[defensive-coding-guide] 61/120: C++: Subscripting to read the NUL
character in std::string not supported
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit e6ed150d2b97ffeecfdc00fd04c154307486f87d
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Thu Sep 19 15:08:53 2013 +0200
C++: Subscripting to read the NUL character in std::string not supported
---
defensive-coding/en-US/CXX-Std.xml | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/defensive-coding/en-US/CXX-Std.xml b/defensive-coding/en-US/CXX-Std.xml
index b221949..56e1ad0 100644
--- a/defensive-coding/en-US/CXX-Std.xml
+++ b/defensive-coding/en-US/CXX-Std.xml
@@ -115,6 +115,10 @@
Use the <function>at(size_type)</function> member function
instead. See <xref
linkend="sect-Defensive_Coding-CXX-Std-Subscript"/>.
+ Furthermore, accessing the terminating NUL character using
+ <literal>operator[]</literal> is not possible. (In some
+ implementations, the <literal>c_str()</literal> member function
+ writes the NUL character on demand.)
</para>
<para>
Never write to the pointers returned by
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 56/120: C++: Warn about functions that
deal with unpaired iterators
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 2067762b472676ef892b55a5263bcf3dd0f16040
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Sep 17 13:51:27 2013 +0200
C++: Warn about functions that deal with unpaired iterators
---
defensive-coding/en-US/CXX-Std.xml | 60 ++++++++++++++++++++++++++++++++++++++
1 file changed, 60 insertions(+)
diff --git a/defensive-coding/en-US/CXX-Std.xml b/defensive-coding/en-US/CXX-Std.xml
index 88fa803..b221949 100644
--- a/defensive-coding/en-US/CXX-Std.xml
+++ b/defensive-coding/en-US/CXX-Std.xml
@@ -7,6 +7,61 @@
The C++ standard library includes most of its C counterpart
by reference, see <xref linkend="sect-Defensive_Coding-C-Libc"/>.
</para>
+ <section id="sect-Defensive_Coding-CXX-Std-Functions">
+ <title>Functions that are difficult to use</title>
+ <para>
+ This section collects functions and function templates which are
+ part of the standard library and are difficult to use.
+ </para>
+ <section id="sect-Defensive_Coding-CXX-Std-Functions-Unpaired_Iterators">
+ <title>Unpaired iterators</title>
+ <para>
+ Functions which use output operators or iterators which do not
+ come in pairs (denoting ranges) cannot perform iterator range
+ checking.
+ (See <xref linkend="sect-Defensive_Coding-CXX-Std-Iterators"/>)
+ Function templates which involve output iterators are
+ particularly dangerous:
+ </para>
+ <itemizedlist>
+ <listitem><para><function>std::copy</function></para></listitem>
+ <listitem><para><function>std::copy_backward</function></para></listitem>
+ <listitem><para><function>std::copy_if</function></para></listitem>
+ <listitem><para><function>std::move</function> (three-argument variant)</para></listitem>
+ <listitem><para><function>std::move_backward</function></para></listitem>
+ <listitem><para><function>std::partition_copy_if</function></para></listitem>
+ <listitem><para><function>std::remove_copy</function></para></listitem>
+ <listitem><para><function>std::remove_copy_if</function></para></listitem>
+ <listitem><para><function>std::replace_copy</function></para></listitem>
+ <listitem><para><function>std::replace_copy_if</function></para></listitem>
+ <listitem><para><function>std::swap_ranges</function></para></listitem>
+ <listitem><para><function>std::transform</function></para></listitem>
+ </itemizedlist>
+ <para>
+ In addition, <function>std::copy_n</function>,
+ <function>std::fill_n</function> and
+ <function>std::generate_n</function> do not perform iterator
+ checking, either, but there is an explicit count which has to be
+ supplied by the caller, as opposed to an implicit length
+ indicator in the form of a pair of forward iterators.
+ </para>
+ <para>
+ These output-iterator-expecting functions should only be used
+ with unlimited-range output iterators, such as iterators
+ obtained with the <function>std::back_inserter</function>
+ function.
+ </para>
+ <para>
+ Other functions use single input or forward iterators, which can
+ read beyond the end of the input range if the caller is not careful:
+ </para>
+ <itemizedlist>
+ <listitem><para><function>std::equal</function></para></listitem>
+ <listitem><para><function>std::is_permutation</function></para></listitem>
+ <listitem><para><function>std::mismatch</function></para></listitem>
+ </itemizedlist>
+ </section>
+ </section>
<section id="sect-Defensive_Coding-CXX-Std-String">
<title>String handling with <literal>std::string</literal></title>
<para>
@@ -124,6 +179,11 @@
supplied an output area that is too small, and their use should
be avoided.
