Can the following code be true for pointers to different things

by

It is still possible for an allocation to generate a pointer that satisfies the condition despite the pointer not pointing into the region. This will happen, for example, on an 80286 in protected mode, which is used by Windows 3.x in Standard mode and OS/2 1.x.

In this system, pointers are 32-bit values, split into two 16-bit parts, traditionally written as XXXX:YYYY. The first 16-bit part (XXXX) is the “selector”, which chooses a bank of 64KB. The second 16-bit part (YYYY) is the “offset”, which chooses a byte within that 64KB bank. (It’s more complicated than this, but let’s just leave it at that for the purpose of this discussion.)

Memory blocks larger than 64KB are broken up into 64KB chunks. To move from one chunk to the next, you add 8 to the selector. For example, the byte after 0101:FFFF is 0109:0000.

But why do you add 8 to move to the next selector? Why not just increment the selector? Because the bottom three bits of the selector are used for other things.

In particular, the bottom bit of the selector is used to choose the selector table. (Let’s ignore bits 1 and 2 since they are not relevant to the discussion. Assume for convenience that they are always zero.)

There are two selector tables, the Global Selector Table (for memory shared across all processes) and the Local Selector Table (for memory private to a single process). Therefore, the selectors available for process private memory are 0001, 0009, 0011, 0019, etc. Meanwhile, the selectors available for global memory are 0008, 0010, 0018, 0020, etc. (Selector 0000 is reserved.)

Okay, now we can set up our counter-example. Suppose guardArea = 0101:0000 and guardSize = 0x00020000. This means that the guarded addresses are 0101:0000 through 0101:FFFF and 0109:0000 through 0109:FFFF. Furthermore, guardArea + guardSize = 0111:0000.

Meanwhile, suppose there is some global memory that happens to be allocated at 0108:0000. This is a global memory allocation because the selector is an even number.

Observe that the global memory allocation is not part of the guarded region, but its pointer value does satisfy the numeric inequality 0101:0000 <= 0108:0000 < 0111:0000.

Bonus chatter: Even on CPU architectures with a flat memory model, the test can fail. Modern compilers take advantage of undefined behavior and optimize accordingly. If they see a relational comparison between pointers, they are permitted to assume that the pointers point into the same array (or one past the last element of that array). Specifically, the only pointers that can legally be compared with guardArea are the ones of the form guardArea, guardArea+1, guardArea+2, …, guardArea + guardSize. For all of these pointers, the condition ptr >= guardArea is true and can therefore be optimized out, reducing your test to

if (ptr < (guardArea + guardSize))

which will now be satisfied for pointers that are numerically less than guardArea.

Moral of the story: This code is not safe, not even on flat architectures.

But all is not lost: The pointer-to-integer conversion is implementation-defined, which means that your implementation must document how it works. If your implementation defines the pointer-to-integer conversion as producing the numeric value of the pointer, and you know that you are on a flat architecture, then what you can do is compare integers rather than pointers. Integer comparisons are not constrained in the same way that pointer comparisons are.

if ((uintptr_t)ptr >= (uintptr_t)guardArea &&
    (uintptr_t)ptr < (uintptr_t)guardArea + (uintptr_t)guardSize)

More Related Contents:

  1. Can an equality comparison of unrelated pointers evaluate to true?
  2. When is it valid to access a pointer to a “dead” object?
  3. Pointers program
  4. Are there differences between pointers to object stored on stack and heap? [closed]
  5. What is the difference between char * const and const char *?
  6. In C, are arrays pointers or used as pointers?
  7. Are all data pointers the same size in one platform for all data types? [duplicate]
  8. Why can’t I convert ‘char**’ to a ‘const char* const*’ in C?
  9. C function pointer casting to void pointer
  10. Difference between char *str=”STRING” and char str[] = “STRING”?
  11. How to printf a memory address in C
  12. What is the difference between far pointers and near pointers?
  13. Why can I change a local const variable through pointer casts but not a global one in C?
  14. Pointer Arithmetic: ++*ptr or *ptr++?
  15. Is argv[n] writable?
  16. Is the compiler allowed to recycle freed pointer variables?
  17. Can a pointer (address) ever be negative?
  18. In C, why can’t an integer value be assigned to an int* the same way a string value can be assigned to a char*?
  19. Pointer interconvertibility vs having the same address
  20. constness and pointers to pointers
  21. When is an array name or a function name ‘converted’ into a pointer ? (in C)
  22. Why can’t I treat an array like a pointer in C?
  23. Why “initializer element is not a constant” is… not working anymore?
  24. Are pointer variables just integers with some operators or are they “symbolic”?
  25. Pointer initialisation gives segmentation fault
  26. How to calculate size of array from pointer variable?
  27. Difference between dereferencing pointer and accessing array elements
  28. Pointer comparisons in C. Are they signed or unsigned?
  29. In C, is it good form to use typedef for a pointer?
  30. What is the function of an asterisk before a function name?

Leave a Comment