[Bug-gnulib] Re: malloc wrappers

[Paul Eggert]

Bruno Haible <address@hidden> writes:

> A clean way to implement this is to define a name for each of these
> variants of malloc, like zerofixed_malloc, ptrdiff_safe_malloc, etc.,
> and let each module explicitly use the one it needs.

This approach won't scale well.  If we have N attributes for malloc,
we'll need 2**N malloc variants.  There are some advantages of this
approach, but I doubt whether it's worth the hassle.  Instead, if we
want this approach, I suggest adding an argument to malloc specifying
which constraints need to be respected.  The argument could be the
logical OR of a set of bits, each corresponding to a constraint.

Houwever, I suspect it's simpler to have just one malloc variant that
satisifies all the constraints.  This will work if we're realistic
about the constraints, and don't insist on constraints that unduly
hamper real programs (even programs that don't need the constraints).

(Of course we could adopt both approaches; it's easy to implement
either in terms of the other.)

So far, we've installed just one constraint, namely that malloc(0)
doesn't return NULL unless malloc is really out of memory.  Insisting
on this constraint has worked well in practice.  It will also work
well in practice if we insist that malloc(PTRDIFF_MAX) should fail.

Perhaps the constrained malloc should be given a name other than
"malloc", but that issue is somewhat independent.