Re: NULL

[Rich Felker <dalias@aerifal.cx>]

On Wed, Jan 09, 2013 at 04:18:12PM +0100, John Spencer wrote:
> >__attribute__ ((sentinel)) may be used. Adding this to the appropriate
> >gtk headers (even just as a temporary debugging measure if it's not
> >desirable permanently) would catch all the bugs calling gtk variadic
> >functions.
> >
> 
> indeed this does emit a warning. however, it will only detect
> sentinels, not other variadic arguments that are expected to be
> pointers but will be passed as int instead. i haven't tested, but it
> will most likely also cause crashes.

Indeed, you are correct. I suspect most such uses _also_ have a
sentinel where incorrect code will also mess up the sentinel, but in
principle it's possible that this does not happen.

A good system of static analysis for variadic functions would need
some way to express the interface contract in terms of a predicate on
the argument types (and possibly contents) of arguments. I'm not aware
of any such system existing, so the matter falls back to whether we
would really need it to avoid all these bugs.

> >If we decide something is needed at the musl level, in my opinion the
> >only acceptable solution is just replacing 0 with 0L unconditionally.
> >Actually I'd like to remove the special-case for C++ and make NULL
> >_always_ be defined to 0 or 0L, but I worry too many people would
> >complain...
> 
> yes, 0L is definitely nicer.
> regarding C code, it would infact be more consequent if you make it
> 0/0L there as well.
> what issues could arise in C code when (void* ) 0 is replaced with 0L ?

The original reason I left NULL with pointer type was to catch the
other idiotic error:

    str[len]=NULL;

i.e. confusion of NULL with ASCII NUL. However, this raises a good
question: short of C11 _Generic, is it even possible for a program to
detect whether NULL has integer or pointer type?

I know of one way, but it's very obscure:

int null_is_ptr_type()
{
	char s[1][1+(int)NULL];
	int i = 0;
	return sizeof s[i++], i;
}

Are there any ways that might actually affect/break programs?

Rich