P3566R2 — You shall not pass `char*` - Safety concerns working with unbounded null-terminated strings
Marco Foco, Joshua Kriegshauser, Alexey Shevlyakov, Giuseppe D'Angelo
LEWGSG18SG23
`string`s and `string_view`s are often used as a safer alternative to null-terminated strings. Unfortunately they suffer from an implicit assumption at creation/assignment time, and in some of their functions: the presence of a null-terminator in the input sequence. The absence of the null-terminator can currently lead to undefined behavior inside these functions. There are many cases when the length of the sequence can be computed at compile time, which shouldn’t be ignored. In some other cases, we can turn potential undefined-behaviors into either well-defined behavior, or "better behaved" undefined behavior (i.e. turning an unbounded string operation into a bounded string operation). In this paper we propose to restrict the usage of constructors and functions taking a `char*` argument in `string`, `string_view`, and `zstring_view` to improve range-safety in these operations (together with some other minor improvements).