checkedc
checkedc copied to clipboard
nt_array_ptr design can require source changes for initialization by calls.
@nmeum has reported that the nt_array_ptr
design where only a 0 can be written at the upper bound doesn't interact well with function calls that do initialization, such as memset
. See #242 for details. Given initialization code of the form:
char *p = ...
memset(p, 0, len)
If p is changed to an nt_array_ptr
they had to narrow the bounds by 1 and insert an explicit initialization step:
memset(p, 0, len - 1);
p[len] = `\0`;
memset
currently takes an array_ptr
. In Issue #242, I discuss two possible approaches that we could take to avoid these source code changes:
- treat functions that initialize by 0 specially for
nt_array_ptr
. - significantly expand our vocabulary for talking about restrictions on writes via
array_ptr
. This would be challenging to do.