[中文版本](/posts/c教程/zh-CN/09-可移植与现代 C/088-Safer Alternatives (Bounds Checking, _Static_assert, and Modern C Safety Tools))

C gives you power and control, but also responsibility. Because C does not automatically protect you from memory errors, buffer overflows, or type misuse, you must add safety at the language and tool level.

This section explores modern safety features in C11 to C23, including bounds checking, static assertions, and practical habits for writing safer C.

Step 1. Why Safety Matters in C

C is fast because it trusts the programmer. That means:

• It doesn’t check array bounds.
• It doesn’t initialize memory automatically.
• It doesn’t manage memory for you.

That trust is both the reason C is used for kernels and the reason it causes so many bugs. The goal is not to make C “safe by default,” but to make your use of C safe by design.

Step 2. Safer Bounds Handling

A classic error in C:

char name[8];
strcpy(name, "HelloWorld"); // buffer overflow

This overwrites memory pastname and causes undefined behavior.

Fix 1: Use bounded versions of functions

strncpy(name, "HelloWorld", sizeof(name) - 1);
name[sizeof(name) - 1] = '\0';

Fix 2: Use safer alternatives introduced in C11 Annex K (if your compiler supports them):

strcpy_s(name, sizeof(name), "Hello");

They automatically check bounds and return error codes. However, Annex K is optional, so not all compilers implement it.

Step 3. Tiny Code: Safe String Copy

#include <stdio.h>
#include <string.h>
int main(void) {
    char dst[8];
    strncpy(dst, "Example", sizeof(dst) - 1);
    dst[sizeof(dst) - 1] = '\0';
    printf("Safe copy: %s\n", dst);
}

Compile with:

gcc safe_copy.c -o safe_copy -Wall -Wextra -O2

The-Wall -Wextra flags warn about suspicious behavior early, one of your best “safety tools.”

Step 4. _Static_assert: Compile-Time Checking

Introduced in C11,_Static_assert lets you validate conditions before the program even compiles.

Example:

_Static_assert(sizeof(int) == 4, "This code requires 32-bit int");

If the condition fails, compilation stops with a clear message.

You can use it for:

• Checking structure layout
• Ensuring type sizes
• Verifying array lengths
• Enforcing invariants

Step 5. Safer Integer Operations

Integer overflow is undefined behavior in C. Example:

int x = 2147483647 + 1; // overflow

Safer options:

Useunsigned types when wrapping is intentional.

Use compiler flags:

• -ftrapv(GCC/Clang): trap on overflow.
• -fsanitize=undefined: detect overflow at runtime.

Example:

gcc -fsanitize=undefined -O2 -g check.c -o check

This will abort your program the moment an overflow occurs.

Step 6. Null Pointer and Resource Safety

Always check return values:

FILE *f = fopen("data.txt", "r");
if (!f) {
    perror("Failed to open file");
    return 1;
}

For dynamic memory:

char *p = malloc(100);
if (!p) {
    fprintf(stderr, "Out of memory\n");
    exit(1);
}

And alwaysfree() when done.

Step 7. Tools for Safety

Modern compilers and tools help you detect bugs early:

Tool	Purpose
AddressSanitizer (-fsanitize=address)	Detects buffer overflows, use-after-free
UndefinedBehaviorSanitizer (-fsanitize=undefined)	Detects integer and type errors
Valgrind	Checks for memory leaks and invalid accesses
clang-tidy	Static analysis and style checking
cppcheck	Portable static analyzer for C/C++

Example:

clang -fsanitize=address safe.c -o safe
./safe

If there’s a bug, you’ll get a detailed memory trace.

Step 8. Struct and Alignment Checks

Unintended padding can cause issues when serializing or working with hardware. You can assert layout at compile time:

#include <stddef.h>
#include <stdio.h>
struct Packet {
    char type;
    int id;
};
_Static_assert(offsetof(struct Packet, id) == 4, "Alignment mismatch");

This ensures your assumptions about memory layout are correct.

Step 9. Defensive Macros and Compile Flags

Protect yourself with compile-time options:

Flag	Purpose
-Wall -Wextra	Enable important warnings
-Werror	Treat warnings as errors
-Wconversion	Warn on implicit type conversions
-fsanitize=address	Detect memory safety issues
-D_FORTIFY_SOURCE=2	Add runtime buffer checks (glibc)
-fstack-protector-strong	Detect stack corruption
-O2	Optimize safely without risky transformations

Example:

gcc -Wall -Wextra -Werror -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 main.c -o main

Step 10. Tiny Code: Using Static Assertions and Sanitizers

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
struct Data {
    int id;
    char name[16];
};
_Static_assert(sizeof(struct Data) <= 32, "Struct too large");
int main(void) {
    struct Data d = {42, "C Safety"};
    printf("%d %s\n", d.id, d.name);
    char buf[8];
    strncpy(buf, "Safe", sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = '\0';
    printf("Buffer: %s\n", buf);
}

Compile with:

gcc -Wall -Wextra -fsanitize=address -O2 safe_program.c -o safe_program

This program will abort if memory safety is violated, giving you immediate feedback during testing.

Why It Matters

Safety doesn’t make your code slower, it makes your software trustworthy. Even though C gives you sharp tools, the combination of static checks, compiler warnings, and runtime sanitizers can make your programs robust enough for production systems.

Try It Yourself

1. Add_Static_assert checks in your structs and constants.
2. Compile with-Wall -Wextra -Werror and fix all warnings.
3. Use AddressSanitizer to catch out-of-bounds bugs.
4. Test your program under Valgrind for leaks.
5. Try writing the same buggy code twice, once raw, once safe, and compare behavior.

Next, you’ll explore modern C style, how to write clear, maintainable, and idiomatic code in the C23 era.