Category Archives: Code

Pointers in C, Part I: Pointers vs. Arrays

“Remember, When You Point a Finger at Someone, There Are Three More Pointing Back at You”
— Unknown
It’s easy to meet even long-time C programmers who don’t fully grok pointers, let alone beginners. Because of this and the fact that pointers play such a crucial role in the C programming language, I’ve decided to launch a new series of blog posts on pointers. I want to start off with an episode that sheds some light on similarities and — more importantly — differences between pointers and arrays.

POINTERS AND ARRAYS: THE BASICS

An array is a sequence of same-sized objects, integers, for instance:


int array[] = { 
    0xA, 
    0xBBBB,
    0xCC000000
};

int array[] = {

0xA,

0xBBBB,

0xCC000000

};

On a big-endian machine, ‘array’ could be stored like this (that it starts at memory address 0xB00010 is just an example):


array       0x00B00010: 00 00 00 0A     // First integer.
            0x00B00014: 00 00 BB BB     // Second integer.
            0x00B00018: CC 00 00 00     // Third integer.

array 0x00B00010: 00 00 00 0A // First integer.

0x00B00014: 00 00 BB BB // Second integer.

0x00B00018: CC 00 00 00 // Third integer.

The compiler (or rather the linker) places the array at a fixed memory location. Thus, When you think array, think memory.

By contrast, a pointer is an object that holds a memory address. Pointers are used to refer to memory where an object of a specific type (like ‘int’) resides.


int value = 42;
int* pointer = &value;

int value = 42;

int* pointer = &value;


value       0x00B00800: 00 00 00 2A     // 0x2A == 42.
:
pointer     0xD70012A0: 00 B0 08 00     // Holds address of 'value', thus we say
                                        // that 'pointer' points to 'value'.

value 0x00B00800: 00 00 00 2A // 0x2A == 42.

pointer 0xD70012A0: 00 B0 08 00 // Holds address of 'value', thus we say

// that 'pointer' points to 'value'.

Pointers are used for flexibility: you can refer to another object at run-time by changing the memory address stored inside the pointer variable:


pointer = &array[1];    // Now point to 2nd 'array' element.

pointer = &array[1]; // Now point to 2nd 'array' element.


pointer     0xD70012A0: 00 B0 00 14     // Now contains address of 
                                        // 2nd array element.

pointer 0xD70012A0: 00 B0 00 14 // Now contains address of

// 2nd array element.

A pointer introduces a level of indirection: in order to access the actual object it refers to (and not the pointer variable itself), you dereference it:


*pointer = 0x1234;  // Don't update address it points to
                    // but value of object it points to.

*pointer = 0x1234; // Don't update address it points to

// but value of object it points to.


array       0x00B00010: 00 00 00 0A
            0x00B00014: 00 00 12 34     // Memory updated.
            0x00B00018: CC 00 00 00

array 0x00B00010: 00 00 00 0A

0x00B00014: 00 00 12 34 // Memory updated.

0x00B00018: CC 00 00 00

DIRECT ACCESS VS. INDIRECT ACCESS

The crucial difference between pointers and arrays is how memory is accessed. For instance, when you retrieve the first array element:


int n = array[0]    // Direct access.

int n = array[0] // Direct access.

the compiler generates code along these lines:

1. Load address of beginning of array into register A
2. Load data at address stored in A into register B

Whereas when you fetch the first array element via a pointer pointing to it:


pointer = &array[0];  // Point to 1st 'array' element.
...
int n = *pointer;     // Indirect access.

pointer = &array[0]; // Point to 1st 'array' element.

...

int n = *pointer; // Indirect access.

The generated code will access memory indirectly very much like this:

1. Load address of pointer into register X
2. Load data at address in register X into register Y
3. Load data at address in register Y into register B

So as you can see, pointers and arrays use different ways to access memory and hence are fundamentally different beasts.

WHEN POINTERS LOOK LIKE ARRAYS AND VICE VERSA

Nevertheless, there are cases where pointers and arrays appear to be same thing.

