Page History

...

These conversions are machine dependent and should only be coded when absolutely necessary.

Non-Compliant Code Example

In this non-compliant code example, the pointer ptr is converted to an integer value.  Both a pointer and an int are assumed to be 32 bits.  The high-order nine bits of the number are used to hold a flag value, and the result is converted back into a pointer.

...

A similar scheme was used in early versions of Emacs, limiting its portability and preventing the ability to edit files larger than 8MB.

Compliant Solution

Saving a few bits of storage is generally not as important as writing portable code. A struct can be used to provide room for both the pointer and the flag value.  This is portable to machines of different word sizes, both smaller and larger than 32 bits, and works even when pointers cannot be represented in any integer type.

struct ptrflag {
  char *pointer;
  unsigned int flag :9;
} ptrflag;
/* ... */
ptrflag.pointer = ptr;
ptrflag.flag = flag;

Risk Analysis

Converting from pointer to integer or vice versa results in unportable code and may create unexpected pointers to invalid memory locations.

Automated Detection

The LDRA tool suite V 7.6.0 is able to detect violations of this recommendation.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.3.2.3, "Pointers"

...

INT14INT10-A. Avoid performing bitwise and arithmetic operations on the same dataDo not assume a positive remainder when using the % operator      04. Integers (INT)       Image Removed INT12-A. Do not make assumptions about the type of a plain int bit-field when used in an expression