Page History

Do not convert a pointer value to a pointer type that is more strictly aligned than the type the value actually points to. Different alignments are possible for different types of objects. If the type-checking system is overridden by an explicit cast or the pointer is converted to a void pointer (void *) and then to a different type, the alignment of an object may be changed.

Section 6.3.2.3, para. 7, of the C Standard [ISO/IEC 9899:2011] states:

...

If the misaligned pointer is dereferenced, the program may terminate abnormally. The cast alone may cause a loss of information, even if the value is not dereferenced. For example, the assertion in the following code example will fail on some conforming implementations, even though no pointers are dereferenced:

char c = 'x';
int *ip = (int *)&c; /* this can lose information */
char *cp = (char *)ip;
assert(cp == &c);    /* will fail on some conforming implementations */

On some implementations, cp will not match &c. As a result, if a pointer to one object type is converted to a pointer to a different object type, the second object type must not require stricter alignment than the first.

Noncompliant Code Example

...

char *data;
struct foo_header header;

memcpy(&header, data + offset, sizeof(header));

if (header.len < FOO)
/* ... */

Risk Assessment

Accessing a pointer or an object that is no longer on the correct access boundary can cause a program to crash or give wrong information, or it can cause slow pointer accesses (if the architecture allows misaligned accesses).

Automated Detection

...

Tool

...

Version

...

Checker

...

Description

...

Can detect violations of this rule. However, it does not flag explicit casts to void * and then back to another pointer type.

...

ECLAIR

...

castexpr

...

Noncompliant Code Example

In this noncompliant example, the char pointer &c is converted to the more strictly aligned int pointer i_ptr.

void f(void) {
  int *i_ptr;
  char c;
 
  i_ptr = (int *)&c;  // diagnostic required
  /* ... */
}

Compliant Solution

This compliant solution because the value referenced by the char pointer c_ptr has the alignment of type int.

void f(void) {
  char *c_ptr;
  int *i_ptr;
  int i;
 
  c_ptr = (char *)&i;
  i_ptr = (int *)c_ptr;
  /* ... */
}

...

Can detect some violations of this rule when the -Wcast-align flag is used.

...

LDRA tool suite

...

94 S
540 S

...

Noncompliant Code Example

For objects declared on the stack, the C Standard provides provides alignas to  to declare an object to have a stricter alignment. It can be used to resolve the following noncompliant code example.

char c = 'x';
int *ip = (int *)&c; /* this can lose information */
char *cp = (char *)ip;
assert(cp == &c);    /* will fail on some conforming implementations */

Compliant Solution

The compliant solution uses uses alignas to  to align the the character character c to  to the alignment of an integer. As a result, the two pointers point to equally aligned pointer types.

alignas(int) char c = 'x'; /* align c to the alignment of an int */
int *ip = (int *)&c; 
char *cp = (char *)ip;
assert(cp == &c);    /* both cp and &c point to equally aligned objects */

Risk Assessment

Accessing a pointer or an object that is no longer on the correct access boundary can cause a program to crash or give wrong information, or it can cause slow pointer accesses (if the architecture allows misaligned accesses).

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...