Thread

flexible array members

Peter Eisentraut <peter_e@gmx.net> — 2011-06-15T20:13:59Z

gcc 4.6 has now arrived as the default compiler on my desktop, and as
previously reported, it throws a bunch of warnings, foiling my life-long
plan of compiling PostgreSQL with -Werror.

So looking more aggressively into fixing some of these, let's look at
this case:

gistutil.c: In function ‘gistMakeUnionKey’:
gistutil.c:263:16: warning: array subscript is above array bounds [-Warray-bounds]
gistutil.c:268:16: warning: array subscript is above array bounds [-Warray-bounds]
gistutil.c:273:16: warning: array subscript is above array bounds [-Warray-bounds]

The code in question is this:

typedef struct
{
    int32       n;              /* number of elements */
    GISTENTRY   vector[1];      /* variable-length array */
} GistEntryVector;

Not sure why the new gcc is confused about this when -Warray-bounds has
existed for a while.  But thinking a bit further, the "proper" fix for
this would be to use flexible array members like this:

typedef struct
{
    int32       n;              /* number of elements */
    GISTENTRY   vector[];
} GistEntryVector;

This is C99, but with some gentle standard autoconf seasoning, it can be
made transparent.  See attached patch.

Is this a route we want to go down?

It looks as though other compilers could also benefit from this.  clang
throws even more warnings of this kind, and the clang static analyzer
even more.

One thing that is a bit concerning is that throwing more flexible array
members around the code wherever variable-length arrays are used results
in crash and burn.  Probably some places are using sizeof or offsetof on
these structures in incompatible ways.  So each place would have to be
examined separately.