|
218 | 218 | - We never use the POSIX version of basename() (which glibc defines it in
|
219 | 219 | libgen.h), only the GNU version (which glibc defines in string.h).
|
220 | 220 | The only reason to include libgen.h is because dirname()
|
221 |
| - is needed. Everytime you need that please immediately undefine |
| 221 | + is needed. Every time you need that please immediately undefine |
222 | 222 | basename(), and add a comment about it, so that no code ever ends up
|
223 | 223 | using the POSIX version!
|
224 | 224 |
|
|
363 | 363 | global variables. Why are global variables bad? They usually hinder
|
364 | 364 | generic reusability of code (since they break in threaded programs,
|
365 | 365 | and usually would require locking there), and as the code using them
|
366 |
| - has side-effects make programs intransparent. That said, there are |
| 366 | + has side-effects make programs non-transparent. That said, there are |
367 | 367 | many cases where they explicitly make a lot of sense, and are OK to
|
368 | 368 | use. For example, the log level and target in log.c is stored in a
|
369 | 369 | global variable, and that's OK and probably expected by most. Also
|
|
385 | 385 |
|
386 | 386 | - When exposing public C APIs, be careful what function parameters you make
|
387 | 387 | "const". For example, a parameter taking a context object should probably not
|
388 |
| - be "const", even if you are writing an other-wise read-only accessor function |
| 388 | + be "const", even if you are writing an otherwise read-only accessor function |
389 | 389 | for it. The reason is that making it "const" fixates the contract that your
|
390 | 390 | call won't alter the object ever, as part of the API. However, that's often
|
391 | 391 | quite a promise, given that this even prohibits object-internal caching or
|
|
395 | 395 |
|
396 | 396 | - Make sure to enforce limits on every user controllable resource. If the user
|
397 | 397 | can allocate resources in your code, your code must enforce some form of
|
398 |
| - limits after which it will refuse operation. It's fine if it is hardcoded (at |
| 398 | + limits after which it will refuse operation. It's fine if it is hard-coded (at |
399 | 399 | least initially), but it needs to be there. This is particularly important
|
400 | 400 | for objects that unprivileged users may allocate, but also matters for
|
401 | 401 | everything else any user may allocated.
|
402 | 402 |
|
403 | 403 | - htonl()/ntohl() and htons()/ntohs() are weird. Please use htobe32() and
|
404 | 404 | htobe16() instead, it's much more descriptive, and actually says what really
|
405 |
| - is happening, after all htonl() and htons() don't operation on longs and |
| 405 | + is happening, after all htonl() and htons() don't operate on longs and |
406 | 406 | shorts as their name would suggest, but on uint32_t and uint16_t. Also,
|
407 | 407 | "network byte order" is just a weird name for "big endian", hence we might
|
408 | 408 | want to call it "big endian" right-away.
|
|
0 commit comments