Out of bounds array accesses in C++ and reinterpret_cast

Question

Say I have code like this

struct A {
  int header;
  unsigned char payload[1];
};

A* a = reinterpret_cast<A*>(new unsigned char[sizeof(A)+100]);

a->payload[50] = 42;

Is this undefined behavior? Creating a pointer that points outside payload should be undefined AFAIK, but I'm unsure whether this is also true in the case where I have allocated the memory after the array.

The standard says p[n] is the same as *(p+ n) and "if the expression P poinst to the i-th element of an array object, the expressions (P)+N point to the i+n-th elements of the array". In the example payload points to an element in the array allocated with new, so this might be ok.

If possible, it would be nice if your answers contained references to the C++ standard.

Answer 1

So the reinterpret_cast is undefined behavior, we can reinterpret_cast to a char or unsigned char we can never cast from a char or unsigned char, if we do:

Accessing the object through the new pointer or reference invokes undefined behavior. This is known as the strict aliasing rule.

So yes this is a violation of the strict aliasing rule.

Answer 2

Consider the code:

struct {char x[4]; char a; } foo;

int work_with_foo(int i)
{
  foo.a = 1;
  foo.x[i]++;
  return foo.a;
}

Even though the program would "own" the storage at foo.x+4, the fact that access via the array type is only defined for the first four elements would allow a compiler to, among other things, replace the above code with either of the following:

int work_with_foo(int i)  { foo.a = 1; foo.x[i]++; return 1; }

int work_with_foo(int i)  { foo.x[i]++; foo.a = 1; return 1; }

The above substitutions are clearly permissible under the Standard. It is less clear what alternate ways of writing the increment would force the compiler to behave as though it reloads foo.a. For example, I think the code *(i+(char*)&foo)+=1; would have defined behavior when i equals the offset of foo.a, and I would think the same should be true of *(i+(char*)&foo.x)+=1; but I'm not sure about *(i+foo.x)+=1; or *(i+(char*)foo.x)+=1;.

Answer 3

This old C hack is never necessary in C++.

consider:

#include <cstdint>
#include <utility>
#include <memory>

template<std::size_t Size>
struct A {
  int header;
  unsigned char payload[Size];
};

struct polyheader
{
  struct concept
  {
    virtual int& header() = 0;
    virtual unsigned char* payload() = 0;
    virtual std::size_t size() const = 0;
    virtual ~concept() = default;  // not strictly necessary, but a reasonable precaution
  };

  template<std::size_t Size>
  struct model : concept
  {
    using a_type = A<Size>;
    model(a_type a) : _a(std::move(a)) {}
    int& header() override {
      return _a.header;
    }

    unsigned char* payload() override {
      return _a.payload;
    }

    std::size_t size() const override {
      return Size;
    }

    A<Size> _a;
  };

  int& header() { return _impl->header(); }
  unsigned char* payload() { return _impl->payload(); }
  std::size_t size() const { return _impl->size(); }

  template<std::size_t Size>
  polyheader(A<Size> a) 
    : _impl(std::make_unique<model<Size>>(std::move(a)))
    {}

  std::unique_ptr<concept> _impl;
};


int main()
{
  auto p1 = polyheader(A<40>());
  auto p2 = polyheader(A<80>());

}