</para>
+ <para>
+ These issues make some of the standard library functions
+ difficult to use correctly, see <xref
+ linkend="sect-Defensive_Coding-CXX-Std-Functions-Unpaired_Iterators"/>.
+ </para>
</section>
</section>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 55/120: C++: Add section on iterators
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit f2167f7ee2ba265cee120e87e8be6c581094aec1
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Sep 17 13:28:00 2013 +0200
C++: Add section on iterators
---
defensive-coding/en-US/CXX-Std.xml | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/defensive-coding/en-US/CXX-Std.xml b/defensive-coding/en-US/CXX-Std.xml
index 181ad48..88fa803 100644
--- a/defensive-coding/en-US/CXX-Std.xml
+++ b/defensive-coding/en-US/CXX-Std.xml
@@ -87,7 +87,7 @@
<section id="sect-Defensive_Coding-CXX-Std-Subscript">
<title>Containers and <literal>operator[]</literal></title>
<para>
- Many containers similar to <literal>std::vector</literal>
+ Many sequence containers similar to <literal>std::vector</literal>
provide both <literal>operator[](size_type)</literal> and a
member function <literal>at(size_type)</literal>. This applies
to <literal>std::vector</literal> itself,
@@ -105,5 +105,25 @@
slightly more verbose.
</para>
</section>
+ <section id="sect-Defensive_Coding-CXX-Std-Iterators">
+ <title>Iterators</title>
+ <para>
+ Iterators do not perform any bounds checking. Therefore, all
+ functions that work on iterators should accept them in pairs,
+ denoting a range, and make sure that iterators are not moved
+ outside that range. For forward iterators and bidirectional
+ iterators, you need to check for equality before moving the
+ first or last iterator in the range. For random-access
+ iterators, you need to compute the difference before adding or
+ subtracting an offset. It is not possible to perform the
+ operation and check for an invalid operator afterwards.
+ </para>
+ <para>
+ Output iterators cannot be compared for equality. Therefore, it
+ is impossible to write code that detects that it has been
+ supplied an output area that is too small, and their use should
+ be avoided.
+ </para>
+ </section>
</section>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 54/120: Add material on std::string
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 594eeadc16bea3c82521470f3d6d1026edd6c608
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Sep 17 13:10:09 2013 +0200
Add material on std::string
---
defensive-coding/en-US/CXX-Std.xml | 79 +++++++++++++++++++++++++++++++++++++-
1 file changed, 78 insertions(+), 1 deletion(-)
diff --git a/defensive-coding/en-US/CXX-Std.xml b/defensive-coding/en-US/CXX-Std.xml
index 5ed53a4..181ad48 100644
--- a/defensive-coding/en-US/CXX-Std.xml
+++ b/defensive-coding/en-US/CXX-Std.xml
@@ -7,7 +7,84 @@
The C++ standard library includes most of its C counterpart
by reference, see <xref linkend="sect-Defensive_Coding-C-Libc"/>.
</para>
- <section>
+ <section id="sect-Defensive_Coding-CXX-Std-String">
+ <title>String handling with <literal>std::string</literal></title>
+ <para>
+ The <literal>std::string</literal> class provides a convenient
+ way to handle strings. Unlike C strings,
+ <literal>std::string</literal> objects have an explicit length
+ (and can contain embedded NUL characters), and storage for its
+ characters is managed automatically. This section discusses
+ <literal>std::string</literal>, but these observations also
+ apply to other instances of the
+ <literal>std::basic_string</literal> template.
+ </para>
+ <para>
+ The pointer returned by the <function>data()</function> member
+ function does not necessarily point to a NUL-terminated string.
+ To obtain a C-compatible string pointer, use
+ <function>c_str()</function> instead, which adds the NUL
+ terminator.
+ </para>
+ <para>
+ The pointers returned by the <function>data()</function> and
+ <function>c_str()</function> functions and iterators are only
+ valid until certain events happen. It is required that the
+ exact <literal>std::string</literal> object still exists (even
+ if it was initially created as a copy of another string object).
+ Pointers and iterators are also invalidated when non-const
+ member functions are called, or functions with a non-const
+ reference parameter. The behavior of the GCC implementation
+ deviates from that required by the C++ standard if multiple
+ threads are present. In general, only the first call to a
+ non-const member function after a structural modification of the
+ string (such as appending a character) is invalidating, but this
+ also applies to member function such as the non-const version of
+ <function>begin()</function>, in violation of the C++ standard.
