C语言未定义行为问题的改进之路

马丁·乌克尔教授在Kernel Recipes会议上阐述了C语言中未定义行为的根源与解决方案1。他指出，C语言采用的抽象机器模型源于对多样化硬件的支持需求，比如曾需要兼容九位字节的Honeywell机器1。这种设计理念导致C标准中目前存在约100个未定义行为实例，成为语言安全性的主要隐患1。

改进工作正在多个层面推进。C23标准已删除旧式函数定义、补码和一补数支持以及三字符组等问题特性1；进行中的C2y草案进一步移除了其中45个未定义行为，并计划添加case范围、命名for循环、_Countof()宏等新功能1。除了标准更新，编译器改进和分析工具也在发挥作用1。

然而，完全消除内存安全问题面临技术挑战。乌克尔将内存安全分解为类型安全、空间内存安全和时间内存安全三个子问题1。要彻底解决这些问题，需要通过昂贵的运行时检查或形式化验证手段，这意味着内存安全的完整实现仍需时间1。

Professor Martin Uecker addressed the challenges of undefined behavior in C at the Kernel Recipes conference, outlining both the historical roots of the problem and ongoing efforts to mitigate it through language evolution 1. The C language adopted an abstract machine model in the C89 standard to accommodate diverse hardware platforms, including machines with nine-bit bytes such as Honeywell computers 1. This design choice has resulted in approximately 100 instances of undefined behavior in the current C standard, though the draft C2y specification has already removed 45 of these problematic cases 1.

Recent and forthcoming language standards represent concrete progress toward safer C implementations. The C23 standard eliminated several legacy features, including old-style function definitions, support for one's and two's complement representations, and trigraphs 1. The C2y draft will introduce additional improvements, adding case ranges, named for loops, a _Countof() macro, and further instances of what Uecker termed "demon removal" 1. Achieving complete memory safety requires addressing three distinct challenges: type safety, spatial memory safety, and temporal memory safety 1. Uecker noted that fully resolving memory safety issues demands either expensive runtime checking or formal verification methods 1.