From: Jim Meyering <jim@meyering.net>
To: Eli Zaretskii <eliz@gnu.org>
Cc: emacs-devel@gnu.org
Subject: Re: oops? read/write vs type of length parameter
Date: Mon, 11 Apr 2011 13:08:38 +0200 [thread overview]
Message-ID: <87d3ktjb9l.fsf@rho.meyering.net> (raw)
In-Reply-To: <E1Q9DfN-00007M-08@fencepost.gnu.org> (Eli Zaretskii's message of "Mon, 11 Apr 2011 05:44:17 -0400")
Eli Zaretskii wrote:
>> From: Jim Meyering <jim@meyering.net>
>> Date: Mon, 11 Apr 2011 10:55:35 +0200
>> Cc: Eli Zaretskii <eliz@elta.co.il>
>>
>> In http://bzr.savannah.gnu.org/lh/emacs/trunk/revision/103883
>> you adjusted the signatures of emacs_read and emacs_write.
>>
>> - extern int emacs_read (int, char *, unsigned int);
>> - extern int emacs_write (int, const char *, unsigned int);
>> + extern ssize_t emacs_read (int, char *, ssize_t);
>> + extern ssize_t emacs_write (int, const char *, ssize_t);
>
> Yes, that's part of my on-going effort to allow editing of files
> larger than 2GB. With that revision, I can finally visit such a large
> file, modify it, and save it to disk :-)
>
>> It's good to see that you corrected the return type to be wider
>> (ssize_t) and still signed, just like "int".
>
> That's what its callers expect: the return value can be positive or
> negative.
As I said, that part is welcome.
It also makes these functions more like read and write.
>> However, did you really intend to make the buffer length parameters signed?
>> I would have expected those to be of type size_t, not ssize_t.
>
> We call these functions with an argument of type EMACS_INT, which can
> be negative.
With read and write, there is already a tension there,
since the return value (length or error indicator) is signed,
while the length parameter is unsigned, and hence slightly wider.
> I don't want it to wind up as a large positive value
> inside these functions, I'd rather the functions fail instead. Note
> that emacs_write is careful enough to check the sign of that argument,
> and if we want a similar guard in emacs_read, we can easily add that.
Currently, emacs_write silently ignores an invalid buffer length,
treating it just like a length of 0. It'd be better not to ignore
such an error.
IMHO, an interface that takes a logically unsigned parameter
should have an unsigned type.
I guess I'm biased towards least-surprise for developers, so I
think read- and write-like functions should accept a buffer length
argument of type size_t, to be consistent with read and write.
To try to protect against bugs by changing API to a signed type may
actually cause trouble when callers end up mixing/comparing their
newly signed (to accommodate the invented API) and unsigned lengths
from standard functions.
Another thing to keep in mind: on some older systems, trying to read
more than INT_MAX bytes in a single syscall will fail.
next prev parent reply other threads:[~2011-04-11 11:08 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-04-11 8:55 oops? read/write vs type of length parameter Jim Meyering
2011-04-11 9:44 ` Eli Zaretskii
2011-04-11 11:08 ` Jim Meyering [this message]
2011-04-11 11:28 ` David Kastrup
2011-04-11 11:52 ` Eli Zaretskii
2011-04-11 12:27 ` Jim Meyering
2011-04-11 12:31 ` David Kastrup
2011-04-11 21:54 ` Jim Meyering
2011-04-12 4:44 ` Eli Zaretskii
2011-04-12 13:24 ` Ted Zlatanov
2011-04-12 13:29 ` Eli Zaretskii
2011-04-12 14:47 ` Ted Zlatanov
2011-04-12 17:00 ` Large file support (was: oops? read/write vs type of length parameter) Eli Zaretskii
2011-04-14 20:57 ` oops? read/write vs type of length parameter Michael Welsh Duggan
2011-04-11 14:02 ` Eli Zaretskii
2011-04-11 11:40 ` Stephen J. Turnbull
2011-04-11 13:58 ` Eli Zaretskii
2011-04-12 1:16 ` Paul Eggert
2011-04-12 3:01 ` Eli Zaretskii
2011-04-12 5:06 ` Paul Eggert
2011-04-12 5:46 ` Eli Zaretskii
2011-04-12 8:19 ` Paul Eggert
2011-04-12 9:41 ` Eli Zaretskii
2011-04-12 15:53 ` Paul Eggert
2011-04-12 16:56 ` Eli Zaretskii
2011-04-12 23:55 ` Juanma Barranquero
2011-04-13 5:14 ` Paul Eggert
2011-04-13 6:31 ` Jim Meyering
2011-04-13 6:37 ` Eli Zaretskii
2011-04-13 8:15 ` Paul Eggert
2011-04-13 9:46 ` Eli Zaretskii
2011-04-13 16:06 ` Paul Eggert
2011-04-13 17:22 ` Eli Zaretskii
2011-04-13 19:31 ` Paul Eggert
2011-04-13 19:59 ` PJ Weisberg
2011-04-14 4:49 ` Eli Zaretskii
2011-04-13 20:02 ` Paul Eggert
2011-04-13 6:49 ` Eli Zaretskii
2011-04-13 14:35 ` Ted Zlatanov
2011-04-15 13:13 ` Ted Zlatanov
2011-04-15 16:34 ` Paul Eggert
2011-04-15 18:20 ` Ted Zlatanov
2011-04-15 1:29 ` Stefan Monnier
2011-04-15 8:55 ` Paul Eggert
2011-04-15 9:41 ` Eli Zaretskii
2011-04-15 10:24 ` Paul Eggert
2011-04-12 12:32 ` Davis Herring
2011-04-12 13:38 ` Eli Zaretskii
2011-04-12 15:43 ` Paul Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d3ktjb9l.fsf@rho.meyering.net \
--to=jim@meyering.net \
--cc=eliz@gnu.org \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).