No type checking in ctype builtins

No type checking in ctype builtins

[Andrea Monaco]

This program

  #include <ctype.h>

  int main ()
  {
    char *s;
    isspace (s);
  }

compiles with no warning in gcc 8.3.0, even though there's a type
mistake; the correct call would be isspace (*s).

The ctype functions are implemented as macros in glibc, so you can't
have type checking.  But they are also provided as builtins by gcc, so I
wonder why type checking is not performed in that case, either.



Thanks,

Andrea Monaco

Re: No type checking in ctype builtins

[Andreas Schwab]

On Apr 27 2022, Andrea Monaco via Gcc wrote:

> This program
>
>   #include <ctype.h>
>
>   int main ()
>   {
>     char *s;
>     isspace (s);
>   }
>
> compiles with no warning in gcc 8.3.0, even though there's a type
> mistake; the correct call would be isspace (*s).

Try -Wsystem-headers.

> The ctype functions are implemented as macros in glibc, so you can't
> have type checking.  But they are also provided as builtins by gcc, so I
> wonder why type checking is not performed in that case, either.

You need to suppress the macro to get the builtin.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."

Re: No type checking in ctype builtins

[Jonathan Wakely]

On Wed, 27 Apr 2022 at 16:29, Andrea Monaco via Gcc <gcc@gcc.gnu.org> wrote:
>
>
> This program
>
>   #include <ctype.h>
>
>   int main ()
>   {
>     char *s;
>     isspace (s);
>   }
>
> compiles with no warning in gcc 8.3.0, even though there's a type
> mistake; the correct call would be isspace (*s).

N.B. The correct call would be isspace((unsigned char)*s) because
isspace has undefined behaviour if you pass it a char with a negative
value.

It would be nice if GCC warned about *that*.

Re: No type checking in ctype builtins

[Andrea Monaco]

  > Try -Wsystem-headers.

You're right.  That showed a warning.


  > You need to suppress the macro to get the builtin.

That means a macro expansion takes precedence over a builtin function
substitution, if I understand correctly.  It makes sense, because
preprocessing happens before compilation.

Maybe we could mention that in the manual, for example in "6.59 Other
Built-in Functions Provided by GCC"
(https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html).



Andrea Monaco

Re: No type checking in ctype builtins

[Florian Weimer]

* Andreas Schwab:

> On Apr 27 2022, Andrea Monaco via Gcc wrote:
>
>> This program
>>
>>   #include <ctype.h>
>>
>>   int main ()
>>   {
>>     char *s;
>>     isspace (s);
>>   }
>>
>> compiles with no warning in gcc 8.3.0, even though there's a type
>> mistake; the correct call would be isspace (*s).
>
> Try -Wsystem-headers.
>
>> The ctype functions are implemented as macros in glibc, so you can't
>> have type checking.  But they are also provided as builtins by gcc, so I
>> wonder why type checking is not performed in that case, either.
>
> You need to suppress the macro to get the builtin.

Shouldn't that happen automatically with -O2?

I think it's a header bug, we don't use inline functions in C mode, only
in C++ mode:

#ifndef __cplusplus
# define __isctype(c, type) \
  ((*__ctype_b_loc ())[(int) (c)] & (unsigned short int) type)
#elif defined __USE_EXTERN_INLINES
# define __isctype_f(type) \
  __extern_inline int							      \
  is##type (int __c) __THROW						      \
  {									      \
    return (*__ctype_b_loc ())[(int) (__c)] & (unsigned short int) _IS##type; \
  }
#endif

Thanks,
Florian

Re: No type checking in ctype builtins

[Eric Gallager]

On Wed, Apr 27, 2022 at 12:20 PM Jonathan Wakely via Gcc
<gcc@gcc.gnu.org> wrote:
>
> On Wed, 27 Apr 2022 at 16:29, Andrea Monaco via Gcc <gcc@gcc.gnu.org> wrote:
> >
> >
> > This program
> >
> >   #include <ctype.h>
> >
> >   int main ()
> >   {
> >     char *s;
> >     isspace (s);
> >   }
> >
> > compiles with no warning in gcc 8.3.0, even though there's a type
> > mistake; the correct call would be isspace (*s).
>
> N.B. The correct call would be isspace((unsigned char)*s) because
> isspace has undefined behaviour if you pass it a char with a negative
> value.
>
> It would be nice if GCC warned about *that*.

Related bugs:
78155: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78155
99950: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99950