target

integration into IS ISO/IEC 9899:202y

document history

license

CC BY, see https://creativecommons.org/licenses/by/4.0

1 Motivation

The recent campaign for slaying daemons has revealed that in fact some of the undefined behavior (UB) in the current C standard doesn’t even exist: some of the situations in J.2 that would in principle result in UB cannot trigger at all. The reason for these are misformulations in the normative text that seem to indicate UB where in fact there only are constraint violations or unspecified behavior.

We say that a semantic non-constraint requirement is a ghost-UB if no conforming program in any execution may ever violate it.

The present paper deals with ghost-UB that would be the result of accessing the bytes of uninitialized allocations.

The deal here is that in the current text aligned_alloc and malloc seem to have different requirements than realloc. For the first two it is stated that

• … the representation is indeterminate

and for the latter it says

• Any bytes in the new object beyond the size of the old object have unspecified values.

Since the current draft now clearly describes that allocations provide byte arrays, the first formulation is simply misleading.

• First, a byte array has no “representation”, representation are defined for types (see 6.2.6, Representation of types) and an allocations have no type.

• Second, an allocation is composed of bytes as its only structure. Bytes have a character type and by definition these have no non-value representations. So for a byte, an indeterminate representation is necessarily an unspecified value.

2 Approach

We propose to simply synchronize the text of the three allocation functions such that they only refer to “bytes with unspecified values”.

Then it is clear that the UBs currently listed as J.2 (170) and (171) may never trigger. The access to an allocated object can only violate a requirement if it implies an lvalue conversion of some type and if the bytes form a non-value representation of that type. This is already captured by list item J.2 (12).

No normative change is intended by this paper.

3 Suggested Wording

New text is underlined green, removed text is stroke-out red.

3.1 In clause 7.25.4, Memory management functions

3.1.1 In clause 7.25.4.2, aligned_alloc

change p2 as follows

2 The aligned_alloc function allocates space for an object whose alignment is specified by alignment,³⁵³⁾ whose size is specified by size, and whose representation is indeterminate bytes have unspecified values. If the value of alignment is not a valid alignment supported by the implementation the function shall fail by returning a null pointer.

3.1.2 In clause 7.25.4.7, malloc

change p2 as follows

The malloc function allocates space for an object whose size is specified by size and whose representation is indeterminate bytes have unspecified values.

3.2 In clause J.1

Add two new items for unspecified behavior

(44′) The values of any bytes in an object allocated by the aligned_alloc or the malloc functions (7.25.4.2 and 7.25.4.7).

(44′′) The values of any bytes in a new object allocated by the realloc function beyond the size of the old object (7.25.4.8).

3.3 In clause J.2

remove the following two ghost-UBs

(170​) The value of the object allocated by the malloc function is used (7.25.4.7).

(171​) The values of any bytes in a new object allocated by the realloc function beyond the size of the old object are used (7.25.4.8).

4 Note to the editors and other interested parties

There is a branch on WG14’s gitlab that reflects the proposed changes:

https://gitlab.gwdg.de/iso-c/draft/-/tree/allocated

Aknowledments

Thanks to Martin Uecker for review and discussions.