Subtraction or comparison between pointers to different arrays

Subtraction or comparison between pointers causes undefined behavior

Description

This defect occurs when you subtract or compare pointers that are null or that point to elements in different arrays. The relational operators for the comparison are >, <, >=, and <=.

Risk

When you subtract two pointers to elements in the same array, the result is the difference between the subscripts of the two array elements. Similarly, when you compare two pointers to array elements, the result is the positions of the pointers relative to each other. If the pointers are null or point to different arrays, a subtraction or comparison operation is undefined. If you use the subtraction result as a buffer index, it can cause a buffer overflow.

Fix

Before you subtract or use relational operators to compare pointers to array elements, check that they are non-null and that they point to the same array.

Examples

expand all

Subtraction Between Pointers to Elements in Different Arrays

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define SIZE20 20

size_t func(void)
{
    int nums[SIZE20];
    int end;
    int *next_num_ptr = nums;
    size_t free_elements;
	/* Increment next_num_ptr as array fills */
	
	/* Subtraction operation is undefined unless array nums 
	is adjacent to variable end in memory. */
    free_elements = &end - next_num_ptr; 
    return free_elements;
}

In this example, the array nums is incrementally filled. Pointer subtraction is then used to determine how many free elements remain. Unless end points to a memory location one past the last element of nums, the subtraction operation is undefined.

Correction — Subtract Pointers to the Same Array

Subtract the pointer to the last element that was filled from the pointer to the last element in the array.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define SIZE20 20

size_t func(void)
{
    int nums[SIZE20];
    int *next_num_ptr = nums;
    size_t free_elements;
	/* Increment next_num_ptr as array fills */
	
	/* Subtraction operation involves pointers to the same array. */
    free_elements = &(nums[SIZE20 - 1]) - next_num_ptr;  
	
    return free_elements + 1;
}

Result Information

Group: Static memory

Language: C | C++

Default: On for handwritten code, off for generated code

Command-Line Syntax: PTR_TO_DIFF_ARRAY

Impact: High

Version History

Introduced in R2017b

expand all

R2023a: Pointer subtraction or comparison involving outputs of stubbed function no longer ignored

Polyspace^® reports this defect even if you use the output of a stubbed function to perform a pointer subtraction or pointer comparison operation. For instance, in this code, the pointer ptr is returned by the function get_ptr():

int32_t *ptr = get_ptr ( );
int32_t a1[ 10 ];
int32_t *p1 = &a1[ 1 ];
diff = ptr - p1;   //Defect

Because the function get_ptr() lacks a body, Polyspace treats it as a stubbed function. Polyspace no longer ignores pointer arithmetic operations when one of the operands is the output of the stubbed function. In this case, because get_ptr() is called before p1 is declared, the pointers ptr and p1 cannot point to the same array. Polyspace reports a defect.