Re: My project

["Joseph S. Myers" <jsm28 at cam dot ac dot uk>]

On Sat, 24 Feb 2001 odeen@bigfoot.com wrote:

> ** `loop' structure
> 
> The syntax of the loop structure is the following

I don't recommend adding any new keywords that aren't in the reserved
namespace - use reserved names such as __loop and __trusted instead.  
Also, avoid adding any new tokens that could change how strictly
conforming programs are lexed or parsed.

What does this loop construct do that couldn't be done by optimising away
bounds checks from full bounded pointers in normal C code?  Can you give
an example of a loop construct and corresponding normal C code where the
compiler could not reasonably optimise away bounds checks in the normal
code but could with your loop construct?

> ** `trusted' values

Which syntactic component are you making the word 'trusted'?  Is it a type
qualifier?  If so, can you have both trusted pointers to untrusted data
(char *trusted p) and untrusted pointers to trusted data (trusted char
*p)?  Or is it a storage class specifier?  If so, what exactly does it
mean about data reached by multiple levels of indirection?

Which syntax productions in ISO 9899 do you change for your 'trusted' and
'reliable' constructs, and what changes do you make to them?

Do you have precise changes to the text of ISO 9899 that specify your
extension?  If not, you should write them.  GCC has too many
badly-specified extensions; when creating one, you should concentrate your
mind on exactly how it interacts with every other feature of C and how
this can be specified in a rigorous manner.  Similarly, do you have a
thorough testsuite, including for the features you haven't yet
implemented?

What are your arguments that this extension fits within the spirit of C?  
When would the use of these extensions be an appropriate secure coding
practice, rather than using Perl's runtime taint checking, or writing in a
paranoid style (as with qmail) that eschews use of *printf, *scanf,
standard C string functions, etc., in favour of small local functions that
do exactly one thing, use string objects with bounds, etc.?

-- 
Joseph S. Myers
jsm28@cam.ac.uk