Page History

When two pointers are subtracted, both must point to elements of the same array object , or just one past the last element of the array object (C Standard, 6.5.7 [ISO/IEC 9899:2024]); the result is the difference of the subscripts of the two array elements. This restriction exists because pointer subtraction in C produces the number of objects between the two pointers, not the number of bytes.Similarly comparing pointers can tell you the relative positions of the pointers in term of Otherwise, the operation is undefined behavior. (See undefined behavior 45.)

Similarly, comparing pointers using the relational operators <, <=, >=, and > gives the positions of the pointers relative to each other. Subtracting or comparing pointers

...

that do not refer to the same array

...

is undefined behavior. (See undefined behavior 45 and undefined behavior 50.

...

)

Comparing pointers using the equality operators == and != has well-defined semantics regardless of whether or not either of the pointers is null, points into the same object, or points one past the last element of an array object or function.

Noncompliant Code Example

In this noncompliant code example, pointer subtraction is used to determine how many free elements are left in the nums array:

...

#include <stddef.h>
 
enum { SIZE = 32 };
 
void func(void) {
  int nums[SIZE];
char *strings[SIZE]  int end;
  int *next_num_ptr = nums;
int  size_t free_byteselements;

  /*perform operations onIncrement next_num_ptr as array fills */

  free_byteselements = strings &end - next_num_ptr;

In this non-compliant code example pointer subtraction is used to determine how many free elements are left in the nums array. The first incorrect assumption is that nums and strings arrays will be next to each other in memory. The second is that free_bytes will be the number of bytes available. The subtraction will return the number of elements between next_num_ptr and strings.

}

This program incorrectly assumes that the nums array is adjacent to the end variable in memory. A compiler is permitted to insert padding bits between these two variables or even reorder them in memory.

Compliant Solution

In this compliant solution, the number of free elements is computed by subtracting next_num_ptr from the address of the pointer past the nums array. While this pointer may not be dereferenced, it may be used in pointer arithmetic.

...

#include <stddef.h>
enum { SIZE = 32 };
 
void func(void) {
  int nums
nt nums[SIZE];
char *strings[SIZE];
  int *next_num_ptr = nums;
int  size_t free_elements =SIZE;

  /*perform operationsIncrement on next_num_ptr as array fills */

  decrement free_elements as it fills */
= &(nums[SIZE]) - next_num_ptr;
}

Exceptions

ARR36-C-EX1: Comparing two pointers to distinct members of the same struct object is allowed. Pointers to structure members declared later in the structure compare greater-than pointers to members declared earlier in the structure.In the compliant solution, the number of free elements is kept as a counter and adjusted on every array operation. It is also calculated in terms of free elements instead if bytes. This prevents further mathematical errors.

Risk Assessment

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Banahan 03|AA. C References#Banahan 03]\] [Section 5.3, "Pointers,"|http://publications.gbdirect.co.uk/c_book/chapter5/pointers.html] and [Section 5.7, "Expressions involving pointers"|http://publications.gbdirect.co.uk/c_book/chapter5/pointer_expressions.html]
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.5.6, "Additive operators"

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-469 and ARR36-C

CWE-469 = Subset(ARR36-C)

ARR36-C = Union(CWE-469, list) where list =

• Pointer comparisons using the relational operators <, <=, >=, and >, where the pointers do not refer to the same array

Bibliography

...

Image Added Image Added ARR35-C. Do not allow loops to iterate beyond the end of an array      06. Arrays (ARR)       Image Modified