How to determine if a pointer equals an element of an array? - c

Question

I have code in Code Reveiw that "works" as expected, yet may have UB
.
Code has an array of same-sized char arrays called GP2_format[]. To detect if the pointer format has the same value as the address of one of the elements GP2_format[][0], the below code simple tested if the pointer was >= the smallest element and <= the greatest. As the elements are size 1, no further checking needed.
const char GP2_format[GP2_format_N + 1][1];
const char *format = ...;
if (format >= GP2_format[0] && format <= GP2_format[GP2_format_N]) Inside()
else Outside();
C11 §6.5.8/5 Relational operators < > <= >= appears to define this as the dreaded Undefined Behavior when comparing a pointer from outside the array.
When two pointers are compared, the result depends on the relative locations in the address space of the objects pointed to. If two pointers to object types both point to the
same object, ... of the same array object, they compare equal. ...(same object OK) .... (same union OK) .... (same array OK) ... In all other cases, the behavior is undefined.
Q1 Is code's pointer compare in GP2_get_type() UB?
Q2 If so, what is a well defined alternate, search O(1), to the questionable GP2_get_type()?
Slower solutions
Code could sequentially test format against each GP2_format[] or convert the values to intptr_t, sort one time and do a O(ln2(n)) search.
Similar
...if a pointer is part of a set, but this "set" is not random, it is an array.
intptr_t approach - maybe UB.
#include <stdio.h>
typedef enum {
GP2_set_precision,
GP2_set_w,
GP2_setios_flags_,
GP2_string_,
GP2_unknown_,
GP2_format_N
} GP2_type;
const char GP2_format[GP2_format_N + 1][1];
static int GP2_get_type(const char *format) {
// candidate UB with pointer compare
if (format >= GP2_format[0] && format <= GP2_format[GP2_format_N]) {
return (int) (format - GP2_format[0]);
}
return GP2_format_N;
}
int main(void) {
printf("%d\n", GP2_get_type(GP2_format[1]));
printf("%d\n", GP2_get_type("Hello World")); // potential UB
return 0;
}
Output (as expected, yet potentially UB)
1
5

Answer 1

If you want to comply with the C Standard then your options are:
Perform individual == or != tests against each pointer in the target range
You could use a hash table or search tree or something to speed this up, if it is a very large set
Redesign your code to not require this check.
A "probably works" method would be to cast all of the values to uintptr_t and then do relational comparison. If the system has a memory model with absolute ordering then it should define uintptr_t and preserve that ordering; and if it doesn't have such a model then the relational compare idea never would have worked anyway.

