The Ten Commandments for C Programmers (Annotated Edition)
/sys/doc/ Documentation archive
The Ten Commandments for C Programmers
(Annotated Edition)
by Henry Spencer
Thou shalt run lint frequently<br>and study its pronouncements with care,<br>for verily its perception and judgement oft exceed thine.
This is still wise counsel,<br>although many modern compilers<br>search out many of the same sins,<br>and there are often problems with<br>lint being aged and infirm, or unavailable in strange lands.<br>There<br>are other tools, such as Saber C,<br>useful to similar ends.<br>``Frequently'' means thou shouldst<br>draw thy daily guidance from it,<br>rather than hoping thy code will<br>achieve lint's blessing by a sudden<br>act of repentance at the last<br>minute. De-linting a program which<br>has never been linted before is<br>often a cleaning of the stables<br>such as thou wouldst not wish on<br>thy worst enemies. Some observe,<br>also, that careful heed to the<br>words of lint can be quite helpful<br>in debugging.<br>``Study'' doth not mean mindless<br>zeal to eradicate every byte of<br>lint output-if for no other reason,<br>because thou just canst not shut it<br>up about some things-but that thou<br>should know the cause of its unhappiness and understand what worrisome<br>sign it tries to speak of.
Thou shalt not follow the NULL pointer,<br>for chaos and madness await thee at its end.
Clearly the holy scriptures were<br>mis-transcribed here, as the words<br>should have been ``null pointer'',<br>to minimize confusion between the<br>concept of null pointers and the<br>macro NULL (of which more anon).<br>Otherwise, the meaning is plain. A<br>null pointer points to regions<br>filled with dragons, demons, core<br>dumps, and numberless other foul<br>creatures, all of which delight in<br>frolicing in thy program if thou<br>disturb their sleep. A null<br>pointer doth not point to a 0 of<br>any type, despite some blasphemous<br>old code which impiously assumes<br>this.
Thou shalt cast all function arguments to the expected<br>type if they are not of that type already, even when<br>thou art convinced that this is unnecessary, lest they<br>take cruel vengeance upon thee when thou least expect<br>it.
A programmer should understand the<br>type structure of his language,<br>lest great misfortune befall him.<br>Contrary to the heresies espoused<br>by some of the dwellers on the<br>Western Shore, `int' and `long' are<br>not the same type. The moment of<br>their equivalence in size and<br>representation is short, and the<br>agony that awaits believers in<br>their interchangeability shall last<br>forever and ever once 64-bit<br>machines become common.<br>Also, contrary to the beliefs common among the more backward inhabitants of the Polluted Eastern<br>Marshes, `NULL' does not have a<br>pointer type, and must be cast to<br>the correct type whenever it is<br>used as a function argument.<br>(The words of the prophet Ansi,<br>which permit NULL to be defined as<br>having the type `void *', are oft<br>taken out of context and misunderstood. The prophet was granting a<br>special dispensation for use in<br>cases of great hardship in wild<br>lands. Verily, a righteous program<br>must make its own way through the<br>Thicket Of Types without lazily<br>relying on this rarely-available<br>dispensation to solve all its problems. In any event, the great<br>deity Dmr who created C hath wisely<br>endowed it with many types of<br>pointers, not just one, and thus it<br>would still be necessary to convert<br>the prophet's NULL to the desired<br>type.)<br>It may be thought that the radical<br>new blessing of ``prototypes''<br>might eliminate the need for caution about argument types. Not so,<br>brethren. Firstly, when confronted<br>with the twisted strangeness of<br>variable numbers of arguments, the<br>problem returns... and he who has<br>not kept his faith strong by<br>repeated practice shall surely fall<br>to this subtle trap. Secondly, the<br>wise men have observed that reliance on prototypes doth open many<br>doors to strange errors, and some<br>indeed had hoped that prototypes<br>would be decreed for purposes of<br>error checking but would not cause<br>implicit conversions. Lastly,<br>reliance on prototypes causeth<br>great difficulty in the Real World<br>today, when many cling to the old<br>ways and the old compilers out of<br>desire or necessity, and no man<br>knoweth what machine his code may<br>be asked to run on tomorrow.
If thy header files fail to declare the return types of<br>thy library functions, thou shalt declare them thyself<br>with the most meticulous care, lest grievous harm<br>befall thy program.
The prophet Ansi, in her wisdom,<br>hath added that thou shouldst also<br>scourge thy Suppliers, and demand<br>on pain of excommunication that<br>they produce header files that<br>declare their library functions.<br>For truly, only they know the precise form of the incantation<br>appropriate to invoking their magic<br>in the optimal way.<br>The prophet hath also commented<br>that it is unwise, and leads one<br>into the pits of damnation and subtle bugs, to attempt to declare<br>such functions thyself when thy<br>header files do the job right.
Thou shalt check the array bounds of all strings<br>(indeed, all arrays), for surely where thou typest<br>``foo'' someone someday shall type...