51 lines
2.2 KiB
Markdown
51 lines
2.2 KiB
Markdown
 
|
# C++ Core Guidelines: bounds safety, GSL, narrow_cast, not_null
|
||
|
|
|
||
|
|
## Metadata
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
|---|---|
|
||
|
|
| Institute | Molodetz Institute — Research & Retrieval Division |
|
||
|
|
| Subject | safe-cpp-practices |
|
||
|
|
| Document type | Source Dossier |
|
||
|
|
| Tier | 1 |
|
||
|
|
| Source title | C++ Core Guidelines: bounds safety, GSL, narrow_cast, not_null |
|
||
|
|
| Source URL | http://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines |
|
||
|
|
| Source publisher / author | Bjarne Stroustrup, Herb Sutter (editors), ISO C++ |
|
||
|
|
| Source type | standard |
|
||
|
|
| Source date (published) | Unknown — not stated (living document) |
|
||
|
|
| Date researched | 2026-10-27 |
|
||
|
|
| Researched by | tai (agent), model: Claude Opus 4.8, on behalf of retoor |
|
||
|
|
| Research method | web search synthesis |
|
||
|
|
| Confidence | High |
|
||
|
|
| Status | Active |
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
|
||
|
|
The reference set of rules for modern C++. The bounds-safety profile treats range errors as a class to eliminate: pass span instead of pointer+length, and make narrowing conversions explicit and checked.
|
||
|
|
|
||
|
|
## Key findings
|
||
|
|
|
||
|
|
- Bounds profile: prefer `span` over raw pointer-plus-length parameters so a length cannot be passed wrong.
|
||
|
|
- `gsl::narrow<T>(x)` converts and throws `narrowing_error` if the value does not round-trip; `narrow_cast<T>` is an explicit, silent, lossy cast.
|
||
|
|
- ES.46: a negative double through `narrow<unsigned>` throws, while `narrow_cast` silently wraps, which is exactly the signed->size_t trap behind the WhatsApp crash.
|
||
|
|
- `gsl::not_null<T*>` documents and enforces that null is not a valid value for a pointer.
|
||
|
|
- The guidelines favor RAII and the rule of zero so resource bugs do not exist to be found.
|
||
|
|
|
||
|
|
## Pros / strengths
|
||
|
|
|
||
|
|
The canonical, broadly agreed rulebook; the span and narrow rules map directly onto wire parsing.
|
||
|
|
|
||
|
|
## Cons / limitations / caveats
|
||
|
|
|
||
|
|
Aspirational and large; full adoption is a multi-year ratchet. GSL is a dependency detz chose not to add (uses std::span/own checked reader instead).
|
||
|
|
|
||
|
|
## Relevance to tai
|
||
|
|
|
||
|
|
Names the exact anti-patterns detz hit (implicit narrowing, pointer+length) and the exact cures (explicit checked narrowing, span-style readers). detz applies the principle without the GSL dependency.
|
||
|
|
|
||
|
|
## Changelog
|
||
|
|
|
||
|
|
| Date | Change |
|
||
|
|
|---|---|
|
||
|
|
| 2026-10-27 | Initial dossier created (web search synthesis). |
|