Error Handling and Program Failure

#include <limits.h>
#include <stdckdint.h>
#include <stdio.h>

// C23: checked, and the destination type decides what "fits" means.
static bool add_safely(int a, int b, int *out)
{
    return !ckd_add(out, a, b);
}

// Pre-C23: check BEFORE the operation, never after (the overflow is already UB).
static bool add_safely_c11(int a, int b, int *out)
{
    if (b > 0 && a > INT_MAX - b) {
        return false;
    }
    if (b < 0 && a < INT_MIN - b) {
        return false;
    }
    *out = a + b;
    return true;
}

int main(void)
{
    int result = 0;
    printf("%d %d\n", add_safely(INT_MAX, 1, &result), add_safely_c11(INT_MAX, 1, &result));

    // Write in one statement, read in the next: writing and reading result in a
    // single expression would be unsequenced, and so undefined.
    bool ok = add_safely(2, 3, &result);
    printf("%d %d\n", ok, result);
    return 0;
}

#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    int uninitialized;              // automatic storage: INDETERMINATE
    // printf("%d\n", uninitialized);   // UNDEFINED -- and -Wuninitialized warns
    (void)uninitialized;

    int initialized = 0;            // always initialize at the declaration

    void *raw = malloc(16);         // malloc: also indeterminate
    if (raw == nullptr) {
        return EXIT_FAILURE;
    }
    // Read it only after writing it, or use calloc to get zeros.
    unsigned char *bytes = raw;
    bytes[0] = 1;

    printf("%d %d\n", initialized, bytes[0]);
    free(raw);
    return 0;
}

warning: variable 'uninitialized' is uninitialized when used here [-Wuninitialized]
warning: self-comparison always evaluates to true [-Wtautological-compare]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void)
{
    int values[4] = { 1, 2, 3, 4 };
    size_t index = 4;

    // Out of bounds: values[4] does not exist. Nothing checks this.
    if (index < sizeof values / sizeof values[0]) {         // the check you must write
        printf("%d\n", values[index]);
    } else {
        puts("index rejected");
    }

    // Buffer overflow through an unchecked copy:
    char small[8];
    const char *source = "this is far too long";

    // strcpy(small, source);                               // OVERFLOW -- UB
    if (snprintf(small, sizeof small, "%s", source) >= (int)sizeof small) {
        puts("truncated rather than overflowed");
    }

    // Use-after-free and double free:
    char *p = malloc(16);
    if (p == nullptr) {
        return EXIT_FAILURE;
    }
    strcpy(p, "ok");
    free(p);
    p = nullptr;                    // makes a later use a null deref, not a UAF
    free(p);                        // free(nullptr) is explicitly safe

    return 0;
}

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// A project-specific status enum: explicit, exhaustive, and switchable.
enum Status {
    STATUS_OK = 0,
    STATUS_INVALID_ARGUMENT,
    STATUS_OUT_OF_MEMORY,
    STATUS_IO_ERROR,
    STATUS_NOT_FOUND,
};

static const char *status_message(enum Status status)
{
    switch (status) {
    case STATUS_OK:               return "ok";
    case STATUS_INVALID_ARGUMENT: return "invalid argument";
    case STATUS_OUT_OF_MEMORY:    return "out of memory";
    case STATUS_IO_ERROR:         return "I/O error";
    case STATUS_NOT_FOUND:        return "not found";
    default:                      return "unknown status";
    }
}

// The result goes through an out parameter; the return value is the status.
static enum Status read_first_line(const char *path, char **out_line)
{
    if (path == nullptr || out_line == nullptr) {
        return STATUS_INVALID_ARGUMENT;
    }
    *out_line = nullptr;

    FILE *f = fopen(path, "r");
    if (f == nullptr) {
        return errno == ENOENT ? STATUS_NOT_FOUND : STATUS_IO_ERROR;
    }

    char buffer[256];
    enum Status status = STATUS_OK;

    if (fgets(buffer, sizeof buffer, f) == nullptr) {
        status = ferror(f) ? STATUS_IO_ERROR : STATUS_NOT_FOUND;
        goto out;
    }