The C language comes with a little bit of syntactic sugar. In certain situations you can use an array like you would use a pointer:


int x = *array;     // Get first element of 'array'.

int x = *array; // Get first element of 'array'.

This looks like you are dereferencing a pointer named ‘array’, but looks can be deceiving. What this really compiles to is this:


int x = array[0];

int x = array[0];

Why? According to the C language standard, in expressions, the name of an array acts as a pointer to the first array element. Hence, the compiler really sees this:


int x = *(&array[0]);

int x = *(&array[0]);

which is equivalent to


int x = array[0];

int x = array[0];

Similarly, you can dereference pointers not just by using the ‘*’ operator but also by using the subscript operator [], which is another form of syntactic sugar — one that makes you believe you are accessing an array instead of a pointer:


// Plain pointer access:
int x1 = *pointer;       // Indirectly access first element.
int x2 = *(pointer + 2); // Indirectly access third element.
int x3 = *(2 + pointer); // dito (commutative law).

// Array-like access:
int x4 = pointer[0];     // Indirectly access first element.
int x5 = pointer[2];     // Indirectly access third element.
int x6 = 2[pointer];     // dito (commutative law, who knew?).

// Plain pointer access:

int x1 = *pointer; // Indirectly access first element.

int x2 = *(pointer + 2); // Indirectly access third element.

int x3 = *(2 + pointer); // dito (commutative law).

// Array-like access:

int x4 = pointer[0]; // Indirectly access first element.

int x5 = pointer[2]; // Indirectly access third element.

int x6 = 2[pointer]; // dito (commutative law, who knew?).

All this syntactic sugar makes C code involving pointers and arrays easier on the eyes — the compiler will do some access magic behind the scenes. The downside is, that it deludes people into believing that pointers and arrays are the same, which is not the case: arrays employ direct access, pointers indirect access.

Contrary to expressions, such syntactic sugar is not available in declarations. If you define an array in one translation unit (file):


const int VALUES[4] = { 
    0x1111,
    0x2222,
    0x3333,
    0x4444,
};

const int VALUES[4] = {

0x1111,

0x2222,

0x3333,

0x4444,

};

and foolishly attempt to import it into another translation unit via this forward declaration:


extern const int* VALUES;    // Import 'VALUES' into translation unit.
int x = *VALUES;             // Indirect access, undefined behavior!

extern const int* VALUES; // Import 'VALUES' into translation unit.

int x = *VALUES; // Indirect access, undefined behavior!

you risk a crash because dereferencing ‘VALUES’ will indirectly access memory when a direct access was required. Let’s assume that the array is stored like this, as defined in the first translation unit:


VALUES      0x00B00210: 00 00 11 11
            0x00B00214: 00 00 22 22
            0x00B00218: 00 00 33 33
            0x00B0021C: 00 00 44 44

VALUES 0x00B00210: 00 00 11 11

0x00B00214: 00 00 22 22

0x00B00218: 00 00 33 33

0x00B0021C: 00 00 44 44

Now, dereferencing ‘VALUES’ declared as a pointer will lead to these steps:

1. Load address of pointer ‘VALUES’ into register X (X = 0x00B00210)
2. Load data at address in register X into register Y (Y = 0x00001111)
3. Load data at address in register Y into register B (B = ???)

What this means in practice depends on whether the address 0x00001111 is a valid address or not. If it is, arbitrary data will be read; otherwise, the memory management unit (MMU) will raise an exception. Therefore, make sure that your array declarations exactly match your definitions:


extern const double VALUES[5]; // Matches definition.
int x = VALUES[0];  // Direct access.
int y = *VALUES;    // dito, syntactic sugar.

extern const double VALUES[5]; // Matches definition.

int x = VALUES[0]; // Direct access.

int y = *VALUES; // dito, syntactic sugar.

PASSING ARRAYS TO FUNCTIONS

So far so good (or bad). Another source of confusion is the fact that arrays are the only objects in C that are implicitly passed by reference:^* You always provide a pointer to the first array element to get an array into a function:


int sum(int* nums, size_t len) {
    int i, sum = 0;
    for (i = 0; i < len; ++i) {
        sum += nums[i]  // indirect access, syntactic sugar.
    }
    return sum;
}

int sum(int* nums, size_t len) {

int i, sum = 0;

for (i = 0; i < len; ++i) {

sum += nums[i] // indirect access, syntactic sugar.

