指针转换为整数或者 整数转换为指针
int36-c. converting a pointer to integer or integer to pointer
skip to end of metadata
created by sditmore, last modified by jill britton on aug 04, 2014
go to start of metadata
although programmers often use integers and pointers interchangeably in c, pointer-to-integer and integer-to-pointer conversions are implementation-defined.
conversions between integers and pointers can have undesired consequences depending on theimplementation. according to the c standard, subclause 6.3.2.3 [iso/iec 9899:2011],
an integer may be converted to any pointer type. except as previously specified, the result is implementation-defined, might not be correctly aligned, might not point to an entity of the referenced type, and might be a trap representation.
any pointer type may be converted to an integer type. except as previously specified, the result is implementation-defined. if the result cannot be represented in the integer type, the behavior is undefined. the result need not be in the range of values of any integer type.
do not convert an integer type to a pointer type if the resulting pointer is incorrectly aligned, does not point to an entity of the referenced type, or is a trap representation.
do not convert a pointer type to an integer type if the result cannot be represented in the integer type (seeundefined behavior 24).
the mapping between pointers and integers must be consistent with the addressing structure of the execution environment. issues may arise, for example, on architectures that have a segmented memory model.
noncompliant code example
the size of a pointer can be greater than the size of an integer, such as in an implementation where pointers are 64 bits and unsigned integers are 32 bits. this code example is noncompliant on such implementations because the result of converting the 64-bit ptr cannot be represented in the 32-bit integer type:
void f(void) {
char *ptr;
/* … */
unsigned int number = (unsigned int)ptr;
/* … */
}
compliant solution
any valid pointer to void can be converted to intptr_t or uintptr_t and back with no change in value (seeint36-ex2). the c standard guarantees that a pointer to void may be converted to or from a pointer to any object type and back again and that the result must compare equal to the original pointer. consequently, converting directly from a char * pointer to a uintptr_t, as in this compliant solution, is allowed on implementations that support the uintptr_t type.
#include
void f(void) {
char *ptr;
/* … */
uintptr_t number = (uintptr_t)ptr;
/* … */
}
noncompliant code example
in this noncompliant code example, the pointer ptr is converted to an integer value. the high-order 9 bits of the number are used to hold a flag value, and the result is converted back into a pointer. this example is noncompliant on an implementation where pointers are 64 bits and unsigned integers are 32 bits because the result of converting the 64-bit ptr cannot be represented in the 32-bit integer type.
void func(unsigned int flag) {
char *ptr;
/* … */
unsigned int number = (unsigned int)ptr;
number = (number & 0x7fffff) | (flag << 23);
ptr = (char *)number;
}
a similar scheme was used in early versions of emacs, limiting its portability and preventing the ability to edit files larger than 8mb.
compliant solution
this compliant solution uses a struct to provide storage for both the pointer and the flag value. this solution is portable to machines of different word sizes, both smaller and larger than 32 bits, working even when pointers cannot be represented in any integer type.
struct ptrflag {
char *pointer;
unsigned int flag : 9;
} ptrflag;
void func(unsigned int flag) {
char *ptr;
/* … */
ptrflag.pointer = ptr;
ptrflag.flag = flag;
}
noncompliant code example
it is sometimes necessary to access memory at a specific location, requiring a literal integer to pointer conversion. in this noncompliant code, a pointer is set directly to an integer constant, where it is unknown whether the result will be as intended:
unsigned int *g(void) {
unsigned int *ptr = 0xdeadbeef;
/* … */
return ptr;
}
the result of this assignment is implementation-defined, might not be correctly aligned, might not point to an entity of the referenced type, and might be a trap representation.
compliant solution
adding an explicit cast may help the compiler convert the integer value into a valid pointer. a common technique is to assign the integer to a volatile-qualified object of type intptr_t or uintptr_t and then assign the integer value to the pointer:
unsigned int *g(void) {
volatile uintptr_t iptr = 0xdeadbeef;
unsigned int *ptr = (unsigned int *)iptr;
/* … */
return ptr;
}
exceptions
int36-ex1: a null pointer can be converted to an integer; it takes on the value 0. likewise, the integer value 0 can be converted to a pointer; it becomes the null pointer.
int36-ex2: any valid pointer to void can be converted to intptr_t or uintptr_t or their underlying types and back again with no change in value. use of underlying types instead of intptr_t or uintptr_t is discouraged, however, because it limits portability.
#include
#include
void h(void) {
intptr_t i = (intptr_t)(void *)&i;
uintptr_t j = (uintptr_t)(void *)&j;
void *ip = (void *)i;
void *jp = (void *)j;
assert(ip == &i);
assert(jp == &j);
}
risk assessment
converting from pointer to integer or vice versa results in code that is not portable and may create unexpected pointers to invalid memory locations.
rule
severity
likelihood
remediation cost
priority
level
int36-c
low
probable
high
p2
l3
automated detection
tool
version
checker
description
compass/rose
coverity 6.5 pointer_conversion_loses_bits fully implemented
ldra tool suite
8.5.4
94 s
fully implemented
prqa qa-c v8.2 305, 306, 309, 674 partially implemented
related vulnerabilities
search for vulnerabilities resulting from the violation of this rule on the cert website.
related guidelines
cert c++ coding standard int11-cpp. take care when converting from pointer to integer or integer to pointer
iso/iec tr 24772:2013 pointer casting and pointer type changes [hfc]
iso/iec ts 17961:2013 converting a pointer to integer or integer to pointer [intptrconv]
mitre cwe cwe-466, return of pointer value outside of expected range
cwe-587, assignment of a fixed address to a pointer
bibliography
[iso/iec 9899:2011] 6.3.2.3, "pointers"
本文来自网络收集,不代表计算机技术网立场,如涉及侵权请联系管理员删除。
ctvol管理联系方式QQ:251552304
本文章地址:https://www.ctvol.com/c-cdevelopment/608018.html