78 What the new standards added, and the *_s controversy

78.1 What C99 added

<stdint.h> is this list’s winner. A standard way to express “exactly 32 bits” finally arose, and the practice of every project keeping its own typedef until then was tidied away.

78.2 What C11 added

<threads.h>‘s circumstance is interesting. Though it is in the standard, glibc long did not provide it, so portable code still uses POSIX threads. It is a case showing that entering the standard and becoming usable are different things.

78.3 What C23 added

#define __STDC_WANT_LIB_EXT1__ 1
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdckdint.h>
#include <stdalign.h>
#include <stddef.h>

int main(void)
{
    /* (1) is annex K really there — the implementation tells us */
#ifdef __STDC_LIB_EXT1__
    printf("annex K: present (__STDC_LIB_EXT1__)\n");
#else
    printf("annex K: not in this implementation\n");
#endif

    /* (2) C23's checked arithmetic — overflow reported as a value */
    int a = 2000000000, b = 2000000000, sum;
    if (ckd_add(&sum, a, b))
        printf("ckd_add: it overflowed (an int cannot hold it)\n");
    else
        printf("ckd_add: %d\n", sum);

    size_t count = (size_t)-1 / 2, elem = 8, bytes;
    if (ckd_mul(&bytes, count, elem))
        printf("ckd_mul: it overflowed — no allocation is attempted\n");

    /* (3) fixed-width integers and alignment */
    printf("int32_t=%zu bytes, alignof(max_align_t)=%zu\n",
           sizeof(int32_t), alignof(max_align_t));

    /* (4) C23's bool is a keyword — used without <stdbool.h> */
    bool ready = true;
    printf("bool is a keyword: %s\n", ready ? "true" : "false");

    /* (5) the edition confirmed through the macro the standard settles */
    printf("__STDC_VERSION__ = %ldL\n", (long)__STDC_VERSION__);
    return 0;
}

annex K: not in this implementation
ckd_add: it overflowed (an int cannot hold it)
ckd_mul: it overflowed — no allocation is attempted
int32_t=4 bytes, alignof(max_align_t)=16
bool is a keyword: true
__STDC_VERSION__ = 202000L

<stdckdint.h> is this edition’s practical winner. It reports the wrap-round of the size calculations seen in chapter 65 as a value — ckd_add, ckd_sub and ckd_mul return true on overflow, and the result may be treated as “unusable” rather than as the wrapped value.

<stdbit.h> is new too. Bit manipulations such as counting leading zeros, counting set bits and rounding up to a power of two have become standard functions — until then a place that leaned on compiler builtins (__builtin_clz and the like).

Besides these, C23 promoted bool, true, false, static_assert and thread_local to keywords, brought in nullptr (chapter 36), and effectively retired compatibility headers such as <stdbool.h> and <stdnoreturn.h>.

78.4 Annex K — the failed attempt at “safe functions”

Now the main business of this chapter.

In the early 2000s Microsoft put functions such as strcpy_s and sprintf_s into its compiler and began raising warnings on use of the existing functions. The proposal to make that design a standard entered C11 as annex K (bounds-checking interfaces).

The core ideas were three.

1. The destination size is compulsorily taken as an argument.
2. When a problem arises it does not truncate and carry on but returns an error (errno_t).
3. When a contract violation is detected, the program’s chosen constraint handler is called.

#define __STDC_WANT_LIB_EXT1__ 1
#include <string.h>

char dst[8];
errno_t e = strcpy_s(dst, sizeof dst, src);   /* an error if it overflows */

The direction resembles what we organised in chapter 62 as “what is needed”. Yet the result was a failure.

78.5 What this part leaves behind

We have walked the standard library across ten chapters. Memorising function names was not the aim, so what remains to be kept is a few attitudes.

1. Read the contract first. Does it take a size, how does it report failure, who owns the pointer it returned.
2. Do not throw away return values. Especially fclose, snprintf and the scanf family.
3. Suspect global state. errno, the locale, static buffers, the rounding mode.
4. Being in the standard does not make it safe. gets survived twenty-two years.
5. Weigh platform extensions between the gain and portability.

The bottom three lines of that table — <stdatomic.h>, <stdckdint.h> and keyword promotion — have only shown their faces. The three remaining chapters of this part treat those three in detail, one each. We begin with the foundation of concurrency.