Read-only Pointer to Pointer

Question

In C, const char *p is sometimes called a "read-only" pointer: a pointer to a constant object (in this case, a char).

It would seem that either

1. const char **p
2. const char *const *p

would be the equivalent declarations for a read-only pointer to a pointer, depending on how many levels of indirection are immutable.

However, compilers (gcc, clang) generate a warning.

My Questions: How do you pass a pointer to a pointer (like char **p) to a function as a "read-only" pointer without generating a warning? If an explicit cast is required, why in the case of char **p and not char *p?

More Details

Here is a concrete example of what I'm trying to achieve.

Read-only Pointer

This code treats char *ptr as a read-only pointer.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void readonly(const char *ptr)
{
    // ... do something with ptr ...

    // but modifying the object it points to is forbidden
    // *ptr = 'j';  // error: read-only variable is not assignable
}

int main(void)
{
    char *ptr =  malloc(12*sizeof(char));
    strcpy(ptr, "hello world");

    printf("before: %s\n", ptr);
    readonly(ptr);
    printf("after: %s\n", ptr);

    free(ptr);
    return 0;
}

The qualifier const is added in the function call without any complaints.

Read-only Pointer to Pointer

I would expect that a similar function call should be possible with a pointer to a pointer.

void readonly(const char *const *ptr)
{
    //  ... do something with ptr ...

    // but modifying the object it points to is forbidden
    // **ptr = 'j';
}

int main(void)
{
    char **ptr;

    ptr = (char **) malloc(2*sizeof(char *));

    ptr[0] = malloc(14*sizeof(char));
    strcpy(ptr[0], "hello world 0");

    ptr[1] = malloc(14*sizeof(char));
    strcpy(ptr[1], "hello world 1");

    printf("before: %s %s\n", ptr[0], ptr[1]);
    readonly(ptr);
    printf("after: %s %s\n", ptr[0], ptr[1]);

    free(ptr[1]);
    free(ptr[0]);
    free(ptr);
    return 0;
}

The clang compiler (version 6.0.0) gives the most human-readable warning.

warning: passing 'char **' to parameter of type
    'const char *const *' discards qualifiers in nested pointer types
    [-Wincompatible-pointer-types-discards-qualifiers]
    readonly(ptr);
         ^~~
note: passing argument to parameter 'ptr' here
    void readonly(const char *const *ptr)

But gcc (8.1.1) also gives a warning.

Aside: It seems strange that clang says that passing char ** discards the qualifier, when I'm trying to add the qualifier?

The Questions

1. How do you pass a pointer to a pointer (like char **p) to a function as a "read-only" pointer without generating a warning?

2. If an explicit cast is required, why in the case of char **p and not char *p?

Answer 1

Your function readonly(const char *ptr) promises that it will not touch what is behind the pointer.
That's the reason why a caller may trustfully pass a pointer to a const memory area (passing a const char *ptr).
And of course it is no problem to pass a non-const char *ptr to this function as well, because your function promises more security than needed. That's why the compiler follows your wish without any warning or note whatsoever.

However this automatism does only work for the 1st indirection level.

The Standard claims in 6.5.16.1 for an assignment, that "both operands are pointers to qualified or unqualified versions of compatible types, and the type pointed to by the left has all the qualifiers of the type pointed to by the right"
The last part of the sentence means that adding a qualifier to the pointed-to type is no problem.
And the first part claims "compatible" types. And (I think,) 6.7.3 (11) does describe this for qualified types: "For two qualified types to be compatible, both shall have the identically qualified version of a compatible type."

Reading this, your pointed-to types are not considered as compatible (even if it would be possible to assign one to the other).

Hence I would say that the clang warning about discarding qualifiers is a bit misleading, but it refers to the non-identically qualified pointed-to types.

Answer 2

You can simplify your code to this:

char const ** var = (char**)0;

The second fact. It is not a bug. Here are test cases: https://github.com/llvm/llvm-project/blob/62ec4ac90738a5f2d209ed28c822223e58aaaeb7/clang/test/Sema/pointer-conversion.c

Let's go with another example:

char const*****  c1 = (char*****)0; // fail
char *const****  c2 = (char*****)0; // fail
char **const***  c3 = (char*****)0; // fail
char ***const**  c4 = (char*****)0; // fail
char ****const*  c5 = (char*****)0; // ok
char *****const  c6 = (char*****)0; // ok

Good. We see pattern.

As I guess C/C++ can't promise you that you can modify anything with a depth bigger than 2 due some problems with const-correctness, which is discussed here before.

Answer 3

In GCC, you can just disable the warning in code with:

#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wincompatible-pointer-types-discards-qualifiers"
readonly(ptr);
#pragma GCC diagnostic pop

I imagine clang has something similar. As for your second question, the comments seem to have it.

Answer 4

A I understand you want to declare the const pointer to pointer to const chat similar as pointer to const char. the declaration is :

void foo( const char ** const pointer )

It is a bit "tricky" as the stars count from the opposite direction.

Lets consider the very simple example

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void foo( const char ** const pointer )
{
    while(**pointer)
    {
        printf("%c", **pointer);
        (*pointer)++;
    }
    printf("\n");
}

void foo1( const char *const * pointer)
{
    while(*pointer)
    {
        printf("%s\n", *pointer++);
    }
}


int main(void) 
{
    char **pointer = malloc(sizeof(char *));
    char **pointer1 = malloc(sizeof(char *) * 4);

    char strings_in_RAM_0[] = "one";
    char strings_in_RAM_1[] = "two";
    char strings_in_RAM_2[] = "three";

    pointer1[0] = strings_in_RAM_0;
    pointer1[1] = strings_in_RAM_1;
    pointer1[2] = strings_in_RAM_2;
    pointer1[3] = NULL;

    *pointer = malloc(50);

    strcpy(*pointer,"Const pointer to pointer");

    foo(pointer);
    foo1(pointer1);

    free(*pointer);
    free(pointer);
    free(pointer1);

    return 0;
}

it will give you a warning but it will work as expected until the free. Then (because the pointer is changed) the free fails. To avoid it you need to save the original pointer to char for example:

void foo( const char ** const pointer )
{
    const char *ptr = *pointer;
    while(**pointer)
    {
        printf("%c", **pointer);
        (*pointer)++;
    }
    printf("\n");
    *pointer = ptr;
}

the foo1 function parameter is of type pointer to const pointer to const char

https://ideone.com/JSewN4