Hi Martin, Joseph, > Date: 2026-10-09 08:29:28+0200 > From: Martin Uecker <[email protected]> > > Am Donnerstag, dem 08.10.2026 um 21:55 +0200 schrieb Alejandro Colomar: > > Hi Joseph, > > > > > Date: 2026-10-08 18:55:44+0000 > > > From: Joseph Myers <[email protected]> > > > > > > On Thu, 8 Oct 2026, Alejandro Colomar wrote: > > > > > > > > My suggestion would be to be strict on the new feature (e.g. disallow > > > > > _Countof for any parameter for which both a forward declaration and > > > > > another declaration of the parameter are visible) rather than adding > > > > > extra > > > > > checks for consistency of forward parameter declarations. > > > > > > > > That'd be unacceptable for me. I need to be able to use _Countof() on > > > > arrays that have been forward declared. > > > > > > > > Here's are a couple of examples: > > > > > > > > char * > > > > vseprintf(char dst[], const char end[]; > > > > char dst[dst?end-dst:0], const char end[0], const char > > > > *restrict fmt, va_list ap) > > > > > > Then the strict semantics could be for e.g. using _Countof for a > > > parameter > > > where a forward declaration gives an array length. > > > > I find that ok. > > > > Another (simpler, but which is a breaking change) would be to disallow > > the use of array length expressions in forward declarations. > > > > > > But we could have a different constraint which I'd find acceptable: > > > > > > > > - Disallow declaring any array length expressions within a forward > > > > declaration of a parameter. > > > > > > > > void f(int a[42]; int a[]); // constraint violation > > > > void g(int a[42]; int a[42]); // constraint violation > > > > void g(int a[]; int a[42]); // ok > > > > > > I think restricting the new feature in such cases would be better than > > > restricting forward declarations themselves in such cases. > > > > Ok. I have some concerns about having _Countof invalidate a certain > > expression that would otherwise be fine. But I also see the point in > > keeping backwards compatibility, so I accept the compromise. > > BTW: Even if not a constraint, I would still like to have the diagnostic > for any inconsistency between forward declaration and parameter as > this is most likely a bug which should be diagnosed (I do not count > one as having a length and the other not as inconsistncy). > > > > > Let's say it's disallowed to take the _Countof() of an array whose > > length expression has appeared in a forward declaration. > > > > Would you (or Martin) mind helping me implement that? I'm pretty much > > lost about how to do it. I guess we should have a flag or something > > that tells whether this has happened, but I lack the knowledge of the > > internals needed to do this, I fear. > > Yes, it would be a bit annoying to implement I think. > > Perhaps we could remove the attribute carrying the length information > from the parameter when there is also such an attribute on the > forward declaration. This should then perhaps cause a warning.
Hmmm, this could work, although it could be surprising and dangerous to
remove it, because then fortification would be degraded, right?
I think it might be better to disallow it.
So, let's see alternatives we have not fully discarded yet (in no
particular order):
- Make it unspecified which of the array length expressions is used.
- Disallow using _Countof() on array parameters where the array length
is specified in a forward declaration.
The easiest way to implement this is to interpret
void f(int a[42]; int a[42]);
as
void f(int a[42]; int a[]);
which will obviously disallow _Countof().
This could be dangerous, as we'd be degrading fortification
information.
- Disallow specifying an array length if it has been specified before.
Diagnose the following:
void f(int a[42]; int a[42]);
(even when not using _Countof()!)
This is a breaking change, but chances are quite low of actually
having code that does this. Other than potentially requiring
changes to existing code, it should be fine and safe.
We could continue allowing this:
void f(int a[42]; int a[]);
(but _Countof() would fail.)
The specification of _Countof() would be that it is not allowed
if the array length was specified in a forward declaration.
I think I've covered them all.
I prefer the 3rd alternative, then the 1st, and I'd like to avoid the
2nd. What do you think about them? Did I miss any other alternative?
Have a lovely day!
Alex
>
>
> Martin
>
> >
> > Anyway, I can start by documenting that it's not allowed to do that.
> >
> >
> > Have a lovely night!
> > Alex
--
<https://www.alejandro-colomar.es>
signature.asc
Description: PGP signature
