public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "aklauer at rumms dot uni-mannheim.de" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug c/45779] New: pointer difference error/ptrdiff_t representability Date: Fri, 24 Sep 2010 16:06:00 -0000 [thread overview] Message-ID: <bug-45779-4@http.gcc.gnu.org/bugzilla/> (raw) http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45779 Summary: pointer difference error/ptrdiff_t representability Product: gcc Version: 4.6.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c AssignedTo: unassigned@gcc.gnu.org ReportedBy: aklauer@rumms.uni-mannheim.de Note: initially found on gcc 4.3.2, confirmed on 4.6.0 20100924 from svn. Consider the following program: <code> /* test.c */ #include<assert.h> #include<inttypes.h> #include<stddef.h> #include<stdio.h> #include<stdlib.h> int main(int argc, char ** argv) { printf("ptrdiff_t max: %ju, size_t max: %ju\n", (uintmax_t) PTRDIFF_MAX, (uintmax_t) SIZE_MAX); assert (argc > 1); size_t size = atoll(argv[1]); printf("requested array size: %zu\n", size); assert (size > 0); uint16_t * array = malloc(size * sizeof(*array)); assert (array != NULL); printf("array one-past-end/start difference: %td\n", &array[size] - &array[0]); } </code> $ gcc -std=c99 -pedantic -Wall -Wextra test.c $ ./a.out 1200000000 ptrdiff_t max: 2147483647, size_t max: 4294967295 requested array size: 1200000000 array one-past-end/start difference: -947483648 The output "-947483648" violates the C99 standard, it should be "1200000000". This program was compiled and run on an IA-32 host with 2.5 GiB memory. The pointer returned by the successful call to malloc() points to an array of 1200000000 uint16_t's. In the present case, the number 1200000000 is smaller than PTRDIFF_MAX and thus representable by the ptrdiff_t type. Hence, by the C99 standard, 6.5.6p9, the expression &array[size] - &array[0] above is defined to have type ptrdiff_t and value 1200000000. Note that if one replaced uint16_t with char in the above code and called the program with argument 2400000000 (a number larger than PTRDIFF_MAX), the behaviour would be undefined. Therefore I suspect that, internally, gcc first calculates the value of &array[size] - &array[0] as if array had type pointer-to-char and then erroneously interprets the result as a negative 32-bit 2's complement signed integer, which it then divides by 2 (that is, sizeof(uint16_t)) with a signed integer division. Best regards, Alexander -- Configure bugmail: http://gcc.gnu.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
next reply other threads:[~2010-09-24 15:42 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2010-09-24 16:06 aklauer at rumms dot uni-mannheim.de [this message] 2010-09-27 18:27 ` [Bug c/45779] " aklauer at rumms dot uni-mannheim.de 2015-02-20 8:29 ` pinskia at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-45779-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).