+ </para>
+ <para>
+ Particular care is necessary when invoking the
+ <function>c_str()</function> member function on a temporary
+ object. This is convenient for calling C functions, but the
+ pointer will turn invalid as soon as the temporary object is
+ destroyed, which generally happens when the outermost expression
+ enclosing the expression on which <function>c_str()</function>
+ is called completes evaluation. Passing the result of
+ <function>c_str()</function> to a function which does not store
+ or otherwise leak that pointer is safe, though.
+ </para>
+ <para>
+ Like with <literal>std::vector</literal> and
+ <literal>std::array</literal>, subscribing with
+ <literal>operator[]</literal> does not perform bounds checks.
+ Use the <function>at(size_type)</function> member function
+ instead. See <xref
+ linkend="sect-Defensive_Coding-CXX-Std-Subscript"/>.
+ </para>
+ <para>
+ Never write to the pointers returned by
+ <function>data()</function> or <function>c_str()</function>
+ after casting away <literal>const</literal>. If you need a
+ C-style writable string, use a
+ <literal>std::vector<char></literal> object and its
+ <function>data()</function> member function. In this case, you
+ have to explicitly add the terminating NUL character.
+ </para>
+ <para>
+ GCC's implementation of <literal>std::string</literal> is
+ currently based on reference counting. It is expected that a
+ future version will remove the reference counting, due to
+ performance and conformance issues. As a result, code that
+ implicitly assumes sharing by holding to pointers or iterators
+ for too long will break, resulting in run-time crashes or worse.
+ On the other hand, non-const iterator-returning functions will
+ no longer give other threads an opportunity for invalidating
+ existing iterators and pointers because iterator invalidation
+ does not depend on sharing of the internal character array
+ object anymore.
+ </para>
+ </section>
+ <section id="sect-Defensive_Coding-CXX-Std-Subscript">
<title>Containers and <literal>operator[]</literal></title>
<para>
Many containers similar to <literal>std::vector</literal>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 53/120: C++ operator new[] has been fixed
in recent GCC versions
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit e32825c5c6860a273c27896c390b1219ba651f66
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Sep 17 11:11:39 2013 +0200
C++ operator new[] has been fixed in recent GCC versions
---
defensive-coding/en-US/CXX-Language.xml | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/defensive-coding/en-US/CXX-Language.xml b/defensive-coding/en-US/CXX-Language.xml
index 9dbc4f3..b6e6df9 100644
--- a/defensive-coding/en-US/CXX-Language.xml
+++ b/defensive-coding/en-US/CXX-Language.xml
@@ -19,8 +19,9 @@
array. Current GCC versions generate code that performs a
computation of the form <literal>sizeof(T) * size_t(n) +
cookie_size</literal>, where <literal>cookie_size</literal> is
- currently at most 8. This computation can overflow, and
- GCC-generated code does not detect this.
+ currently at most 8. This computation can overflow, and GCC
+ versions prior to 4.8 generated code which did not detect this.
+ (Fedora 18 was the first release which fixed this in GCC.)
</para>
<para>
The <literal>std::vector</literal> template can be used instead
@@ -28,11 +29,12 @@
overflow internally.)
</para>
<para>
- If there is no alternative to <literal>operator new[]</literal>,
- code which allocates arrays with a variable length must check
- for overflow manually. For the <literal>new T[n]</literal>
- example, the size check could be <literal>n || (n > 0 &&
- n > (size_t(-1) - 8) / sizeof(T))</literal>. (See <xref
+ If there is no alternative to <literal>operator new[]</literal>
+ and the sources will be compiled with older GCC versions, code
+ which allocates arrays with a variable length must check for
+ overflow manually. For the <literal>new T[n]</literal> example,
+ the size check could be <literal>n || (n > 0 && n >
+ (size_t(-1) - 8) / sizeof(T))</literal>. (See <xref
linkend="sect-Defensive_Coding-C-Arithmetic"/>.) If there are
additional dimensions (which must be constants according to the
C++ standard), these should be included as factors in the
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 52/120: Regenerate snippets
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 5b90f9975381095a48beab469167da3d870c39ab
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Mon Sep 16 15:11:29 2013 +0200
Regenerate snippets
---
.../en-US/snippets/C-String-Functions-strncat-as-strncpy.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml b/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml
index 0895eaf..1f5c8c6 100644
--- a/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml
+++ b/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml
@@ -4,5 +4,5 @@
<!-- Automatically generated file. Do not edit. -->
<programlisting language="C">
buf[0] = '\0';
-strncpy(buf, data, sizeof(buf) - 1);
+strncat(buf, data, sizeof(buf) - 1);
</programlisting>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 51/120: Actually use strncat in the
strncat example
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 805f9a85c843413140c867922bc2695cbbd1766a
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Mon Sep 16 15:08:29 2013 +0200
Actually use strncat in the strncat example
Spotted by Thomas Miletich <thomas.miletich(a)gmail.com>.
