Esthetics (or worse?) of Secure Pointers

[Joe Buck]

Greg McGary writes:
> Bob, I think you are hallucinating! John and I agreed long ago
> that trying to mix bounded and unbounded code is an exercise in
> frustration, and a poor use of time, since the resulting program has
> holes in its checking.

It might be possible, for specific libraries, to write a set of thunks
that would allow bounds-checked code to call the non-bounds-checked C
library.  Such things might be necessary for people on OSes that don't
have a free C library to use the bounds checking compiler.  This thunks
layer would assume that the C library is correct, and use the known
properties of the library function to determine bounds in cases where
pointers are returned (e.g. for malloc we set the lower bound to result
and the upper bound to result+size).  And yes, I know there are lots of
problems with functions like strchr that assume strings are properly
null-terminated.

But even if this is done, in the end it perhaps doesn't make a great
deal of difference: if you use bounds checking you need a different libc.
Perhaps this is produced by building a libc from source with a bounds
checking compiler, or perhaps it is produced by some other form of
trickery as described above.