RFC: Enforcing Bounds Safety in C (-fbounds-safety)

Clang Frontend
113

As it turns out, our implementation does accept __counted_by after the brackets like in your previous comment, so the point might be moot.

In the general case, we consider it a non-goal to designate a single location on a line where __counted_by should go. Like with const , each level of indirection can have its own, so there have to be syntactically distinct ways to apply it. This has come up before in the thread. We primarily use __counted_by on pointers exactly like in your example, and while our adopters have usually gone with char *__counted_by(tx_size) tx , we also accept __counted_by after the identifier. The caveat is that it only works to annotate the outermost pointer. For instance, it wouldn’t work here:

void foo(int *__counted_by(*size) *q, size_t *size) {
    static int buf[10];
    *q = buf;
    *size = 10;
}

void call_foo(void) {
    size_t size;
    int *__counted_by(size) p;
    foo(&p, &size);
}

You can’t have __counted_by after q in this case because the count doesn’t apply to the outermost pointer. This is where __counted_by being a type attribute becomes significant.