Re: Implement C11 annex K?

[dalias <dalias at libc dot org>]

On Sun, Aug 17, 2014 at 02:03:25PM -0400, David A. Wheeler wrote:
> On Sat, 16 Aug 2014 01:01:01 -0400, Rich Felker <dalias@libc.org> wrote:
> > Actually snprintf has both if you want:
> > 
> > snprintf(dest, destsize, "%.*s", srcsize, src);
> 
> As far as I can tell this doesn't guarantee that *reading* stops immediately once
> you exceed the length.
> 
> ISO/IEC 9899:2011 (E) section 7.21.6.1 ("The fprintf function") says under "s":
> "If no l length modifier is present, the argument shall be a pointer to the initial
> element of an array of character type.280) Characters from the array are
> written up to (but not including) the terminating null character. If the
> precision is specified, no more than that many bytes are written."

You missed the next sentence:

"If the precision is not specified or is greater than the size of the
array, the array shall contain a null character."

> Sure, src isn't required to point to a null-terminated string, so the spec requires that
> the implementation stop reading eventually.  But there's no guarantee in the spec
> that it'll stop at any particular point.  It could read 2G, then notice :-).

Formally there is no such thing as reading past the end of the array
(or even indexing past the end of the array). Yes a pathological
implementation on a machine without trapping could in principle do
such reads on the hardware, but it could also contain useless loops
that spin doing nothing for 10 seconds. There is no way to specify
that actions which are undefined don't happen without specifying
bounded time to return, which is way outside the scope of C.

Rich