Re: ANSI C and POSIX (was Re: C/C++ knocks the crap out of Ada)

[dewar@cs.nyu.edu (Robert Dewar)]

Peter said

"How?  No offense meant, but any code which can be affected by this is flat
out broken.  POSIX-style read is to be given a pointer to at least nbytes
of space, for the information read.  Period."

That's really confusing, the code in question DID give a buffer large
enough to hold nbytes of data, where nbytes is the number of bytes 
for "the information read". Maybe I don't understand, but reading the
above sentence, it sounds like you would be surprised by the Linux
behavior.

Here is the exact case. We declare a buffer of 100 bytes. We read a
1000 bytes from a file whose total length is 68 bytes. On all systems
that we had experience with other than Linux, this worked fine, the
first 68 bytes of the buffer is filled, and the remaining 32 bytes
is unused. 

I am not claiming this is "correct" code in some abstract sense. I
certainly can't tell that it is wrong from the definitions I have
of the read function. What I am claiming is that this worked on
all systems we tried it on, and then failed on Linux. I am not saying
Linux is wrong here, just that its behavior was surprising!

The code in question made 100% sure that the data read would never
exceed the buffer size, and I would have been hard pressed to
determine that the code was incorrect. 

I am not sure that POSIX is relevant here, almost none of the systems on
which we ran claimed POSIX compliance. Peter, can you post the POSIX
wording on read, I don't have it at hand. Does it in fact make it
clear that the Linux behavior is correct and that the program was
wrong.

Let's suppose that the POSIX standard does in fact make it clear that
the Linux behavior is correct. I still think the check is unwise
(note that the check is not against the actual size of the buffer
given, this is of course impossible in C, it is against the end
of the address range of the data area). It's a good example of the
kind of principle I mentioned before. Since almost all systems allow
the program I described above to work correctly, and it is manifestly
safe programming evenif the check is not present, I think it would
be a better choice for Linux not to do this extra check.