[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1371397720.5692.103.camel@eris.loria.fr>
Date: Sun, 16 Jun 2013 17:48:40 +0200
From: Jens Gustedt <jens.gustedt@...ia.fr>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] bugfix: initialize a state variable in lio_wait
Am Sonntag, den 16.06.2013, 10:24 -0400 schrieb Rich Felker:
> On Sun, Jun 16, 2013 at 11:31:58AM +0200, Jens Gustedt wrote:
> > In all, this re-enforces my opinion to *always* initialize variables,
> > unless I know that its address is immediately passed to an
>
> I disagree with this principle. If you initialize the variable to a
> dummy value, the compiler (or other static analysis tools) cannot
> catch erroneous use of the variable before a real value is stored in
> it. Also valgrind cannot catch them. Your "always initialize"
> principle only makes sense when (as in this case) there's an obvious
> "default value" the variable should have if it's not set elsewhere.
> But often that's not the case, especially for pointers.
For pointers and all other types of objects there is the C default
initialization with 0. Statically allocated objects are initialized
with that, and so in general code should be made "robust" with respect
to such an initialization, be it just by failing loud and clear when
we run over a pointer that is 0 initialized. (and analysis tools
should be capable to tell us potential dereferences of 0-pointers, the
same as they should be able to find unitialized use.)
The other aspect of that is the possibility of C99 to declare
variables as late as possible. 90% of the variables could be declared
at their first write, which eliminates most of these problems.
Whereas such a 0-initialization strategy mostly works for application
code, there might in fact be issues for a C library such as musl. I
agree that there are circumstances where it just can't fail. But these
code spots need special care, anyhow, I think.
The musl functions that I looked into are short and sweet, but
unfortunately somewhat "obfuscated" by this
top-of-function-declaration mania. I find a style as I posted it
earlier for lio_wait much more readable, for me and for the compiler:
static int lio_wait(struct lio_state *st)
{
int got_err = 0;
struct aiocb **const cbs = st->cbs;
for (int i=0, cnt = st->cnt; i<cnt; i++) {
...
Jens
--
:: INRIA Nancy Grand Est :: http://www.loria.fr/~gustedt/ ::
:: AlGorille ::::::::::::::: office Nancy : +33 383593090 ::
:: ICube :::::::::::::: office Strasbourg : +33 368854536 ::
:: ::::::::::::::::::::::::::: gsm France : +33 651400183 ::
:: :::::::::::::::::::: gsm international : +49 15737185122 ::
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
