[PATCH] D32199: [TBAASan] A TBAA Sanitizer (Clang)

[Krzysztof Parzyszek via cfe-commits]

On 5/1/2017 6:17 PM, Hal Finkel wrote:
> However, the example can also be written as:
> 
>        struct X { int a, b; };
>        X x { 50, 100 };
>        X *o = (X*) &x.b;
> 
>        int a_is_b = o->a; // This is UB (or so we say)?
> 
> and then the pointer arithmetic considerations don't seem to apply.

I know what you mean. There is a statement somewhere that makes this 
illegal, but it's really hard to find this kind of information in the 
standards so I'm not sure I can find any definite proof in a finite time...

There is this paragraph that may give some clue (pointer to a struct 
points to the first element):

6.7.2.1 Structure and union specifiers

13 Within a structure object, the non-bit-field members and the units in 
which bit-fields reside have addresses that increase in the order in 
which they are declared. A pointer to a structure object, suitably 
converted, points to its initial member (or if that member is a 
bit-field, then to the unit in which it resides), and vice versa. There 
may be unnamed padding within a structure object, but not at its beginning.


There are also some other relevant sections:


6.2.7 Compatible type and composite type

2 All declarations that refer to the same object or function shall have 
compatible type; otherwise, the behavior is undefined.


6.5 Expressions

7 An object shall have its stored value accessed only by an lvalue 
expression that has one of the following types:73)
— a type compatible with the effective type of the object,
— a qualified version of a type compatible with the effective type of 
the object,
— a type that is the signed or unsigned type corresponding to the 
effective type of the object,
— a type that is the signed or unsigned type corresponding to a 
qualified version of the effective type of the object,
— an aggregate or union type that includes one of the aforementioned 
types among its members (including, recursively, a member of a 
subaggregate or contained union), or
— a character type.

73) The intent of this list is to specify those circumstances in which 
an object may or may not be aliased.


-Krzysztof

-- 
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, 
hosted by The Linux Foundation