__attribute__((sentinel)) for C FFI variadic functions

[tomjakubowski]

__attribute__((sentinel)) or __attribute__((sentinel(N))) is a GNU C extension (also supported by clang) that marks variadic functions as requiring a sentinel NULL value in the last (or (N+1)th-to-last) argument slot. The compiler checks uses of this function and emits a warning (-Wformat) if the NULL sentinel value is not present in the expected location in the parameter list.

https://gcc.gnu.org/onlinedocs/gcc-4.0.4/gcc/Function-Attributes.html#index-g_t_0040code_007bsentinel_007d-function-attribute-1760

It would be nice to be able to mark foreign variadic functions in Rust the same way, such that the compiler checks that a sentinel NULL appears in the proper position at call sites for these functions. GCC considers any 0-initialized pointer type to be NULL in this context.

[tomjakubowski]

Some examples would be marking execl as #[sentinel] (NULL must appear in the last argument position) and execle as #[sentinel(1)] (NULL must appear as the second-to-last argument position):

extern {
    #[sentinel]
    fn execl(path: *const c_char, arg0: *const c_char, ...);
    #[sentinel(1)]
    fn execle(path: *const c_char, arg0: *const c_char, ...);
}

fn foo() {
    // ...
    unsafe { execl(path_to_bin, arg0, arg1, arg2); } // <- warning/error, missing sentinel value 
    unsafe { execl(path_to_bin, arg0, arg1, arg2, 0 as *const _); } // <- ok
    unsafe { execle(path_to_bin, arg0, arg1, arg2, 0 as *const_, env_array); } // <- also ok
}