From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 0FF7A3858025; Thu, 15 Sep 2022 18:21:26 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0FF7A3858025 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1663266086; bh=N9BfokwSlMo/4Aj5H/ttnck05npU3GCcfSgfOzJb9UM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=BA7s0jt6Ppil9WIdEv+mEPdDsTgWw1wAvu+VlV6bg2rdJAm8smlx4PIIBAfwfipyz 14RdNyiHMXscR9d+yyUep49ilR0EfnFohrWL36WlPJ5wZIFA2eWw98v3bR9DzXEnGk 5L3QxinjXSVDY5eXXLhkupzRQHgAeV0Kaj0JF+Xw= From: "jzwinck at gmail dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/106926] string_view construction from literal string containing null/zero should warn Date: Thu, 15 Sep 2022 18:21:25 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c++ X-Bugzilla-Version: 13.0 X-Bugzilla-Keywords: diagnostic X-Bugzilla-Severity: enhancement X-Bugzilla-Who: jzwinck at gmail dot com X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D106926 --- Comment #2 from John Zwinck --- Jonathan, yes it was a real problem, I wrote such buggy code myself. I was more complacent with string_view than I might have been with std::string because everyone knows string_view doesn't have to be null terminated (bad excuse, but it's mine). I agree the same problem could happen with std::string. As for your idea to add an attribute, I assume you mean something like this: string_view(const char* s __attribute__((does_strlen))); I think this would work but it seems like the attribute would have to be ad= ded in many places. Instead, the compiler could statically determine that the length of the string is lost in code like this: string_view foo("bad\0string"); And maybe even here: const char* bar =3D "another\0one"; Though that may be a step too far because someone could hard-code the lengt= h 12 elsewhere, and there probably is code in the wild doing that. In general the diagnostic could apply wherever the compiler knows the conte= nts will be copied. Since that's not always possible to know, maybe it could assume copying will happen when the literal is passed to an out-of-line function. I recognize this might be too harsh for -Wall; I'd still be quite happy to = see the warning with -Wextra. The attribute idea is also fine, if you think it= 's feasible to apply it in enough places and not too ugly. Thank you.=