Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Keith Thompson Newsgroups: comp.lang.c Subject: Re: double free Date: Fri, 15 Jul 2016 13:04:24 -0700 Organization: None to speak of Lines: 79 Message-ID: References: <8760sc2aiz.fsf@bsb.me.uk> <57856cf1.441531@news.xs4all.nl> <9cfaefc2-92a1-4e03-aa6b-d071a0988c87@googlegroups.com> <4gugob9jk24ovphk6kb8l9365pf8fap1nc@4ax.com> <87eg6vqb4y.fsf@bsb.me.uk> <87oa5yq4zz.fsf@bsb.me.uk> <20b352c3-5b7a-4c33-8e80-76e654896af8@googlegroups.com> <29e420f3-061b-4803-bb66-dcad76f9938c@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: mx02.eternal-september.org; posting-host="945944de09706c9b4e29b53c9d2efdc2"; logging-data="7150"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/LvoqSjzzr3QaPj3DLbJ9i" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux) Cancel-Lock: sha1:TYhY6rNkxdM5OYSSba4TNt/0j1o= sha1:W/pf+nRk+jQJxLnpJFiDnbArl5Q= Xref: csiph.com comp.lang.c:90413 supercat@casperkitty.com writes: > On Friday, July 15, 2016 at 2:30:23 PM UTC-5, Keith Thompson wrote: >> supercat writes: >> The standard says enough about array representation to indicate that, >> unless I'm missing something, it should reliably work as you describe. >> >> > In the expression u.a[0][i], to what type does u.a[0] decay? >> >> unsigned char* >> >> > In the expression u.b[i], to what type does u.b decay? >> >> unsigned char* >> >> > It would seem that (union uu*)(u.a[0])->b[i] should be defined for all >> > i in the range 0..99. >> >> Now you're casting an unsigned char* pointer to type `union uu*`. N1570 >> 6.7.2.1 guarantees that >> >> A pointer to a union object, suitably converted, points to each >> of its members (or if a member is a bitfield, then to the unit >> in which it resides), and vice versa. >> >> but that's not *quite* what you're doing here. The pointer value being >> converted is to the 0th element of one of the union's members, not to >> the member itself. I'm not confident that this is defined. On the >> other hand, you're treating objects as arrays of unsigned char, and >> there are some special guarantees for that. Using arrays of int or some >> other non-character type might make the examples clearer. > > Even with non-character types, the address of an array is the address of > its first element, is it not? No, they're of different types. They should yield the same value when suitable converted to the same pointer type (I don't have the chapter and verse that guarantees that). >> > I'm unclear, however, which of the following >> > lines would not be equivalent to the previous one. >> > >> > (union uu*)(u.a[0])->b[i] >> > ( (unsigned char*)(union uu*)(u.a[0]) )[i] >> > ( (unsigned char*)(u.a[0]) )[i] >> > ( (u.a[0]) )[i] >> > >> > Since the first is defined for i=0..99 and the last only for i=0..9, it >> > would seem there must be some difference; I think the most logical >> > explanation for the difference would be that while a[0] nominally decays >> > to a some kind of character pointer, it won't be usable as a full-fledged >> > "unsigned char*" unless one performs some kind of cast upon it. >> >> I'm not sure what a "full-fledged unsigned char*" is supposed to be. > > The expression u.a[0][i] is defined for a smaller range of types than > u.b[i]; that would seem to imply that there is something different from > u.a[0] and u.b, but I'm not clear what kinds of pointer expressions a > compiler could treat like the former, and what kinds of pointer expressions > a compiler could treat like the latter. Do you mean a smaller range of *values*? Here's the relevent code again: union uu { unsigned char a[10][10]; unsigned char b[100]; } u; The difference is that `u.a[0]` is of type `unsigned char[10]`, and `u.b` is of type `unsigned char[100]`. Both decay to `unsigned char*`, but the range of integer values you can add to that pointer value differs, for reasons explained in N1570 6.5.6p8. -- Keith Thompson (The_Other_Keith) kst-u@mib.org Working, but not speaking, for JetHead Development, Inc. "We must do something. This is something. Therefore, we must do this." -- Antony Jay and Jonathan Lynn, "Yes Minister"