Answer 2

This is not an answer to the stated question, but an answer to the underlying problem.
Unless I am mistaken, the entire problem can be avoided by making GP_format a string. This way the problem simplifies to checking whether a pointer points to within a known string, and that is not UB. (If it is, then using strchr() to find a character and compute its index in the string would be UB, which would be completely silly. That would be a serious bug in the standard, in my opinion. Then again, I'm not a language lawyer, just a programmer that tries to write robust, portable C. Fortunately, the standard states it's written to help people like me, and not compiler writers who want to avoid doing hard work by generating garbage whenever a technicality in the standard lets them.)
Here is a full example of the approach I had in mind. This also compiles with clang-3.5, since the newest GCC I have on the machine I'm currently using is version 4.8.4, which has no _Generic() support. If you use a different version of clang, or gcc, change the first line in the Makefile accordingly, or run e.g. make CC=gcc.
First, Makefile:
CC := clang-3.5
CFLAGS := -Wall -Wextra -std=c11 -O2
LD := $(CC)
LDFLAGS :=
PROGS := example
.PHONY: all clean
all: clean $(PROGS)
clean:
rm -f *.o $(PROGS)
%.o: %.c
$(CC) $(CFLAGS) -c $^
example: out.o main.o
$(LD) $^ $(LDFLAGS) -o $#
Next, out.h:
#ifndef OUT_H
#define OUT_H 1
#include <stdio.h>
typedef enum {
out_char,
out_int,
out_double,
out_FILE,
out_set_fixed,
out_set_width,
out_set_decimals,
out_count
} out_type;
extern const char out_formats[out_count + 1];
extern int outf(FILE *, ...);
#define out(x...) outf(stdout, x)
#define err(x...) outf(stderr, x)
#define OUT(x) _Generic( (x), \
FILE *: out_formats + out_FILE, \
double: out_formats + out_double, \
int: out_formats + out_int, \
char: out_formats + out_char ), (x)
#define OUT_END ((const char *)0)
#define OUT_EOL "\n", ((const char *)0)
#define OUT_fixed(x) (out_formats + out_set_fixed), ((int)(x))
#define OUT_width(x) (out_formats + out_set_width), ((int)(x))
#define OUT_decimals(x) (out_formats + out_set_decimals), ((int)(x))
#endif /* OUT_H */
Note that the above OUT() macro expands to two subexpressions separated by a comma. The first subexpression uses _Generic() to emit a pointer within out_formats based on the type of the macro argument. The second subexpression is the macro argument itself.
Having the first argument to the outf() function be a fixed one (the initial stream to use) simplifies the function implementation quite a bit.
Next, out.c:
#include <stdlib.h>
#include <stdarg.h>
#include <stdio.h>
#include <errno.h>
#include "out.h"
/* out_formats is a string consisting of ASCII NULs,
* i.e. an array of zero chars.
* We only check if a char pointer points to within out_formats,
* if it points to a zero char; otherwise, it's just a normal
* string we print as-is.
*/
const char out_formats[out_count + 1] = { 0 };
int outf(FILE *out, ...)
{
va_list args;
int fixed = 0;
int width = -1;
int decimals = -1;
if (!out)
return EINVAL;
va_start(args, out);
while (1) {
const char *const format = va_arg(args, const char *);
if (!format) {
va_end(args);
return 0;
}
if (*format) {
if (fputs(format, out) == EOF) {
va_end(args);
return 0;
}
} else
if (format >= out_formats && format < out_formats + sizeof out_formats) {
switch ((out_type)(format - out_formats)) {
case out_char:
if (fprintf(out, "%c", va_arg(args, int)) < 0) {
va_end(args);
return EIO;
}
break;
case out_int:
if (fprintf(out, "%*d", width, (int)va_arg(args, int)) < 0) {
va_end(args);
return EIO;
}
break;
case out_double:
if (fprintf(out, fixed ? "%*.*f" : "%*.*e", width, decimals, (float)va_arg(args, double)) < 0) {
va_end(args);
return EIO;
}
break;
case out_FILE:
out = va_arg(args, FILE *);
if (!out) {
va_end(args);
return EINVAL;
}
break;
case out_set_fixed:
fixed = !!va_arg(args, int);
break;
case out_set_width:
width = va_arg(args, int);
break;
case out_set_decimals:
decimals = va_arg(args, int);
break;
case out_count:
break;
}
}
}
}
Note that the above lacks even OUT("string literal") support; it's quite minimal implementation.
Finally, the main.c to show an example of using the above:
#include <stdlib.h>
#include "out.h"
int main(void)
{
double q = 1.0e6 / 7.0;
int x;
out("Hello, world!\n", OUT_END);
out("One seventh of a million is ", OUT_decimals(3), OUT(q), " = ", OUT_fixed(1), OUT(q), ".", OUT_EOL);
for (x = 1; x <= 9; x++)
out(OUT(stderr), OUT(x), " ", OUT_width(2), OUT(x*x), OUT_EOL);
return EXIT_SUCCESS;
}
In a comment, chux pointed out that we can get rid of the pointer inequality comparisons, if we fill the out_formats array; then (assuming, just for paranoia's sake, we skip the zero index), we can use (*format > 0 && *format < out_type_max && format == out_formats + *format) for the check. This seems to work just fine.
I also applied Pascal Cuoq's answer on how to make string literals decay into char * for _Generic(), so this does support out(OUT("literal")). Here is the modified out.h:
#ifndef OUT_H
#define OUT_H 1
#include <stdio.h>
typedef enum {
out_string = 1,
out_int,
out_double,
out_set_FILE,
out_set_fixed,
out_set_width,
out_set_decimals,
out_type_max
} out_type;
extern const char out_formats[out_type_max + 1];
extern int outf(FILE *, ...);
#define out(x...) outf(stdout, x)
#define err(x...) outf(stderr, x)
#define OUT(x) _Generic( (0,x), \
FILE *: out_formats + out_set_FILE, \
double: out_formats + out_double, \
int: out_formats + out_int, \
char *: out_formats + out_string ), (x)
#define OUT_END ((const char *)0)
#define OUT_EOL "\n", ((const char *)0)
#define OUT_fixed(x) (out_formats + out_set_fixed), ((int)(x))
#define OUT_width(x) (out_formats + out_set_width), ((int)(x))
#define OUT_decimals(x) (out_formats + out_set_decimals), ((int)(x))
#endif /* OUT_H */
Here is the correspondingly modified implementation, out.c:
#include <stdlib.h>
#include <stdarg.h>
#include <stdio.h>
#include <errno.h>
#include "out.h"
const char out_formats[out_type_max + 1] = {
[ out_string ] = out_string,
[ out_int ] = out_int,
[ out_double ] = out_double,
[ out_set_FILE ] = out_set_FILE,
[ out_set_fixed ] = out_set_fixed,
[ out_set_width ] = out_set_width,
[ out_set_decimals ] = out_set_decimals,
};
int outf(FILE *stream, ...)
{
va_list args;
/* State (also, stream is included in state) */
int fixed = 0;
int width = -1;
int decimals = -1;
va_start(args, stream);
while (1) {
const char *const format = va_arg(args, const char *);
if (!format) {
va_end(args);
return 0;
}
if (*format > 0 && *format < out_type_max && format == out_formats + (size_t)(*format)) {
switch ((out_type)(*format)) {
case out_string:
{
const char *s = va_arg(args, char *);
if (s && *s) {
if (!stream) {
va_end(args);
return EINVAL;
}
if (fputs(s, stream) == EOF) {
va_end(args);
return EINVAL;
}
}
}
break;
case out_int:
if (!stream) {
va_end(args);
return EINVAL;
}
if (fprintf(stream, "%*d", width, (int)va_arg(args, int)) < 0) {
va_end(args);
return EIO;
}
break;
case out_double:
if (!stream) {
va_end(args);
return EINVAL;
}
if (fprintf(stream, fixed ? "%*.*f" : "%*.*e", width, decimals, va_arg(args, double)) < 0) {
va_end(args);
return EIO;
}
break;
case out_set_FILE:
stream = va_arg(args, FILE *);
if (!stream) {
va_end(args);
return EINVAL;
}
break;
case out_set_fixed:
fixed = !!va_arg(args, int);
break;
case out_set_width:
width = va_arg(args, int);
break;
case out_set_decimals:
decimals = va_arg(args, int);
break;
case out_type_max:
/* This is a bug. */
break;
}
} else
if (*format) {
if (!stream) {
va_end(args);
return EINVAL;
}
if (fputs(format, stream) == EOF) {
va_end(args);
return EIO;
}
}
}
}
If you find a bug or have a suggestion, please let me know in the comments. I don't actually need such code for anything, but I do find the approach very interesting.