Why -Wsign-conversion compiler warning when using malloc with a struct value? - c

Question

When compiling code accessing a constant from a struct to use in malloc, I get a -Wsign-conversion warning when using gcc -Wconversion sample.c:
sample.c:12:45: warning: implicit conversion changes signedness: 'int' to 'unsigned long' [-Wsign-conversion]
unsigned char *numbers = malloc(s.value * 100 * sizeof(unsigned char));
1 warning generated.
The C code with the warning is this:
#include <stdlib.h>
#include <stdio.h>
typedef struct
{
const int value;
} MyStruct;
int main(int argc, char *argv[])
{
MyStruct s = {5000};
unsigned char *numbers = malloc(s.value * 100 * sizeof(unsigned char));
printf("Address of numbers: %p\n", &numbers);
}
If I don't use a struct, and instead directly provide the value, there is no warning using gcc -Wconversion sample.c:
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char *argv[])
{
unsigned char *numbers = malloc(500 * 100 * sizeof(unsigned char));
printf("Address of numbers: %p\n", &numbers);
}
What is the correct way to use malloc with a struct value when using the -Wconversion flag?

Answer 1

You can change your struct declaration to have a const unsigned int, or just cast into an unsigned int the s.value into the malloc() function, as it requires unsigned arguments (even size_t to be precise).
void *malloc(size_t size);

Answer 2

In this struct
typedef struct
{
const int value;
} MyStruct;
the member value seems to have all words in its declaration wrong
misleading type
misleading name
an odd qualifier (why do you want to have a const-qualified member here?)
Since the "value" is used as a multiplier in call to malloc this would hint that it is not a generic "value" but a size of an array, so perhaps it would better be unsigned - and even size_t altogether; and its name be something like size, length or so.
The warning is because if the value indeed is a signed -1, by multiplying it by 100 you will get -100 but then by multiplying by a sizeof value of type size_t, that would be converted to size_t and as the result the number of bytes allocated would be (SIZE_MAX - 100) * 1 which is hardly what you'd wish for.
Better be explicit and use a declaration that conveys the meaning:
typedef struct
{
size_t size;
} MyStruct;

Answer 3

One problem in the code is that s.value * 100 might overflow INT_MAX, causing undefined behaviour.
gcc continually tweaks exactly which code does and doesn't trigger -Wsign-conversion since it has so many false positives, so you might get different results with different versions.
To fix this you can change to s.value * 100UL (and ditch the sizeof(unsigned char) which is worse than redundant). But think about what would happen if s.valueis very large, you could consider doing a check that the value is not too big (say, underSIZE_MAX/200` at least!) before doing the multiplication.