Dangerous ‘C’ Assumptions

Below is a list of assumptions which are not necessarily safe to make, and some assumptions which are safe.

• Do not assume you know the size of int.
• Do not assume that long, float, double, or long double can be at any even address.
• Some bitwise operations on signed integers are implementation dependant; to ensure portability, integers used in bitwise operations should be unsigned.
• Do not assume you know the memory layout of a data type; specifically, there may or may not be gaps between members due to alignment issues.
• Especially do not assume you know how a struct or a class is laid out in memory, or that they can be written to a data file ‘as is’.
• Do not assume a class layout stores bases and members in declaration order.
• Do not assume pointers and integers are interchangeable. Use void* if you want an untyped pointer, not char*. Pointers to functions might have a different size than void*.
• Do not assume you know how the calling conventions are implemented, or indeed any detail of the language implementation or run time.
• offsetof only works for PODs (Plain Old Data types).
• You cannot portably assume anything about the placement in memory of automatic variables, or about the direction in which the stack grows.
• Due to alignment issues, you cannot always write just any object at just any memory address, even if you have enough space.

ANSI specifies the following about C’s built in types. This is all you can safely assume:

• Base two is guaranteed for integral numbers.
• Two’s complement is guaranteed for negative integral numbers. (GGC supports only this but implies that other representations are allowed in C99.)
• An unsigned char can hold at least 0 to 255; it may hold more.
• A signed char can hold -127 to +127; it may hold more.
• A char may be either an unsigned char or a signed char. You cannot assume either. Therefore, do not use char (without a prefix) unless you do not care about sign extension.
• A short can hold at least -32,767 to 32,767 (signed) or 0 to 65,535 (unsigned).
• A long can hold at least -2,147,483,647 to 2,147,483,647 (signed) or 0 to 4,294,967,295 (unsigned).
• An int holds at least 16 bits and therefore can hold at least -32,767 to 32,767 (signed) or 0 to 65,535 (unsigned). In other words, an int cannot be counted on to hold any more than a short. int is an appropriate type to use when a short would be large enough but you would like to use the processor’s “natural” word size to improve efficiency—on some machines, a 32-bit operation is more efficient than a 16-bit operation because there is no need to do masking. If you need values larger than a short can hold, you must specify long.

For more information, see section 4.6 of [Stroustrup1997] and Item 91 of [Sutter2005a].