Will off-the-end pointer overlap with other object?

Question

Considering that C++ does not have bound checking for built-in type arrays, Is it possible that:

One array's off-the-end pointer points to another array's first element?

Answer 1

Yes, a pointer beyond the end of an array could point to another object. Dereferencing a pointer beyond the end of an array results in undefined behavior.

Answer 2

My opinion: yes, it is possible in C++. There have been several SO threads on this topic, none of which reached any solid conclusion. Here is one example.

In some cases we can be sure that there is actually a valid object in memory immediately after the end of the old object. One case is standard-layout structs; another is multi-dimensional arrays. I originally wrote this post with a multi-dimensional array, but I have edited it to use the standard layout struct case, to avoid any objections about what the term "array object" means in the Standard.

struct
{
    int a[2];
    int b[2];
} foo;

if ( sizeof foo == 4 * sizeof(int) )
{
    int *p = &foo.a[0];

    ++p;    // (1)
    ++p;    // (2)
    *p = 3; // (3)
    ++p;    // (4)
    *p = 5; // (5)
}

Which line causes undefined behaviour (if any)? p is (initially, anyway) a pointer into the array of type int[2] which is designated by foo.a.

After line (2), p is now a one-past-the-end pointer. Is this dereferenceable?

The case of incrementing the pointer is covered by the section on the + operator (it is defined to have the same effect on p as p = p + 1). Here is a quote from C++11 [expr.add]#7:

Unless both pointers point to elements of the same array object, or one past the last element of the array object, the behavior is undefined.

Line (2) does not cause UB by this clause. What about line (3)?

As far as I can see, there is no clause in the C++ standard that says dereferencing a one-past-the-end pointer causes undefined behaviour. In several places it says that iterators "might not be dereferencable", or "the library does not assume that the iterator is dereferenceable". But it carefully avoids saying "the iterator is not dereferenceable".

From the fact that we proved there is no padding, and the rules about standard-layout structs saying that elements cannot be reordered; we can conclude that now p must hold the address of the element foo.b[0]. Therefore, p is a pointer into the subobject foo.b, as well as being a one-past-the-end pointer for foo.a.

---

Note that in C99 it is different. The text in C99 for the + operator has (emphasis mine):

If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined. If the result points one past the last element of the array object, it shall not be used as the operand of a unary * operator that is evaluated.

So, in C99 line (3) causes undefined behaviour. However C++ deliberately omits the bolded line.

---

Rationale: I don't know what the actual rationale is. However, my "mental model" for C's pointers is that it permits the compiler to implement "fat pointers", i.e. bounds-checked pointers. A pointer may contain the bounds of the (sub-)object that it was pointed to; and so the executable can detect array bounds errors at runtime just based on the pointer value.

I believe the C99 text is compatible with this; and the compiler can produce an executable that aborts on line (3).

However , as already stated, C++ does not have equivalent text and I can find no justification in the C++ Standard for considering (3) to cause UB; nor (4) or (5).

Answer 3

Reading beyond the bound of an array might result in dirty read.

1. It could be possible you may hit another array body
2. but it could also be possible that you may hit an unallocated region or
3. in case of int pointer you may point to a 4 byte region shared by an array of two shorts.
4. Your pointer may try to access a region which does not belongs to your process. Fatal error!

Not recommended to go beyond the bounds.

Regards Kajal

Answer 4

Is it possible that:

One array's off-the-end pointer points to another array's first element?

I'm not sure by what you mean by off the end pointer. As c++ iterators use half open ranges, I'm assuming you mean the pointer that represents the end position in an iteration. As that is one past the end, yes, it might overlap a next array, and hence it may not be dereferenced.

When using pointers as iterators, addresses and not values are compared. End implies the next address beyond end.