Re: Buffer overflow Article - CACM

["Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de>]

On Mon, 14 Nov 2005 20:57:40 +0000, Simon Wright wrote:

> "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> writes:
> 
>> This is not the whole truth. I agree that overhead caused by
>> run-time checks is not a big deal. But that is not the problem in my
>> view. Let they be 0%! The real problem is that a check may fail
>> while program crash is not an option. This means that there must be
>> some error handling. More errors may happen at run-time more complex
>> infrastructure one would require. Add here unit tests for these
>> errors etc.
> 
> For information -- is your point that we should design the program
> (using eg SPARK) so that there isn't any need for runtime checking?

Yes, when possible.

> (I don't think it likely that you want us not to bother to do any
> checking!)

We should draw line between "functional" and "non-functional" checks. When
checks is an artefact of program/language/environment design then its
penalty is more than just run-time overhead. Of course the distinction is
not absolute. For example End_Error might look functional, but probably in
a better OS with OO interface you will never have it working with a string
container, XML document rather than with a raw byte stream. Buffer overflow
checks is a clear "non-functional" candidate to me. This is also a reason
why I'm skeptical about the design of Unbounded_String and Ada.Container.
They don't support safe iteration constructs "for I in X'Range loop".

-- 
Regards,
Dmitry A. Kazakov
http://www.dmitry-kazakov.de