    *out_line = strdup(buffer);
    if (*out_line == nullptr) {
        status = STATUS_OUT_OF_MEMORY;
    }

out:
    fclose(f);
    return status;
}

int main(void)
{
    char *line = nullptr;
    enum Status status = read_first_line("/nonexistent/file", &line);

    printf("status: %s\n", status_message(status));
    free(line);
    return status == STATUS_OK ? EXIT_SUCCESS : EXIT_FAILURE;
}

#include <stdio.h>
#include <stdlib.h>

static int process(const char *in_path, const char *out_path, size_t buffer_size)
{
    int status = -1;                        // pessimistic default

    unsigned char *buffer = nullptr;
    FILE *in = nullptr;
    FILE *out = nullptr;

    buffer = malloc(buffer_size);
    if (buffer == nullptr) {
        goto cleanup;                       // nothing acquired yet
    }

    in = fopen(in_path, "rb");
    if (in == nullptr) {
        perror("open input");
        goto cleanup;
    }

    out = fopen(out_path, "wb");
    if (out == nullptr) {
        perror("open output");
        goto cleanup;
    }

    size_t read_count;
    while ((read_count = fread(buffer, 1, buffer_size, in)) > 0) {
        if (fwrite(buffer, 1, read_count, out) != read_count) {
            perror("write");
            goto cleanup;
        }
    }

    if (ferror(in)) {
        perror("read");
        goto cleanup;
    }

    status = 0;                             // success only reached here

cleanup:
    // One place to release everything; each guard makes the order irrelevant.
    if (out != nullptr && fclose(out) != 0 && status == 0) {
        perror("close output");             // a close failure IS an error
        status = -1;
    }
    if (in != nullptr) {
        fclose(in);
    }
    free(buffer);
    return status;
}

int main(void)
{
    return process("/nonexistent/in", "/tmp/c-demo-out.bin", 4096) == 0 ? 0 : 1;
}

#include <assert.h>
#include <limits.h>
#include <stddef.h>
#include <stdio.h>

static_assert(CHAR_BIT == 8, "this code assumes 8-bit bytes");

enum Direction { DIR_NORTH, DIR_SOUTH, DIR_EAST, DIR_WEST };

static const char *direction_name(enum Direction d)
{
    switch (d) {
    case DIR_NORTH: return "north";
    case DIR_SOUTH: return "south";
    case DIR_EAST:  return "east";
    case DIR_WEST:  return "west";
    }

    // Every enumerator is handled above, so this is genuinely unreachable...
    // but prefer returning a fallback to promising UB:
    return "unknown";
}

static int average(const int *values, size_t count)
{
    assert(values != nullptr);          // a precondition: callers must not pass null
    assert(count > 0);                  // ...and must pass a non-empty range

    long long total = 0;
    for (size_t i = 0; i < count; ++i) {
        total += values[i];
    }
    return (int)(total / (long long)count);
}

int main(void)
{
    int values[3] = { 10, 20, 30 };
    printf("%s %d\n", direction_name(DIR_EAST), average(values, 3));
    return 0;
}

# Address + undefined behavior: the default pairing. Catches out-of-bounds,
# use-after-free, leaks, signed overflow, misaligned access, bad shifts.
$ clang -std=c23 -Wall -Wextra -Werror -g -O1 \
        -fsanitize=address,undefined -fno-omit-frame-pointer -o app app.c
$ ./app
app.c:14:12: runtime error: signed integer overflow: 2147483647 + 1 cannot be
             represented in type 'int'

# Threads: data races and lock-order inversions (mutually exclusive with ASan).
$ clang -std=c23 -g -fsanitize=thread -o app app.c

# Uninitialized reads (Clang only, and needs every dependency instrumented).
$ clang -std=c23 -g -fsanitize=memory -o app app.c

# No rebuild required, slower, catches leaks and invalid accesses:
$ valgrind --leak-check=full --track-origins=yes ./app

# Static analysis, no execution at all:
$ gcc -std=c23 -fanalyzer -c app.c
$ clang --analyze app.c
$ clang-tidy app.c -- -std=c23