Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated UB references from C11->C23

Different Do not convert a pointer value to a pointer type that is more strictly aligned than the referenced type. Different alignments are possible for different types of objects. If the type-checking system is overridden by an explicit cast or the pointer is converted to a void pointer (void *) and then to a different type, the alignment of an object may be changed.

According to C99, Section The C Standard, 6.3.2.3, p7 , paragraph 7 [ISO/IEC 9899:2024], states

A pointer to an object or incomplete type may be converted to a pointer to a different object or incomplete type. If the resulting pointer is not correctly aligned for the pointed-to referenced type, the behavior is undefined.

(See also undefined behavior 22 of Annex J24.)

If the misaligned pointer is dereferenced, the program may terminate abnormally. The On some architectures, the cast alone may cause a loss of information , even if the value is not dereferenced . For example, the following code is not guaranteed to work conforming C99 implementations, even though no pointers are dereferenced:if the types involved have differing alignment requirements.

Noncompliant Code Example

In this noncompliant example, the char pointer &c is converted to the more strictly aligned int pointer ip. On some implementations, cp will not match &c. As a result, if a pointer to one object type is converted to a pointer to a different object type, the second object type must not require stricter alignment than the first.

Code Block
bgColor#FFCCCC
langc
#include <assert.h>
 
void func(void) {
  
Code Block

char c = 'x';
  int *ip = (int *)&c; /* thisThis can lose information */
  char *cp = (char *)ip;
assert(cp == &c); 
   /* willWill fail on some conforming implementations */

On some implementations cp will not match &c.

As a result, if a pointer to one object type is converted to a pointer to a different object type, the second object type must not require stricter alignment than the first.

Noncompliant Code Example

  assert(cp == &c);
}

Compliant Solution (Intermediate Object)

In this compliant solution, the char value is stored into an object of type int so that the pointer's value will be properly aligned:

Code Block
bgColor#ccccff
langc
#include <assert.h>
 
void func(void) {
  char c = 'x';
  int i = c;
  int *ip = &i;

  assert(ip == &i);
}

Noncompliant Code Example

The C Standard allows any object pointer to be cast to and from C99 and C90 allow a pointer to be cast into and out of void *. As a result, it is possible to silently convert from one pointer type to another without the compiler diagnosing the problem by storing or casting a pointer to void * and then storing or casting it to the final type. In this noncompliant code example, the type checking system is circumvented due to the caveats of void pointers. loop_function() is passed the char pointer char_ptr but returns an object of type int pointer:

Code Block
bgColor#FFCCCC
langc

char *loop_ptr;
int *int_ptr;

int *loop_function(void *v_pointer) {
  /* ... */
  return v_pointer;
}
 
void func(char *char_ptr) {
  int *int_ptr = loop_function(loopchar_ptr);

  /* ... */
}

This example compiles without warning using GCC 4.8 on Ubuntu Linux 14.04. However, vint_pointer can be aligned on a one-byte boundarymore strictly aligned than an object of type char *.

Compliant Solution

Because the input parameter directly influences the return value, and loop_function() returns an object of type int *, the formal parameter v_pointer is redeclared to accept only accept an object of type int *.:

Code Block
bgColor#ccccff
langc

int *loop_ptr;
int *int_ptr;

int *loop_function(int *v_pointer) {
  /* ... */
  return v_pointer;
}
 
void func(int *loop_ptr) {
  int *int_ptr = loop_function(loop_ptr);

...



  /* ... */
}

Noncompliant Code Example

Many Some architectures require that pointers are correctly aligned when accessing objects bigger larger than a byte. There are, however, many places However, it is common in system code where you receive that unaligned data (for example, the network stacks) that needs to must be copied to a properly aligned memory location, such as in this noncompliant code example.:

Code Block
bgColor#FFCCCC
langc
#include <string.h>
 
struct foo_header {
  int len;
  /* ... */
};
 
void func(char *data;
, size_t offset) {
  struct foo_header *tmp;
  struct foo_header *header;

  tmp = (struct foo_header *)(data + offset);
  memcpy(&header, tmp, sizeof(header));

if (header.len < FOO)
/* ... */
}

Assigning Unfortunately, the behavior is undefined when you assign an unaligned value to a pointer that points to references a type that needs to be aligned is undefined behavior. An implementation may notice, for example, that tmp and header must be aligned , so it could and use an inlined inline memcpy() that uses instructions that assumes assume aligned data.

Compliant Solution

This compliant solution does not avoids the use of the foo_header pointer.:

Code Block
bgColor#ccccff
langc
#include <string.h>
 
struct foo_header {
  int len;
  /* ... */
};
  
void func(char *data;
, size_t offset) {
  struct foo_header header; 

  memcpy(&header, data + offset, sizeof(header));

  /* ... */
}

Exceptions

EXP36-C-EX1: Some hardware architectures have relaxed requirements with regard to pointer alignment. Using a pointer that is not properly aligned is correctly handled by the architecture, although there might be a performance penalty. On such an architecture, improper pointer alignment is permitted but remains an efficiency problem.

