-fbounds-safety: Enforcing bounds safety for C • Hacker News Board

Re: -fbounds-safety: Enforcing bounds safety for C

#21

Post by zephen » Thu, Feb 19, 2026, 3:13 PM UTC

nananana9 wrote: post #9

baq wrote: post #8

Earlier quoted context omitted.

and if you write directly in assembly you don't even need a C++ compiler

That's an objectively correct statement, but I don't see how it makes sense as a response to my comment, as I'm advocating to use the more advanced feature-rich tool over the compiler-specific-hacks one.

> I don't see how it makes sense as a response to my comment

Your comment started out with "just."

As if there are never any compelling reasons to want to make existing C code better.

But instead of taking that as an opportunity to reflect on when various tools might be appropriate,

> as I'm advocating to use the more advanced feature-rich tool over the compiler-specific-hacks one.

You've simply doubled down.

Re: -fbounds-safety: Enforcing bounds safety for C

#22

Post by groundzeros2015 » Thu, Feb 19, 2026, 3:19 PM UTC

musicale wrote: post #2

I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"m not sure how extensively it is used.

What are you hoping it will achieve?

Re: -fbounds-safety: Enforcing bounds safety for C

#23

Post by taminka » Thu, Feb 19, 2026, 3:22 PM UTC

this is amazing, counter to what most ppl think, majority of memory bugs are from out of bounds access, not stuff like forgetting to free a pointer or some such

Re: -fbounds-safety: Enforcing bounds safety for C

#24

Post by irishcoffee » Thu, Feb 19, 2026, 3:25 PM UTC

groundzeros2015 wrote: post #22

musicale wrote: post #2

I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"m not sure how extensively it is used.

What are you hoping it will achieve?

The internet went down because cloudflare used a bad config... a config parsed by a rust app.

One of these days the witch hunt against C will go away.

Re: -fbounds-safety: Enforcing bounds safety for C

#25

Post by worldsavior » Thu, Feb 19, 2026, 3:26 PM UTC

Very cool. I always wondered why there isn't something like this in GCC/LLVM, it would obviously solve uncountable of security issues.

Re: -fbounds-safety: Enforcing bounds safety for C

#26

Post by Retr0id » Thu, Feb 19, 2026, 3:26 PM UTC

taminka wrote: post #23

this is amazing, counter to what most ppl think, majority of memory bugs are from out of bounds access, not stuff like forgetting to free a pointer or some such

I think UAFs are more common in mature software

Re: -fbounds-safety: Enforcing bounds safety for C

#27

Post by random_mutex » Thu, Feb 19, 2026, 3:31 PM UTC

taminka wrote: post #23

this is amazing, counter to what most ppl think, majority of memory bugs are from out of bounds access, not stuff like forgetting to free a pointer or some such

There is use after free

Re: -fbounds-safety: Enforcing bounds safety for C

#28

Post by eecc » Thu, Feb 19, 2026, 3:35 PM UTC

random_mutex wrote: post #27

taminka wrote: post #23

this is amazing, counter to what most ppl think, majority of memory bugs are from out of bounds access, not stuff like forgetting to free a pointer or some such

There is use after free

Majority. Parent said majority

Re: -fbounds-safety: Enforcing bounds safety for C

#29

Post by q3k » Thu, Feb 19, 2026, 3:35 PM UTC

Retr0id wrote: post #26

taminka wrote: post #23

this is amazing, counter to what most ppl think, majority of memory bugs are from out of bounds access, not stuff like forgetting to free a pointer or some such

I think UAFs are more common in mature software

Or type confusion bugs, or any other stuff that stems from complex logic having complex bugs.

Boundary checking for array indexing is table stakes.

Re: -fbounds-safety: Enforcing bounds safety for C

#30

Post by ndiddy » Thu, Feb 19, 2026, 3:37 PM UTC

Has any progress been made on this? I remember seeing this proposal 3 or 4 years ago but it looks like it still hasn't been implemented. It's a shame because it seems like a useful feature. It looks like Microsoft has something similar (https://learn.microsoft.com/en-us/cpp/code-quality/understan...) but it would be nice to have something that worked on other platforms.