}

return sum;

}

At the caller’s site, the code looks like this:


int total1 = sum(array, 3);       // Pass pointer to 1st elem, syntactic sugar.
int total2 = sum(&array[0], 3);   // dito, but explicitly.

int total1 = sum(array, 3); // Pass pointer to 1st elem, syntactic sugar.

int total2 = sum(&array[0], 3); // dito, but explicitly.

TYPE-SAFETY THAT ISN’T

Sometimes, you want to ensure at compile-time, that only arrays of certain sizes can enter your function. Imagine you have a function that builds a 128-bit random value in an array of eight bytes:


void get_random(uint8_t* random) {
    for (size_t i = 0; i < 8; ++i) {
        random[i] = *get_random_byte();
    }
}

void get_random(uint8_t* random) {

for (size_t i = 0; i < 8; ++i) {

random[i] = *get_random_byte();

}

‘get_random’ assumes that it is passed the address of eight bytes of memory, but nobody prevents the caller from passing an array that is not big enough:


uint8_t myrand[4];    // Short by 4 bytes.
get_random(myrand);   // but compiles fine...

uint8_t myrand[4]; // Short by 4 bytes.

get_random(myrand); // but compiles fine...

Which will — of course — lead to a dreaded buffer overrun.

Is it possible to make ‘get_random’ type-safe, such that arrays with a length different to eight lead to compile-time errors?

One (ill-fated) approach is to employ a C feature that allows you to declare arguments using array-like notation:


void get_random(uint8_t random[8]) {
    ...
}

void get_random(uint8_t random[8]) {

...

}

However, this doesn’t give you any extra type safety. To the compiler, ‘random’ is still a pointer to a ‘uint8_t’ and if you ask for the size of ‘random’ (via sizeof(random)) in the body of the function, you will still get the value returned by sizeof(uint8_t*). Few developers are aware of this fact. To me, it’s a source of nasty bugs.

Since this array-ish syntax fools people into believing that a real array was passed to a function (by value) I don’t recommend using it.

TYPE-SAFETY DONE RIGHT

You can get real type-safety for your “array” arguments through so-called “pointers to arrays”. Alas, this C feature tends to confuse the heck out of programmers.

In the previous examples, we passed an array (conceptually) by passing a pointer to the first element:


uint8_t randval[8];
get_random(randval);      // Implicitly.
get_random(&randval[0]);  // Explicitly.

uint8_t randval[8];

get_random(randval); // Implicitly.

get_random(&randval[0]); // Explicitly.

The real type of the array and the size of the array is lost in this process; the called function only sees a pointer to a ‘uint8_t’. By contrast, the following syntax allows you to obtain a pointer to an array that preserves the full type information:


typedef uint8_t RANDVAL[8];
RANDVAL randval;
RANDVAL* pointer = &randval;  // note the '&'

typedef uint8_t RANDVAL[8];

RANDVAL randval;

RANDVAL* pointer = &randval; // note the '&'

This ‘pointer’ is completely type-safe:


int* p = pointer;         // Doesn't compile, incompatible pointers.
get_random(pointer);      // dito.
int x = (*pointer)[9];    // OK: extract 10th element.

int* p = pointer; // Doesn't compile, incompatible pointers.

get_random(pointer); // dito.

int x = (*pointer)[9]; // OK: extract 10th element.

To add type-safety to our ‘get_random’ function, we could define it like this:


void get_random_type_safe(RANDVAL* random) {
    for (size_t i = 0; i < sizeof(*random); ++i) {
        (*random)[i] = *get_random_byte();
    }
}

void get_random_type_safe(RANDVAL* random) {

for (size_t i = 0; i < sizeof(*random); ++i) {

(*random)[i] = *get_random_byte();

}

With this change, ‘get_random_type_safe’ only accepts pointers to 8 element arrays of uint8_t’s. Passing any other kind of pointer will result in a compile-time error.