The x86 32- and 64-bit architectures usually impose only a performance penalty for violations of this rule, but under some circumstances, noncompliant code can still exhibit undefined behavior. Consider the following program:

Code Block
bgColor#FFCCCC
langc
#include <stdio.h>
#include <stdint.h>

#define READ_UINT16(ptr)       (*(uint16_t *)(ptr))
#define WRITE_UINT16(ptr, val) (*(uint16_t *)(ptr) = (val))

void compute(unsigned char *b1, unsigned char *b2,
             int value, int range) {
  int i;
  for (i = 0; i < range; i++) {
    int newval = (int)READ_UINT16(b1) + value;
    WRITE_UINT16(b2, newval);
    b1 += 2;
    b2 += 2;
  }
}

int main() {
  unsigned char buffer1[1024];
  unsigned char buffer2[1024];
  printf("Compute something\n");
  compute(buffer1 + 3, buffer2 + 1, 42, 500);
  return 0;
}

This code tries to read short ints (which are 16 bits long) from odd pairs in a character array, which violates this rule. On 32- and 64-bit x86 platforms, this program should run to completion without incident. However, the program aborts with a SIGSEGV due to the unaligned reads on a 64-bit platform running Debian Linux, when compiled with GCC 4.9.4 using the flags  -O3   or  -O2 -ftree-loop-vectorize -fvect-cost-model.

If a developer wishes to violate this rule and use undefined behavior, they must not only ensure that the hardware guarantees the behavior of the object code, but they must also ensure that their compiler, along with its optimizer, also respect these guarantees.


EXP36-C-EX2: If a pointer is known to be correctly aligned to the target type, then a cast to that type is permitted. There are several cases where a pointer is known to be correctly aligned to the target type. The pointer could point to an object declared with a suitable alignment specifier. It could point to an object returned by aligned_alloc(), calloc(), malloc(), or realloc(), as per the C standard, section 7.24.3, paragraph 1  [ISO/IEC 9899:2024].

This compliant solution uses the alignment specifier, which is new to C11, to declare the char object c with the same alignment as that of an object of type int. As a result, the two pointers reference equally aligned pointer types:

Code Block
bgColor#ccccff
langc
#include <stdalign.h>
#include <assert.h>
 
void func(void) {
  /* Align c to the alignment of an int */
  alignas(int) char c = 'x';
  int *ip = (int *)&c; 
  char *cp = (char *)ip;
  /* Both cp and &c point to equally aligned objects */
  assert(cp == &c);
}
if (header.len < FOO)
/* ... */

Risk Assessment

Accessing a pointer or an object that is no longer on the correct access boundary can not properly aligned can cause a program to crash or give wrong erroneous information, or it can cause slow pointer accesses (if the architecture allows misaligned accesses).

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

EXP36-C

low

Low

probable

Probable

medium

Medium

P4

L3

Automated Detection

Tool

Version

Checker

Description

Section

LDRA tool suite

Include PageLDRA_VLDRA_V
Section

94 S
540 S

Section

Fully Implemented

Astrée
Include Page
Astrée_V
Astrée_V
pointer-cast-alignmentFully checked
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-EXP36
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

LANG.CAST.PC.OBJ

Cast: Object Pointers

Compass/ROSE

Can detect violations of this rule. However, it does not flag explicit casts to void * and then back to another pointer type

Coverity
Include Page
Coverity_V
Coverity_V

MISRA C 2004 Rule 11.4

MISRA C 2012 Rule 11.1

MISRA C 2012 Rule 11.2

MISRA C 2012 Rule 11.5

MISRA C 2012 Rule 11.7

Implemented
Cppcheck Premium

Include Page
Cppcheck Premium_V
Cppcheck Premium_V

premium-cert-exp36-cPartially implemented

ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

CC2.EXP36

Fully implemented
EDG
section



GCC
Include Page
GCC_V
GCC_V

 

section

Can detect some violations of this rule when the -Wcast-align flag is used

.

Section

EDG Front End to Compass/ROSE

 

 

 

Section

Compass/ROSE

 

 

Section

Can detect violations of this rule. However, it does not flag explicit casts to void * and then back to another pointer type.

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C0326, C3305

C++3033, C++3038


Klocwork
 
Include Page
Klocwork_V
Klocwork_V
MISRA.CAST.OBJ_PTR_TO_OBJ_PTR.2012
LDRA tool suite
Include Page
LDRA_V
LDRA_V

94 S, 606 S

Partially implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V
CERT_C-EXP36-a

Do not cast pointers into more strictly aligned pointer types

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

2445

Partially supported: reports casts directly from a pointer to a less strictly aligned type to a pointer to a more strictly aligned type

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rule EXP36-C

Checks for source buffer misaligned with destination buffer (rule fully covered)

PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V548, V641V1032

RuleChecker

Include Page
RuleChecker_V
RuleChecker_V

pointer-cast-alignmentFully checked
Section

ECLAIR

Include PageECLAIR_VECLAIR_V
Section

castexpr

SectionFully Implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)CERT C++ Secure Coding Standard: EXP36

Taxonomy

Taxonomy item

Relationship

CERT CVOID EXP56-CPP. Do not

...

...

Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772

...

:2013Pointer Casting and Pointer Type Changes [HFC]Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TS 17961Converting pointer values to more strictly aligned pointer types [alignconv]Prior to 2018-01-12: CERT: Unspecified Relationship
MISRA C:2012Rule 11.1 (required)Prior to 2018-01-12: CERT: Unspecified Relationship
MISRA C:2012Rule 11.2 (required)Prior to 2018-01-12: CERT: Unspecified Relationship
MISRA C:2012Rule 11.5 (advisory)Prior to 2018-01-12: CERT: Unspecified Relationship
MISRA C:2012Rule 11.7 (required)Prior to 2018-01-12: CERT: Unspecified Relationship

Bibliography


...

Image Added Image Added Image Added

MISRA Rules 11.2 and 11.3

Bibliography

Walfridsson, Krister. Aliasing, pointer casts and gcc 3.3. August, 2003.
[Bryant 2003]

EXP35-C. Do not access or modify an array in the result of a function call after a subsequent sequence point      03. Expressions (EXP)      EXP37-C. Call functions with the arguments intended by the API