (e.g. the allocator knowing the size of things on the heap).

The point is that C could be made much safer to use with a few "simple" (at least seemingly) tweaks. C has great tooling support on all platforms, including embedded, so it would be a compelling advancement if the language standard were to include such a thing. The important thing would be to coerce such a string type to character arrays so it remains compatible with all libraries without casting.

Not every string is allocated from the heap. There is no way to know if a string passed to a function, for example, came from the heap or not.

That's true, although there's no reason the stack allocator couldn't record this information somewhere as well.

And if the memory allocator doesn't know about the string then you could just revert to the existing behaviour so you're no worse off.

There's more ways to allocate memory than the heap and stack.

What are you referring to? sbrk? mmap? I typically use either the heap or the stack myself.

Static memory is at the bottom of the address space, below the heap. But that would really only be relevant in the case of string literals unless I'm mistaken.

You can have a static buffer:

    static char buf[128];

and use strcpy() at any point to copy into it, so I don't think statically allocated strings must be literals.

There is a distinction between const and non-const static memory, though, in that the former can be stored in Read-Only Memory. Still, static memory is generally used for many fewer purposes than the stack or the heap, and if I understand correctly, sbrk is still working with the heap, just more manually.

That's right. Allocators use the sbrk and mmap to manage the heap. IIRC high performance allocators tend to use mmap exclusively.

Something like memory pools or manual memory management. Yes the memory pool will come from the heap or stack but the heap/stack allocator will have no idea what is going on in there.

And all of them know how much memory they've allocated.

Yes, but unless you expose at the language level an interface for all types of allocators and enforce it then a whole lot of allocation techniques like memory pools couldn't be used with strcpy or would have to use char* type of strings again.

The point is not that allocators don't know how much memory has been allocated, but that C has no idea about the underlying allocator, so it cannot ask it about the length of the string as it was proposed.

Okay but you don't have to implement a 100% solution to make 90% of existing code much safer.

How much C code is out there that only uses malloc/free? All of those programs could be made safer if the default string methods were able to prevent writing past the end of the array.

Clang offers a memory sanitizer that does a lot of extra checking. People don't ship their software with the sanitizer activated because the performance hit is nontrivial.

You're free to do as you please here. You don't have to use malloc()/free(), just implement your own LIBRARY_Alloc()/LIBRARY_Free()/LIBRARY_GetMemorySizeBytes() :)

However that doesn't mean that you shouldn't be able to either

Would be nice to be able to tell if something is allocated on the heap or stack in a portable way.

As in being able to ask if and object is thread local or not. The language and run time could support that but studiously does not.

Just like the language could allow you to directly monkey with the ABI but does not.

That something could be allocated by custom allocator like new or g_slice_alloc. You can monkey with the ABI as numerous FFI libraries do, but it is not portable by definition, unless you’re using, well, portable FFI library. Personally I can’t see why string, abi, etc libraries must be included. Include GLib++/GObject++ then and use its actually large ecosystem — what problem are you trying to solve by blaming low-level? That low-level is too low? Do you need high-level low-level that everyone will obey next morning? Check Java?

> portable FFI library

I looked into that, not available on many many platforms.

strcpy has no access to the "allocator". It doesn't know about malloc, realloc, or free.

Yes -- and that has turned out to be a bad design decision. It's somewhat convenient to use methods like strcat() to build up strings, but it also leads to very insecure code.

I think the inclusion of strdup() shows that it was a mistake to make C strings completely allocator-agnostic.

Strings don’t have to fill the char array they live in. Overallocating a buffer is a common technique to avoid frequent reallocation.

Reply on news.ycombinator.com