We know that in expressions, using an array’s name like ‘array’ is short for “pointer to first element in array” but that doesn’t mean that ‘&array’ is a pointer to a pointer to the first element — the ‘&’ operator doesn’t create another level of indirection, even though it looks like it did. In the previous example, the value stored in ‘pointer’ is still the address of the first element of the array. Hence, this assertion holds:


assert((size_t) array == (size_t) &array); // Casting to 'size_t' obtains 
                                           // numeric value of address.

assert((size_t) array == (size_t) &array); // Casting to 'size_t' obtains

// numeric value of address.

Since the actual pointer values are the same, you can still use legacy APIs that only accept pointers to ‘uint8_t’s (like the original ‘get_random’ function), if you apply type casts:


uint8_t* p = (uint8_t*) pointer;   // OK, but type-safety lost.
get_random(p);                     // Fine.

uint8_t* p = (uint8_t*) pointer; // OK, but type-safety lost.

get_random(p); // Fine.

You don’t need typedefs like ‘RANDVAL’ if you want to employ pointers to arrays. I mainly used it to avoid overwhelming you with the hideous pointer-to-array syntax. Without typedefs, you would need to type in things like this:


uint8_t randval[8];
uint8_t (*pointer)[8] = &randval;
void get_random_type_safe(uint8_t (*random)[8]) {
    for (size_t i = 0; i < sizeof(*random); ++i) {
        (*random)[i] = *get_random_byte();
    }
}

uint8_t randval[8];

uint8_t (*pointer)[8] = &randval;

void get_random_type_safe(uint8_t (*random)[8]) {

for (size_t i = 0; i < sizeof(*random); ++i) {

(*random)[i] = *get_random_byte();

}

The syntax to declare pointers to arrays is similar to the syntax to declare pointers to functions and takes a little getting used to. If in doubt, ask the Linux tool ‘cdecl’ which is also available online:


cdecl> explain int (*x[10])[42]
declare x as array 10 of pointer to array 42 of int

cdecl> explain int (*x[10])[42]

declare x as array 10 of pointer to array 42 of int

Do I recommend using pointers to arrays? No, at least not in general. It confuses way too many developers and leads to ugly casts in order to access plain pointer interfaces. Still, pointers to arrays make sense every now and then and it’s always good to know your options.

This concludes my first installment on pointers. There is more to come. Stay tuned!

________________________________

^{*) The language designers of C believed that passing an array by value (e. g. as a copy via the stack) would be extremely inefficient and dangerous (think: stack overflow), so there is no direct way to do it. However, they were not so fearful regarding structs (which can also get quite large and overflow the stack), so you could pass an array by value if you wrapped it inside a struct:}


typedef struct {
    int data[3];
} MY_ARRAY;
void some_func(MY_ARRAY the_array) {
   the_array.data[0] = ...
   ...
}
MY_ARRAY array2 = { 1, 2, 3 };
some_func(array2); // Pass by value, ie. duplicate array2 on the stack.

typedef struct {

int data[3];

} MY_ARRAY;

void some_func(MY_ARRAY the_array) {

the_array.data[0] = ...

...

}

MY_ARRAY array2 = { 1, 2, 3 };

some_func(array2); // Pass by value, ie. duplicate array2 on the stack.

↩

Bug Hunting Adventures #12: String Limits

“The limits of my language mean the limits of my world.”
— Ludwig Wittgenstein

The aim of the routine below (‘reduce_string’) is to limit a given ‘string’ to at most ‘max_len’ characters. If the length of ‘string’ exceeds ‘max_len’, characters are removed from around the middle and filled with an ‘ellipsis’ string. Here are some examples that demonstrate what ‘reduce_string’ is supposed to do:


char text1[] = "The quick brown fox";
reduce_string(text1, 8, "..")
// -> "The..fox"
char text2[] = "The quick brown fox";
reduce_string(text2, 4, "")
// -> "Thox"
char text3[] = "I am the spirit that denies!"
reduce_string(text3, 7, "---")
// -> "I ---s!"

char text1[] = "The quick brown fox";

reduce_string(text1, 8, "..")