---
defensive-coding/src/C-String-Functions.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/defensive-coding/src/C-String-Functions.c b/defensive-coding/src/C-String-Functions.c
index 34d9c31..9f8898a 100644
--- a/defensive-coding/src/C-String-Functions.c
+++ b/defensive-coding/src/C-String-Functions.c
@@ -70,7 +70,7 @@ main(void)
assert(strncmp(buf, data, 9) == 0);
//+ C String-Functions-strncat-as-strncpy
buf[0] = '\0';
- strncpy(buf, data, sizeof(buf) - 1);
+ strncat(buf, data, sizeof(buf) - 1);
//-
}
{
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 50/120: Serialization: Mention that shelve
is problematic, too
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 43ab73b25747bbde0052ad266fa5470c6b1d98a0
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Wed Sep 4 16:19:19 2013 +0200
Serialization: Mention that shelve is problematic, too
---
defensive-coding/en-US/Tasks-Serialization.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/defensive-coding/en-US/Tasks-Serialization.xml b/defensive-coding/en-US/Tasks-Serialization.xml
index 456da55..008e75b 100644
--- a/defensive-coding/en-US/Tasks-Serialization.xml
+++ b/defensive-coding/en-US/Tasks-Serialization.xml
@@ -64,7 +64,7 @@
<itemizedlist>
<listitem><para>
Python's <package>pickle</package> and <package>cPickle</package>
- modules
+ modules, and wrappers such as <package>shelve</package>
</para></listitem>
<listitem><para>
Perl's <package>Storable</package> package
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 48/120: Update revision history
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit 72af9ff225c85977a45b48500cd5314f4fc2f9b4
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Aug 27 10:10:50 2013 +0200
Update revision history
---
defensive-coding/en-US/Revision_History.xml | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/defensive-coding/en-US/Revision_History.xml b/defensive-coding/en-US/Revision_History.xml
index 54ffa03..fc79226 100644
--- a/defensive-coding/en-US/Revision_History.xml
+++ b/defensive-coding/en-US/Revision_History.xml
@@ -8,6 +8,24 @@
<simpara>
<revhistory>
<revision>
+ <revnumber>1.1-1</revnumber>
+ <date>Tue Aug 27 2013</date>
+ <author>
+ <firstname>Eric</firstname>
+ <surname>Christensen</surname>
+ <email>sparks(a)redhat.com</email>
+ </author>
+ <revdescription>
+ <simplelist>
+ <member>Add a chapter which covers some Java topics.</member>
+ <member>Deserialization: Warn about Java's java.beans.XMLDecoder.</member>
+ <member>C: Correct the advice on array allocation
+ (<ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=995595">bug 995595</ulink>).</member>
+ <member>C: Add material on global variables.</member>
+ </simplelist>
+ </revdescription>
+ </revision>
+ <revision>
<revnumber>1.0-1</revnumber>
<date>Thu May 09 2013</date>
<author>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months
[defensive-coding-guide] 47/120: Revision_History.xml: Fix
cut-and-paste errors
by git repository hosting
This is an automated email from the git hooks/post-receive script.
sparks pushed a commit to branch master
in repository defensive-coding-guide.
commit ff46f1337c855c362b3d2181489dea5acb4fa697
Author: Florian Weimer <fweimer(a)redhat.com>
Date: Tue Aug 27 10:10:30 2013 +0200
Revision_History.xml: Fix cut-and-paste errors
---
defensive-coding/en-US/Revision_History.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/defensive-coding/en-US/Revision_History.xml b/defensive-coding/en-US/Revision_History.xml
index cba22e7..54ffa03 100644
--- a/defensive-coding/en-US/Revision_History.xml
+++ b/defensive-coding/en-US/Revision_History.xml
@@ -1,9 +1,9 @@
<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE appendix PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-<!ENTITY % BOOK_ENTITIES SYSTEM "UEFI_Secure_Boot_Guide.ent">
+<!ENTITY % BOOK_ENTITIES SYSTEM "Defensive_Coding.ent">
%BOOK_ENTITIES;
]>
-<appendix id="appe-UEFI_Secure_Boot_Guide-Revision_History">
+<appendix id="appe-Defensive_Coding-Revision_History">
<title>Revision History</title>
<simpara>
<revhistory>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
7 years, 9 months