MEM57-CPP. Avoid using default operator new for over-aligned types

The non-placement new expression is specified to invoke an allocation function to allocate storage for an object of the specified type.  When successful, the allocation function, in turn, is required to return a pointer to storage with alignment suitable for any object with a fundamental alignment requirement.  Although the global operator new, the default allocation function invoked by the new expression, is specified by the C++ standard [ISO/IEC 14882-2014] to allocate sufficient storage suitably aligned to represent any object of the specified size, since the expected alignment isn't part of the function's interface, the most a program can safely assume is that the storage allocated by the default operator new defined by the implementation is aligned for an object with a fundamental alignment.  In particular, it is unsafe to use the storage for an object of a type with a stricter alignment requirement – an over-aligned type.

Avoid relying on the default operator new to obtain storage for objects of over-aligned types.  Doing so may result in an object being constructed at a misaligned location, which has undefined behavior and can result in abnormal termination when the object is accessed even on architectures otherwise known to tolerate misaligned accesses.

Noncompliant Code Example

In the following noncompliant code example, the new expression is used to invoke the default operator new to obtain storage in which to then construct an object of the user-defined type Vector with alignment that exceeds the fundamental alignment of most implementations (typically 16 bytes).  Objects of such over-aligned types are typically required by SIMD vectorization instructions which can trap when passed unsuitably aligned arguments.

struct alignas (32) Vector { char elems [32]; };

Vector* f() {
  Vector *pv = new Vector ();
  return pv;
}

Compliant Solution (aligned_alloc)

In this compliant solution, an overloaded operator new function is defined to obtain appropriately aligned storage by calling the C11 function aligned_alloc.  Programs that make use of the array form of the new expression must define the corresponding member array operator new[] and operator delete[].  The aligned_alloc function is not part of the C++ 98, C++ 11, or C++ 14 standards but may be provided by implementations of such standards as an extension.  Programs targeting C++ implementations that do not provide the C11 aligned_alloc function must define the member operator new to adjust the alignment of the storage obtained by the allocation function of their choice, either the default global operator new or malloc.

#include <new>
#include <stdlib.h>

struct alignas (32) Vector {
  char elems [32];
  static void* operator new (size_t);
  static void operator delete (void *p) {
    free (p);
  }
};

void* Vector::operator new (size_t nbytes) {
  if (void *p = aligned_alloc (32, nbytes))
    return p;
  throw std::bad_alloc ();
}

Vector* f() {
  Vector *pv = new Vector ();
  return pv;
}

Risk Assessment

Using improperly aligned pointers results in undefined behavior, typically leading to abnormal termination.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

[N3396] Dynamic memory allocation for over-aligned data, WG14 proposal, Clark Nelson