// -> "The..fox"

char text2[] = "The quick brown fox";

reduce_string(text2, 4, "")

// -> "Thox"

char text3[] = "I am the spirit that denies!"

reduce_string(text3, 7, "---")

// -> "I ---s!"

But as always in this series, a bug slipped in. Can you find it?


char* reduce_string(char* string, int max_len, const char* ellipsis) {
    assert(string != NULL);
    assert(ellipsis != NULL);

    int string_len = strlen(string);
    int excess_chars = string_len - max_len;

    if (excess_chars > 0) {
        int ellipsis_len = strlen(ellipsis);
        // Number of chars to be removed from the original string.
        int to_be_dropped = excess_chars + ellipsis_len;
        int to_be_dropped_half = to_be_dropped / 2;
        int middle = string_len / 2;

        // Drop chars from the middle to the left;
        // what remains is called the 'left part'.
        int p = middle - to_be_dropped_half;

        // If ellipsis longer than string, skip left part;
        // ie. the resulting string starts with ellipsis.
        if (p < 0) {
            p = 0;
        }

        // Append ellipsis after left part.
        for (int i = 0; i < ellipsis_len; ++i) {
            // Ensure that maximum length is respected.
            if (p >= max_len) {
                break;
            }
            string[p++] = ellipsis[i];
        }

        // Append right part.
        int r = middle + to_be_dropped - to_be_dropped_half;
        while (p < max_len) {
            string[p++] = string[r++];
        }
    }

    return string;
}

char* reduce_string(char* string, int max_len, const char* ellipsis) {

assert(string != NULL);

assert(ellipsis != NULL);

int string_len = strlen(string);

int excess_chars = string_len - max_len;

if (excess_chars > 0) {

int ellipsis_len = strlen(ellipsis);

// Number of chars to be removed from the original string.

int to_be_dropped = excess_chars + ellipsis_len;

int to_be_dropped_half = to_be_dropped / 2;

int middle = string_len / 2;

// Drop chars from the middle to the left;

// what remains is called the 'left part'.

int p = middle - to_be_dropped_half;

// If ellipsis longer than string, skip left part;

// ie. the resulting string starts with ellipsis.

if (p < 0) {

p = 0;

}

// Append ellipsis after left part.

for (int i = 0; i < ellipsis_len; ++i) {

// Ensure that maximum length is respected.

if (p >= max_len) {

break;

}

string[p++] = ellipsis[i];

}

// Append right part.

int r = middle + to_be_dropped - to_be_dropped_half;

while (p < max_len) {

string[p++] = string[r++];

}

return string;

}

Solution

Random Casting

Recently, a security-related bug slipped into libcurl 7.52.0.

For those of you who don’t know, libcurl is a popular open source library that supports many protocols and greatly simplifies data transfer over the Internet; an uncountable number of open- and closed-source projects depend on it.

Because of the bug, this particular version of libcurl doesn’t use random numbers when it should, which is really bad for security:


static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)
{
  // ... 24 lines ...
  result = Curl_ssl_random(data, (unsigned char *)&rnd, sizeof(rnd));
  //...
}

static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)

{

// ... 24 lines ...

result = Curl_ssl_random(data, (unsigned char *)&rnd, sizeof(rnd));

//...

}

Since all the surrounding code is stripped away it is pretty easy to see what went wrong, right?

Within ‘randit’ there is an attempt to obtain a random number by calling ‘Curl_ssl_random’. However, ‘Curl_ssl_random’ is not passed the pointer ‘rnd’, but instead a pointer to ‘rnd’. Hence, the memory pointed to by ‘rnd’ is not filled with a random number but rather the pointer ‘rnd’ will point to a random memory location.

How did this bug come about? I’m pretty sure that — initially — the unlucky developer had accidentally typed this:


static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)
{
  // ... 24 lines ...
  result = Curl_ssl_random(data, &rnd, sizeof(rnd));
  // ...
}

static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)

{

// ... 24 lines ...

result = Curl_ssl_random(data, &rnd, sizeof(rnd));

// ...

