• Nick Treleaven (23/23) Mar 25 A C-style variadic `pragma(printf)` function can have a safe
• Nick Treleaven (2/4) Mar 25 I meant **no** new syntax would be needed!
• Dennis (5/10) Mar 25 The simple fix is accept that printf does not have a `@safe`

Nick Treleaven <nick geany.org> writes:

A C-style variadic `pragma(printf)` function can have a safe 
interface:
https://dlang.org/changelog/pending.html#dmd.saferPrintf

However, a pragma is not part of the function type. Consequently 
there are safety holes for:

- [Taking address of the 
function](https://github.com/dlang/dmd/issues/22794)
- [Overriding a method](https://github.com/dlang/dmd/issues/22812)

This is because the pragma disappears but the  trusted part 
remains, making the new symbol wrongly  trusted. Possibly there 
are other safety holes. Is there a reliable simple way to fix 
those without changing the design to track this in the type 
system? It could be as simple as the compiler recognizing a new 
`core.attribute`, so new language syntax would be needed. If so, 
now would be a good time to change this before 2.113 is released.

A lesser issue is that `pragma(printf)` can check just the format 
string syntax for `va_list` functions. Possibly people might 
wrongly add  trusted there:
https://github.com/dlang/dmd/issues/22786

That could be made an error either way (although if the `va_list` 
parameter isn't read, it can be safe, but not very useful). But 
it illustrates that having a separate attribute might be clearer 
e.g. for code reviews.

Nick Treleaven <nick geany.org> writes:

On Wednesday, 25 March 2026 at 12:54:42 UTC, Nick Treleaven wrote:
 It could be as simple as the compiler recognizing a new 
 `core.attribute`, so new language syntax would be needed.

I meant **no** new syntax would be needed!

Dennis <dkorpel gmail.com> writes:

On Wednesday, 25 March 2026 at 12:54:42 UTC, Nick Treleaven wrote:
 Is there a reliable simple way to fix
 those without changing the design to track this in the type 
 system?

The simple fix is accept that printf does not have a ` safe` 
interface and use a D function instead.

 It could be as simple as the compiler recognizing a new 
 `core.attribute`, so no new language syntax would be needed.

Even that to me sounds like too much effort for an evolutionary 
dead end like pragma(printf).