Different alignments are possible for different types of objects. If the type-checking system is overridden by an explicit cast or the pointer is converted to a void pointer (void *
) and then to a different type, the alignment of an object may be changed.
According to C99, Section 6.3.2.3, p7
A pointer to an object or incomplete type may be converted to a pointer to a different object or incomplete type. If the resulting pointer is not correctly aligned for the pointed-to type, the behavior is undefined.
(See also undefined behavior 22 of Annex J.)
If the misaligned pointer is dereferenced, the program may terminate abnormally. The cast alone may cause a loss of information, even if the value is not dereferenced. For example, the following code is not guaranteed to work conforming C99 implementations, even though no pointers are dereferenced:
char c = 'x'; int *ip = (int *)&c; /* this can lose information */ char *cp = (char *)ip; assert(cp == &c); /* will fail on some conforming implementations */
On some implementations cp
will not match &c
.
As a result, if a pointer to one object type is converted to a pointer to a different object type, the second object type must not require stricter alignment than the first.
Noncompliant Code Example
C99 and C90 allow a pointer to be cast into and out of void *
. As a result, it is possible to silently convert from one pointer type to another without the compiler diagnosing the problem by storing or casting a pointer to void *
and then storing or casting it to the final type. In this noncompliant code example, the type checking system is circumvented due to the caveats of void
pointers.
char *loop_ptr; int *int_ptr; int *loop_function(void *v_pointer) { /* ... */ return v_pointer; } int_ptr = loop_function(loop_ptr);
This example compiles without warning. However, v_pointer
can be aligned on a one-byte boundary.
Compliant Solution
Because the input parameter directly influences the return value, and loop_function()
returns an int *
, the formal parameter v_pointer
is redeclared to only accept int *
.
int *loop_ptr; int *int_ptr; int *loop_function(int *v_pointer) { /* ... */ return v_pointer; } int_ptr = loop_function(loop_ptr);
Another solution is to ensure that loop_ptr
points to an object returned by malloc()
because this object is guaranteed to be aligned properly for any need. However, this is a subtlety that is easily missed when the program is modified in the future. It is easier and safer to let the type system document the alignment needs.
Noncompliant Code Example
Many architectures require that pointers are correctly aligned when accessing objects bigger than a byte. There are, however, many places in system code where you receive unaligned data (for example, the network stacks) that needs to be copied to a properly aligned memory location, such as in this noncompliant code example.
char *data; struct foo_header *tmp; struct foo_header *header; tmp = data + offset; memcpy(&header, tmp, sizeof(header)); if (header.len < FOO) /* ... */
Unfortunately, the behavior is undefined when you assign an unaligned value to a pointer that points to a type that needs to be aligned. An implementation may notice, for example, that tmp
and header
must be aligned, so it could use an inlined memcpy()
that uses instructions that assumes aligned data.
Compliant Solution
This compliant solution does not use the foo_header
pointer.
char *data; struct foo_header header; memcpy(&header, data + offset, sizeof(header)); if (header.len < FOO) /* ... */
Risk Assessment
Accessing a pointer or an object that is no longer on the correct access boundary can cause a program to crash or give wrong information, or it can cause slow pointer accesses (if the architecture allows misaligned accesses).
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
EXP36-C |
low |
probable |
medium |
P4 |
L3 |
Automated Detection
Tool |
Version |
Checker |
Description |
---|---|---|---|
9.7.1 | 94 S |
Fully Implemented |
|
GCC |
4.3.5 |
|
Can detect some violations of this rule when the |
EDG Front End to Compass/ROSE |
|
|
|
Compass/ROSE |
|
|
Can detect violations of this rule. However, it does not flag explicit casts to |
1.2 | castexpr |
Fully Implemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
CERT C++ Secure Coding Standard: EXP36-CPP. Do not convert pointers into more strictly aligned pointer types
ISO/IEC 9899:1999 Section 6.2.5, "Types"
ISO/IEC TR 24772 "HFC Pointer casting and pointer type changes"
MISRA Rules 11.2 and 11.3
Bibliography
Walfridsson, Krister. Aliasing, pointer casts and gcc 3.3. August, 2003.
[Bryant 2003]