}

When (s)he compiled the code with gcc, the following error message was produced:


rand.c:63 error: cannot convert ‘unsigned int**’ to ‘unsigned char*’ for argument ‘2’ 
    to ‘CURLcode Curl_ssl_random(void*, unsigned char*, size_t)’

rand.c:63 error: cannot convert ‘unsigned int**’ to ‘unsigned char*’ for argument ‘2’

to ‘CURLcode Curl_ssl_random(void*, unsigned char*, size_t)’

Which exactly explains the problem, but most likely, the developer only skimmed the error message and jumped to the wrong conclusion; that is, (s)he thought that a cast was needed because of a simple pointer incompatibility (unsigned int* vs. unsigned char*) when in fact there is a severe pointer incompatibility (pointer to pointer vs. pointer).

I’ve seen this many times before: developers apply casts to get rid of warnings from the compiler (or a static analysis tool) without a second thought. Don’t do this. Be very considerate when your compiler speaks to you. Casting, on the other hand, will silence it forever.

“inline” Is Yet Another Word For “Premature Optimization”

The fact that some C++ developers use the ‘inline’ keyword so much has always been a conundrum to me — I’ve never liked it. Why? First and foremost because it clutters up header files and exposes implementation details to the users of a class.

Most likely, inline aficionados believe that these disadvantages are more than compensated for by the fact that inlining gives them faster code, but this is not necessarily the case: according to the C++ standard (ISO/IEC 14882:2014), the compiler is allowed to silently ignore the ‘inline’ keyword:

“An implementation is not required to perform this inline substitution at the point of call”

Believing is not knowing, as the old saying goes. This is another reason why I don’t like the ‘inline’ keyword: it doesn’t guarantee you anything.

But let’s attack the ‘inline’ keyword from another angle. Even if we knew that declaring a method inline made it faster, shouldn’t we have to ask ourselves first if there is actually a performance case? Without profiling, without a proven need, any optimization is premature optimization, which — according to Donald Knuth — is the root of all evil. The fact that an optimization gives a local improvement doesn’t justify it sufficiently — it’s the overall improvement of the major use cases that matters. Otherwise we would implement all of our functions with inline assembly, wouldn’t we?

In the old days of C programming, developers used the ‘register’ keyword as a hint to tell the compiler what variables should be kept in registers for performance reasons. Nowadays, every C compiler is much better at allocating variables to registers than any human being. Consequently, the ‘register’ keyword has been deprecated in C11.

By the same token, today’s C++ compilers do a much better job of figuring out which functions should be inlined than we are able to do. Therefore, instead of giving hints to the compiler we should rather rely on automated, transparent inlinining that doesn’t clutter up class interfaces.

As an example, at optimization level -O2, the g++ compiler automatically inlines all functions that are small or called only once. Specifying -finline-functions (enabled by default at -O3) uses a heuristic to determine if its worthwhile to inline a function or not — without the need for any developer intervention.

To me, it’s about time that ‘inline’ goes the way of the ‘register’ keyword.

Counting Down Correctly in C

The countdown for the New Year is near to its end, so I want to take this opportunity to discuss how to implement loops that count down from an upper boundary to a lower boundary. I know it sounds mundane, but I will present a technique that is — at least in my experience — not widely known, not even amongst seasoned C coders (with the notable exception of Chuck Norris, of course).

But first, please take a moment to look at the following routine that employs a countdown for-loop and decide if it works correctly or not:


/* Return the highest index of given character in array. Search from 
   upper (exclusive) to lower (inclusive) index. If character is not
   found, return upper index. */
size_t rfind(const char* array, size_t lower, size_t upper, char c) {
    size_t i;

    for (i = upper - 1; i >= lower; --i) {
        if (array[i] == c) {
            return i;
        }
    }

    return upper;
}

/* Return the highest index of given character in array. Search from

upper (exclusive) to lower (inclusive) index. If character is not

found, return upper index. */

size_t rfind(const char* array, size_t lower, size_t upper, char c) {

size_t i;

for (i = upper - 1; i >= lower; --i) {

if (array[i] == c) {

return i;

}

return upper;

}

This code appears to be fine, but it has a flaw that shows only when the ‘lower’ index is 0: ‘size_t’ is an unsigned type, and when ‘i’ becomes 0, subtracting 1 yields a very large positive number (due to integer wrap-around) which in turn causes an out-of-bounds access to the given ‘array’. So what do we need to change such that the code works as expected, even for a lower bound of 0?

