Ensure only pointers are passed to a variadic function

Question

I built a printf-like variadic function for logging purposes on a custom CPU.

To ensure that I have no memory faults I wrote the function so that it only takes pointers and handles them. The preprocessor adds always a NULL-Pointer at the end of the va-list, so whenever the function recocnizes a zero-pointer it returns. In this way, I can be sure that I don't read the List. I did this all to prevent from wrong handling with the programme, it should be a safe function. Whatever the user puts into the va-list shouldn't end in a crash.

The only problem I have now is to ensure that the user can only pass pointers to the variadic function, nothing else (except the first two arguments which are not part of the va-list) my function declaration looks like this:

void LogNew( UINT LogClass, char* pMsg, ... );

And the null-Termination:

#define LogNew(...) LogNew(__VA_ARGS__, 0)

Is there a way, maybe via Preprocessor, to make sure that no one uses call by value instead of call by reference.

Thank You in Advance!

Answer 1

You can wrap each argument in an expression that ensures that only a pointer will be allowed (while preserving its value). For example, you can convert a argument elem to:

(true ? (elem) : (void *) 0)

The ternary condition ensures that its second and third arguments are compatible. Note that this will still allow literal zero as an parameter; you can detect that at runtime (the corresponding parameter will be a null pointer); also, for many implementations this will only generate a warning rather than a hard error.

Another option is to apply the &* operators to the argument. The problem here is that this won't work for void pointers, but a _Generic selection macro can help:

&*(_Generic((elem), void *: ((char*) elem), const void *: ((char const*) elem), default: (elem)))

Wrapping each argument is a bit tricky, but there are macro programming libraries which can help. For example, using Boost.Preprocessor you could write:

#include <boost/preprocessor.hpp>

void LogNew(unsigned LogClass, char* pMsg, ... ) {}
#define LOG_NEW_ELEMENT(r,data,elem) \
    , &*(_Generic((elem), void *: ((char*) elem), const void *: ((char const*) elem), default: (elem)))
#define LOG_NEW_IMPL(LogClass,Args) \
    LogNew(LogClass, \
    BOOST_PP_SEQ_HEAD(Args) \
    BOOST_PP_SEQ_FOR_EACH(LOG_NEW_ELEMENT, _, BOOST_PP_SEQ_TAIL(Args)), \
    ((void*) 0))
#define LogNew(LogClass,...) \
    LOG_NEW_IMPL(LogClass, BOOST_PP_VARIADIC_TO_SEQ(__VA_ARGS__))

Example:

int main() {
    char msg[] = "hello";
    LogNew(1u, msg);
    LogNew(1u, msg, "world");
    LogNew(1u, msg, (void *) "ok");
    LogNew(1u, msg, 123);  // error: invalid type argument of unary '*' (have 'int')
}

Answer 2

If you want to reduce or prevent errors with wrong formats, your best bet is to use fprintf, in my opinion. It is a variadic function and therefore unsafe, but it is the way to print stuff in C, so programmers are familiar with it and its shortcomings. If your logging function is just a macro, for example:

enum {Fatal, Error, Warning, Info};

int maxlevel = Error;

#define logmsg(L, ...) if (L > maxlevel); else {        \
        if (L == Fatal) fprintf(stderr, "Fatal: ");     \
        if (L == Error) fprintf(stderr, "Error: ");     \
                                                        \
        fprintf(stderr, __VA_ARGS__);                   \
        fprintf(stderr, "\n");                          \
                                                        \
        if (L == Fatal) exit(1);                        \
    }                                                   \

you get the benefit of static analysis, which will warn you about format/type mismatches. in clang/gcc, -Wformat, which is part of -Wall, will do that. In Visual Studio, you can use /analyze. (And you won't generate the va list when logging is suppressed.)

If you roll your own variable-argument function and call vfprintf, you can detect bad format strings with the clang/gcc format attribute or the _Printf_format_string_ anotation in Visual Studio.

That said, if all of your variable arguments are of the same type, you can use an array. If your compiler supports C99's compound literals, you can use a macro to convert the variable portion of your argument list into an array.

Say that all printed arguments should be const char *. (I know that's not what you want, but bear with me.) Then you can achieve a printing function that takes any positive amount of C strings like this:

void put(const char **s)
{
    while (*s) {
        fputs(*s++, stdout);
    }

    fputs("\n", stdout);
}

#define put(...) put((const char *[]){__VA_ARGS__, NULL})

And use it like this:

put("Couldn't open \"", fn, "\".");
put("My name is ", (rand() % 2) ? "Igor" : "Tamara", ".");
put("");

You can extend this technique to const void *. I've hidden the code behind an Ideone link, because using void will make you lose the type information of the arguments. Your code probably won't crash hard, because the pointers should point somewhere, but you will still invoke undefined behaviour and get garbage output when you use the wrong format.

(In comments to the first answer, Lundin points out that converting an integer type to a pointer is legal. That's not a defect of the shown answer, that's a defect of the language. You could also say puts(54) and only get a warning.)