Safer and Better C

[bazad]

Hi,

I am not using C all the time. I have a general understanding of C
and nothing else. The recent reply to use strlcpy and strlcat showed
me that I am not aware of the best and safe techniques. Is there any
place where I could learn more about safer and better C (on FreeBSD)?
Thank you

[CBFalconer]

John Bode wrote:

.... snip ...
1. Initialize all variables to a known value.
2. Check all return values from library functions.
3. Don't use gets().
4. During development, set the warning level on the compiler to
its highest setting. Review and eliminate each warning.
5. Don't cast an expression *just* to eliminate a warning.
6. When comparing against a constant expression for equality, put
the constant on the LHS (i.e., if (SOME_CONSTANT == x)); this
will catch any problems where you typed "=" when you meant "==".
7. Abstract out tedious, repetitive, and/or low-level tasks. IOW,
don't call malloc() directly from your application code, but
wrap it in a function that performs error checking and
initialization of the memory being returned.

I agree with all except #1, which can mask a failure to suitably
initialize later.

--
Chuck F (cb********@yah oo.com) (cb********@wor ldnet.att.net)
Available for consulting/temporary embedded and systems.
<http://cbfalconer.home .att.net> USE worldnet address!

[Kenny McCormack]

In article <g0************ *****@newsread3 .news.pas.earth link.net>,
Mike Wahler <mk******@mkwah ler.net> wrote:

"Keith Thompson" <ks***@mib.or g> wrote in message
news:ln******* *****@nuthaus.m ib.org...

jo*******@my-deja.com (John Bode) writes:
[...]

> 6. When comparing against a constant expression for equality, put the
> constant on the LHS (i.e., if (SOME_CONSTANT == x)); this will catch
> any problems where you typed "=" when you meant "==".

[...]

This one is controversial. Personally, I find the (5 == x) form
grating; I'd rather use (x == 5) and just make sure I get the operator
right. (This has been discussed to death here before.)

#define equals ==

if(x equals y)
;

Heh.

But don't most compilers catch (warn about) this anyway, these days?

That is, they want you to change:

if (x = 5)
to:
if ((x = 5))

[Guillaume]

> But don't most compilers catch (warn about) this anyway, these days?

That is, they want you to change:

if (x = 5)
to:
if ((x = 5))

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

[Keith Thompson]

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

But don't most compilers catch (warn about) this anyway, these days?
That is, they want you to change:
if (x = 5)
to:
if ((x = 5))

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

--
Keith Thompson (The_Other_Keit h) ks***@mib.org <http://www.ghoti.net/~kst>
San Diego Supercomputer Center <*> <http://users.sdsc.edu/~kst>
We must do something. This is something. Therefore, we must do this.

[Kelsey Bjarnason]

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

But don't most compilers catch (warn about) this anyway, these days?
That is, they want you to change:
if (x = 5)
to:
if ((x = 5))

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

int main()
{
int x = 3, y = 4;

if ( y = x )
;

return 0;
}

gcc -Wall test.c
test.c: In function `main':
test.c:5: warning: suggest parentheses around assignment used as truth
value
Apparently, it does. Just not with the default warning levels... but
you'd never fail to use at least -Wall during development, would you?

[Arthur J. O'Dwyer]

On Fri, 15 Oct 2004, Kelsey Bjarnason wrote:

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))
gcc doesn't.

[...] Apparently, it does.

Try again, this time with the line Guillaume asked about. Keith's
absolutely right.

On the other hand, gcc /will/ warn you if you leave off the redundant
parentheses in Guillaume's example. Which some people might see as an
advantage to leaving them off (my preferred style in many cases as it
reduces clutter), but really I don't consider "mistyping == as = or
vice versa" to be a statistically significant problem in the first place.

-Arthur

[Jonathan Adams]

In article
<pa************ *************** *@xxnospamyy.li ghtspeed.bc.ca> ,
Kelsey Bjarnason <ke*****@xxnosp amyy.lightspeed .bc.ca> wrote:

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

But don't most compilers catch (warn about) this anyway, these days?
That is, they want you to change:
if (x = 5)
to:
if ((x = 5))

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

int main()
{
int x = 3, y = 4;

if ( y = x )
;

return 0;
}

gcc -Wall test.c
test.c: In function `main':
test.c:5: warning: suggest parentheses around assignment used as truth
value

I believe they were referring to the latter construction:

if ((x = 5) && (y == 6))

which is not caught (at least not with -Wall on gcc 3.4.2).

Cheers,
- jonathan

[Ben Pfaff]

Kelsey Bjarnason <ke*****@xxnosp amyy.lightspeed .bc.ca> writes:

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

if ( y = x )
;

Are you paying attention?
--
Ben Pfaff
email: bl*@cs.stanford .edu
web: http://benpfaff.org

[Keith Thompson]

"Arthur J. O'Dwyer" <aj*@nospam.and rew.cmu.edu> writes:

On Fri, 15 Oct 2004, Kelsey Bjarnason wrote:

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

[...]

Apparently, it does.

Try again, this time with the line Guillaume asked about. Keith's
absolutely right.

On the other hand, gcc /will/ warn you if you leave off the
redundant parentheses in Guillaume's example. Which some people
might see as an advantage to leaving them off (my preferred style in
many cases as it reduces clutter), but really I don't consider
"mistyping == as = or vice versa" to be a statistically significant
problem in the first place.

The parentheses aren't redundant (if that's really supposed to be "="
rather than "=="). If you leave them out:

if (x = 5 && y == 6)

is equivalent to

if (x = (5 && y == 6))

Of course if you correctly use "==" rather than "=", they are redundant:

if (x == 5 && y == 6)

--
Keith Thompson (The_Other_Keit h) ks***@mib.org <http://www.ghoti.net/~kst>
San Diego Supercomputer Center <*> <http://users.sdsc.edu/~kst>
We must do something. This is something. Therefore, we must do this.

[Kelsey Bjarnason]

On Sat, 16 Oct 2004 00:12:55 -0400, Arthur J. O'Dwyer wrote:

On Fri, 15 Oct 2004, Kelsey Bjarnason wrote:

On Sat, 16 Oct 2004 01:26:14 +0000, Keith Thompson wrote:

Guillaume <"grsNOSPAM at NOTTHATmail dot com"> writes:

What will the compiler catch if you have a multiple test, like:

if ((x = 5) && (y == 6))

gcc doesn't.

[...]

Apparently, it does.

Try again, this time with the line Guillaume asked about. Keith's
absolutely right.

Actually, it does. Note that the (x=5) is included in the extra layer of
parentheses, which is the _fix_ to allow such a situation to occur without
the warning. Trying it in the context of the original actual problem -
without the extra parentheses - it does, indeed, complain.

One can hardly say "X doesn't do this" when it does _unless_ one takes
steps to prevent it... and then test with code which has, in fact, taken
those steps. Might as well compile with all warnings disabled and then
complain the compiler doesn't detect any of a thousand or more things.