You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 104 Next »

Do not convert a pointer value to a pointer type that is more strictly aligned than the type the value actually points to. Different alignments are possible for different types of objects. If the type-checking system is overridden by an explicit cast or the pointer is converted to a void pointer (void *) and then to a different type, the alignment of an object may be changed.

Subclause 6.3.2.3, paragraph 7, of the C Standard [ISO/IEC 9899:2011] states:

A pointer to an object or incomplete type may be converted to a pointer to a different object or incomplete type. If the resulting pointer is not correctly aligned for the referenced type, the behavior is undefined.

See undefined behavior 25.

If the misaligned pointer is dereferenced, the program may terminate abnormally. On some architectures, the cast alone may cause a loss of information even if the value is not dereferenced if the types involved have differing alignment requirements.

Noncompliant Code Example

In this noncompliant example, the char pointer &c is converted to the more strictly aligned int pointer ip. On some implementations, cp will not match &c. As a result, if a pointer to one object type is converted to a pointer to a different object type, the second object type must not require stricter alignment than the first.

#include <assert.h>
 
void func(void) {
  char c = 'x';
  int *ip = (int *)&c; /* This can lose information */
  char *cp = (char *)ip;

  /* Will fail on some conforming implementations */
  assert(cp == &c);
}

Compliant Solution (Intermediate Object)

In this compliant solution, the char value is stored into an int so that the pointer's value will be properly aligned:

#include <assert.h>
 
void func(void) {
  char c = 'x';
  int i = c;
  int *ip = (int *)&i;

  assert(ip == &i);
}

Compliant Solution (C11, alignas())

This compliant solution uses alignas to align the character c to the alignment of an integer. As a result, the two pointers point to equally aligned pointer types:

#include <stdalign.h>
#include <assert.h>
 
void func(void) {
  /* Align c to the alignment of an int */
  alignas(int) char c = 'x';
  int *ip = (int *)&c; 
  char *cp = (char *)ip;
  /* Both cp and &c point to equally aligned objects */
  assert(cp == &c);
}

Noncompliant Code Example

The C Standard allows a pointer to be cast into and out of void *. As a result, it is possible to silently convert from one pointer type to another without the compiler diagnosing the problem by storing or casting a pointer to void * and then storing or casting it to the final type. In this noncompliant code example, loop_function() is passed the char pointer loop_ptr but returns an int pointer:

int *loop_function(void *v_pointer) {
  /* ... */
  return v_pointer;
}
 
void func(char *loop_ptr) {
  int *int_ptr = loop_function(loop_ptr);

  /* ... */
}

This example compiles without warning. However, v_pointer can be more strictly aligned than an int *.

Compliant Solution

Because the input parameter directly influences the return value, and loop_function() returns an int *, the formal parameter v_pointer is redeclared to accept only int *:

int *loop_function(int *v_pointer) {
  /* ... */
  return v_pointer;
}
 
void func(int *loop_ptr) {
  int *int_ptr = loop_function(loop_ptr);

  /* ... */
}

Another solution is to ensure that loop_ptr points to an object returned by malloc() because this object is guaranteed to be aligned properly for any need. However, this subtlety is easily missed when the program is modified in the future. It is easier and safer to let the type system document the alignment needs.

Noncompliant Code Example

Many architectures require that pointers are correctly aligned when accessing objects larger than a byte. There are, however, many places in system code where you receive unaligned data (for example, the network stacks) that needs to be copied to a properly aligned memory location, such as in this noncompliant code example:

#include <string.h>
 
struct foo_header {
  int len;
  /* ... */
};
 
void func(char *data, size_t offset) {
  struct foo_header *tmp;
  struct foo_header header;

  tmp = data + offset;
  memcpy(&header, tmp, sizeof(header));

  /* ... */
}

Unfortunately, the behavior is undefined when you assign an unaligned value to a pointer that points to a type that needs to be aligned. An implementation may notice, for example, that tmp and header must be aligned, so it could use an inlined memcpy() that uses instructions that assume aligned data.

Compliant Solution

This compliant solution does not use the foo_header pointer:

#include <string.h>
 
struct foo_header {
  int len;
  /* ... */
};
  
void func(char *data, size_t offset) {
  struct foo_header header; 
  memcpy(&header, data + offset, sizeof(header));

  /* ... */
}

Exceptions

EXP36-EX1: Some platforms, notably x86, have relaxed requirements with regard to pointer alignment. Using a pointer that is not properly aligned is correctly handled by the platform, although the platform may impose a performance penalty. On such a platform, improper pointer alignment is permitted, as it is an efficiency problem but not a security problem.

Risk Assessment

Accessing a pointer or an object that is not properly aligned can cause a program to crash or give wrong information, or it can cause slow pointer accesses (if the architecture allows misaligned accesses).

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

EXP36-C

Low

Probable

Medium

P4

L3

Automated Detection

Tool

Version

Checker

Description

Compass/ROSE  

Can detect violations of this rule. However, it does not flag explicit casts to void * and then back to another pointer type

ECLAIR

1.2

CC2.EXP36

Fully implemented
EDG   
GCC4.3.5 

Can detect some violations of this rule when the -Wcast-align flag is used

LDRA tool suite

9.7.1

94 S
540 S

Fully implemented
PRQA QA-C
Unable to render {include} The included page could not be found.
3305Fully implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding StandardEXP36-CPP. Do not convert pointers into more strictly aligned pointer types
ISO/IEC TR 24772:2013Pointer Casting and Pointer Type Changes [HFC]
ISO/IEC TS 17961Converting pointer values to more strictly aligned pointer types [alignconv]
MISRA C:2012Rule 11.1 (required)
Rule 11.2 (required)
Rule 11.5 (advisory)
Rule 11.7 (required)

Bibliography

 


 

  • No labels