Page History

When two pointers are subtracted, both must point to elements of the same array object or just one past the last element of the array object (C Standard, subclause 6.5.6 7 [ISO/IEC 9899:20112024]); the result is the difference of the subscripts of the two array elements. Otherwise, the operation is undefined behavior. (see See undefined behavior 4845.).

Similarly, comparing pointers using the relational operators <, <=, >=, and > gives the positions of the pointers relative to each other. Subtracting or comparing pointers that do not refer to the same array is undefined behavior. (see See undefined behavior 4845 and undefined behavior 5350.).

Comparing pointers using the equality operators == and != has well-defined semantics regardless of whether or not either of the pointers is null, points into the same object, or points one past the last element of an array object or function.

...

This program incorrectly assumes that the nums array is adjacent to the end variable in memory. A compiler is permitted to insert padding bits between these two variables , or even reorder them in memory.

...

#include <stddef.h>
enum { SIZE = 32 };
 
void func(void) {
  int nums[SIZE];
  int *next_num_ptr = nums;
  size_t free_elements;

  /* Increment next_num_ptr as array fills */

  free_elements = &(nums[SIZE]) - next_num_ptr;
}

Exceptions

ARR36-C-EX1: Comparing two pointers to distinct members of the same struct object is allowed. Pointers to structure members declared later in the structure compare greater-than pointers to members declared earlier in the structure.

Risk Assessment

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-469 and ARR36-C

CWE-469 = Subset(ARR36-C)

ARR36-C = Union(CWE-469, list) where list =

• Pointer comparisons using the relational operators <, <=, >=, and >, where the pointers do not refer to the same array

Bibliography

...

...

Image Modified Image Modified Image Modified