Re: Buffer overflow Article - CACM

["Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de>]

On Tue, 15 Nov 2005 23:32:37 +0100, Georg Bauhaus wrote:

> Dmitry A. Kazakov wrote:
>> On Tue, 15 Nov 2005 15:03:11 +0100, Georg Bauhaus wrote:
>> 
>>>Dmitry A. Kazakov wrote:
>>>
>>>>Ada.Container.
>>>>They don't support safe iteration constructs "for I in X'Range loop".
>>>
>>>Ada.Container does provide safe iteration construct, be
>>>suitably defining and/or suggesting what is meant by "safe".
>>>
>>>OTOH, for I in X'Range loop alone doesn't imply that
>>>iteration will be safe.
>> 
>> As you said, it depends on the definition. Clearly it isn't safe against
>> shelling the computer.
> 
> For sure you can get Constrain_Error using the library,
> and this isn't alwas pleasant. Yet, in which ways is any of the
> following more safe than the other?
> 
>    for I in X'Range loop
>       Modify_Element(X(I));
>    end loop;
> 
>    Iterate(X, Modify_Element'Access);

You are comparing apples and oranges. The first is a language construct,
the second is a call to procedure. They could be made comparable if Ada had
subroutines as first class objects:

   Iterate (X, procedure (E : in out Element_Type) is begin ... end);

Or at least:

   Iterate (X, Modify_Element);

But that is aside. What would you say about the same written in Assembly:

MOV $Modify_Element, R1
MOV $X, R2
JMP $Iterate   ; Isn't this safe?

The question is not how iteration and element processing are composed:
using procedural decomposition or language constructs. The question is how
iteration is expressed. These are not directly related issues and there is
not much choice here: loop vs. recursion.

Note also that your example is based on a trick. You bring a black horse
Modify_Element into consideration. Nothing is known about it. So whatever
the enclosing construct does and how it does this, safety is 0.

As for Robert's note about explicit indices, it would be nice to have

   for E in X loop ...

for array types as well. I think it would be quite easy to implement in an
Ada compiler.

-- 
Regards,
Dmitry A. Kazakov
http://www.dmitry-kazakov.de