| ------------------------------------------------------------------------------ |
| -- -- |
| -- GNAT COMPILER COMPONENTS -- |
| -- -- |
| -- I N T E R F A C E S . C . S T R I N G S -- |
| -- -- |
| -- S p e c -- |
| -- -- |
| -- Copyright (C) 1993-2025, Free Software Foundation, Inc. -- |
| -- -- |
| -- This specification is derived from the Ada Reference Manual for use with -- |
| -- GNAT. The copyright notice above, and the license provisions that follow -- |
| -- apply solely to the contents of the part following the private keyword. -- |
| -- -- |
| -- GNAT is free software; you can redistribute it and/or modify it under -- |
| -- terms of the GNU General Public License as published by the Free Soft- -- |
| -- ware Foundation; either version 3, or (at your option) any later ver- -- |
| -- sion. GNAT is distributed in the hope that it will be useful, but WITH- -- |
| -- OUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY -- |
| -- or FITNESS FOR A PARTICULAR PURPOSE. -- |
| -- -- |
| -- As a special exception under Section 7 of GPL version 3, you are granted -- |
| -- additional permissions described in the GCC Runtime Library Exception, -- |
| -- version 3.1, as published by the Free Software Foundation. -- |
| -- -- |
| -- You should have received a copy of the GNU General Public License and -- |
| -- a copy of the GCC Runtime Library Exception along with this program; -- |
| -- see the files COPYING3 and COPYING.RUNTIME respectively. If not, see -- |
| -- <http://www.gnu.org/licenses/>. -- |
| -- -- |
| -- GNAT was originally developed by the GNAT team at New York University. -- |
| -- Extensive contributions were provided by Ada Core Technologies Inc. -- |
| -- -- |
| ------------------------------------------------------------------------------ |
| |
| -- This package declares types and subprograms that allow the allocation, |
| -- reference, update and deallocation of C-style strings, as defined by |
| -- ARM B.3.1. |
| |
| -- Preconditions in this unit are meant for analysis only, not for run-time |
| -- checking, so that the expected exceptions are raised. This is enforced by |
| -- setting the corresponding assertion policy to Ignore. These preconditions |
| -- protect from Constraint_Error, Dereference_Error and Update_Error, but not |
| -- from Storage_Error. |
| |
| pragma Assertion_Policy (Pre => Ignore); |
| |
| package Interfaces.C.Strings with |
| SPARK_Mode => On, |
| Abstract_State => (C_Memory), |
| Initializes => (C_Memory), |
| Always_Terminates |
| is |
| pragma Preelaborate; |
| |
| -- Definitions for C character arrays |
| type char_array_access is access all char_array; |
| for char_array_access'Size use System.Parameters.ptr_bits; |
| |
| pragma No_Strict_Aliasing (char_array_access); |
| -- Since this type is used for external interfacing, with the pointer |
| -- coming from who knows where, it seems a good idea to turn off any |
| -- strict aliasing assumptions for this type. |
| |
| type chars_ptr is private |
| with |
| Preelaborable_Initialization; |
| |
| type chars_ptr_array is array (size_t range <>) of aliased chars_ptr; |
| |
| Null_Ptr : constant chars_ptr; |
| -- Null value for private type chars_ptr |
| |
| function To_Chars_Ptr |
| (Item : char_array_access; |
| Nul_Check : Boolean := False) return chars_ptr |
| with |
| SPARK_Mode => Off; -- To_Chars_Ptr'Result is aliased with Item |
| -- Extract raw chars_ptr from char_array access type |
| |
| function New_Char_Array (Chars : char_array) return chars_ptr with |
| Volatile_Function, |
| Post => New_Char_Array'Result /= Null_Ptr, |
| Global => (Input => C_Memory); |
| -- Copy the contents of Chars into a newly allocated chars_ptr |
| |
| function New_String (Str : String) return chars_ptr with |
| Volatile_Function, |
| Post => New_String'Result /= Null_Ptr, |
| Global => (Input => C_Memory); |
| -- Copy the contents of Str into a newly allocated chars_ptr |
| |
| procedure Free (Item : in out chars_ptr) with |
| SPARK_Mode => Off; |
| -- When deallocation is prohibited (eg: cert runtimes) this routine |
| -- will raise Program_Error. |
| |
| Dereference_Error : exception; |
| -- This exception is raised when a subprogram of this unit tries to |
| -- dereference a chars_ptr with the value Null_Ptr. |
| |
| -- The Value functions copy the contents of a chars_ptr object |
| -- into a char_array/String. |
| -- There is a guard for a storage error on an object declaration for |
| -- an array type with a modular index type with the size of |
| -- Long_Long_Integer. The special processing is needed in this case |
| -- to compute reliably the size of the object, and eventually, to |
| -- raise Storage_Error, when wrap-around arithmetic might compute |
| -- a meangingless size for the object. |
| -- |
| -- The guard raises Storage_Error when |
| -- |
| -- (Arr'Last / 2 - Arr'First / 2) > (2 ** 30) |
| -- |
| function Value (Item : chars_ptr) return char_array with |
| Pre => Item /= Null_Ptr, |
| Global => (Input => C_Memory); |
| |
| function Value |
| (Item : chars_ptr; |
| Length : size_t) return char_array |
| with |
| Pre => Item /= Null_Ptr and then Length /= 0, |
| Global => (Input => C_Memory); |
| |
| function Value (Item : chars_ptr) return String with |
| Pre => Item /= Null_Ptr, |
| Global => (Input => C_Memory); |
| |
| function Value |
| (Item : chars_ptr; |
| Length : size_t) return String |
| with |
| Pre => Item /= Null_Ptr and then Length /= 0, |
| Global => (Input => C_Memory); |
| |
| function Strlen (Item : chars_ptr) return size_t with |
| Pre => Item /= Null_Ptr, |
| Global => (Input => C_Memory); |
| -- Return the length of a string contained in a chars_ptr |
| |
| -- Update the contents of a chars_ptr with a char_array/String. If the |
| -- update exceeds the original length of the chars_ptr the Update_Error |
| -- exception is raised. |
| procedure Update |
| (Item : chars_ptr; |
| Offset : size_t; |
| Chars : char_array; |
| Check : Boolean := True) |
| with |
| Pre => |
| Item /= Null_Ptr |
| and then (Chars'First /= 0 or else Chars'Last /= size_t'Last) |
| and then Chars'Length <= size_t'Last - Offset |
| and then Chars'Length + Offset <= Strlen (Item), |
| Global => (In_Out => C_Memory); |
| |
| procedure Update |
| (Item : chars_ptr; |
| Offset : size_t; |
| Str : String; |
| Check : Boolean := True) |
| with |
| Pre => |
| Item /= Null_Ptr |
| and then Str'Length <= size_t'Last - Offset |
| and then Str'Length + Offset <= Strlen (Item), |
| Global => (In_Out => C_Memory); |
| |
| Update_Error : exception; |
| |
| private |
| pragma SPARK_Mode (Off); |
| type chars_ptr is access all Character; |
| for chars_ptr'Size use System.Parameters.ptr_bits; |
| |
| pragma No_Strict_Aliasing (chars_ptr); |
| -- Since this type is used for external interfacing, with the pointer |
| -- coming from who knows where, it seems a good idea to turn off any |
| -- strict aliasing assumptions for this type. |
| |
| Null_Ptr : constant chars_ptr := null; |
| end Interfaces.C.Strings; |