Most developer’s knee-jerk reaction is to change the type of the indices to a signed type, like ‘int’, but this is unfortunate, as it limits (at least halves) the available value range. As often in life, the proper solution is not to fight the enemy but to turn him into a friend: Let’s use unsigned wrap-around to our advantage:


size_t rfind(const char* array, size_t lower, size_t upper, char c) {
    size_t i;

    for (i = upper - 1; i != lower - 1; --i) {
        if (array[i] == c) {
            return i;
        }
    }

    return upper;
}

size_t rfind(const char* array, size_t lower, size_t upper, char c) {

size_t i;

for (i = upper - 1; i != lower - 1; --i) {

if (array[i] == c) {

return i;

}

return upper;

}

Instead of using the greater-than operator, we now use the not-equals operator and instead of comparing against ‘lower’ we now compare against one less than ‘lower’. If ‘lower’ happens to be 0, ‘lower’ – 1 (again, due to integer wrap-around) will yield the maximum possible value representable by type ‘size_t’. The same will happen to the loop counter ‘i’ when it has a value of 0 and is decremented once more. As a consequence, the expression ‘i != lower – 1’ becomes false and the loop terminates — as desired.

A Happy New Year to all of my faithful readers!

Optimizing for Simplicity

“In Jeet Kune-Do, one does not accumulate but eliminate. It is not daily increase but daily decrease. The height of cultivation always runs to simplicity. […] The height of cultivation is really nothing special. It is merely simplicity; the ability to express the utmost with the minimum. It is the halfway cultivation that leads to ornamentation.”
— Bruce Lee

The old maxim “Keep It Simple, Stupid” is widely known, but unfortunately one of the most frequently violated best practices in software development. Why is simplicity so important?

Most developers assume that the reason why they shall keep their code simple is to get features out quicker, they should rather work on things that the customer urgently needs, things that provide immediate business value instead of letting him wait for the gold-plated version.

While there is nothing wrong with this interpretation, it doesn’t go far enough. Developers must strive for simplicity to achieve a high degree of maintainability: software development is an investment and software must be built such that not only today’s requirements but also future requirements can be implemented in an economic way. Don’t just think about a particular software product — think about how software evolves into a family of related products and versions over time. The most important reason for simplicity is to ensure that software can evolve with as little cost (aka. pain) as possible. Contrast this to the olden days of software development where developers added lots of flexibility up-front — flexibility that in most cases was never needed (YAGNI). These days, we rather keep it simple and adapt quickly, when the need arises.

Correctness comes first, no doubt, but the next priority is simplicity. Code must be simple such that it is easy to read and understand. Only code that is easy to comprehend can be maintained with little effort. Code that is complex (maybe because it is littered with unjustified optimizations and hard-to-grasp language features) makes changes hard and risky. Complex code is not an asset; it’s a liability that contributes to the overall technical debt.

One of today’s biggest challenges in software development is managing complexity. While there is little we can do about the essential (intrinsic) complexity of a software product, we constantly have to fight non-essential complexity; that is, complexity that arises as a side-effect, from the way we construct a software product.

So while developing code, constantly reflect and ask yourself what your code looks like, especially from another developer’s point of view. Is it easy to understand, does it even look mundane? Great! Resist the temptation to write clever code. Instead, take pride in being able to write the clearest, simplest code.

Don’t get me wrong. It’s OK to try out more complex designs and advanced language features — honing one’s skills is imperative. But always view such activities just as learning activities, like “playgrounding” and send your changes straight to /dev/null once you’re done. If you don’t have the heart to zap them, keep them on a private branch. But unless there is a compelling, justified reason you should take the high road and show true software development mastery by not integrating them with the code base.

Approxion

Code – People – Everything