CPP1111 — Early detection of bound violation on bounded types

Addressee: IDL to C++11 1.1 RTF <idl2cpp11-rtf@omg.org>
Nature: Enhancement
Summary: Early detection of bound violation on bounded types

In the IDL to C++11 Mapping v1.0 (formal/13-02-04), the sections
6.9, 6.10, and 6.11 describe the mapping for string, wstring, and
sequence types, respectively. These sections also address the bounded
variant of those types:

" Implementations must (at run time) detect attempts to pass a
[string|wstring|sequence] value that exceeds the bound as a parameter
across an interface. It must raise a BAD_PARAM system exception to
signal the error. "

In practice, the point at which such a value is passed into an interface
method may be far away from the assignment causing a bound violation,
which makes the error source hard to find.

I propose doing a bound check not only at interface methods but also
at the setter functions for struct, union, and valuetype members.

The section quoted above could thus be extended as follows:

" Implementations must (at run time) detect attempts to pass a
[string|wstring|sequence] value that exceeds the bound as a parameter
across an interface, or passed to a setter method of a struct, union,
or valuetype. It must raise a BAD_PARAM system exception to
signal the error. "

Furthermore, the mapping standard does not define the bound check
behavior for arrays and sequences of bounded types.
IMHO the mapping standard should make explicit that the bound check
shall be performed on each bounded-type element of an array or sequence.

Example:

// IDL
typedef string<12> string12_t;
typedef string12_t string_arr_t[2][3];
typedef sequence<string12_t, 4> string_seq_t;
struct struct_t

The sarr() and sseq() setter methods generated for struct_t should
iterate over their input parameter and perform the bound check on
each element. Similar checks should happen in the explicit constructor
which accepts values for each struct member.

Adding the bounds check to the place where the bounded type is used leads to
inconsistent behavior for users. After discussion we decided to map bounded types
(string/wstring/sequence) to a distinct type and that this type could do a bounds check.
The exact type doesn’t need to be standardized because bound types can only be used
through a typedef in IDL and never are used directly by the programmer. Because the
standard containers don’t have the concept of bounds enforcing a bound will be very
hard to accomplish on all places.