Equality comparison of pointers to different objects

Question

Inspired by this answering this question, I dug a little into the C11 and C99 standards for the use of equality operators on pointers (the original question concerns relational operators). Here's what C11 has to say (C99 is similar) at §6.5.9.6:

Two pointers compare equal if and only if both are null pointers, both are pointers to the same object (including a pointer to an object and a subobject at its beginning) or function, both are pointers to one past the last element of the same array object, or one is a pointer to one past the end of one array object and the other is a pointer to the start of a different array object that happens to immediately follow the first array object in the address space.⁹⁴)

Footnote 94 says (and note that footnotes are non-normative):

Two objects may be adjacent in memory because they are adjacent elements of a larger array or adjacent members of a structure with no padding between them, or because the implementation chose to place them so, even though they are unrelated. If prior invalid pointer operations (such as accesses outside array bounds) produced undefined behavior, subsequent comparisons also produce undefined behavior.

The body of the text and the non-normative note appear to be in conflict. If one takes the 'if and only if' from the body of the text seriously, then in no other circumstances than those set out should equality be returned, and there is no room for UB. So, for instance this code:

uintptr_t a = 1;
uintptr_t b = 1;
void *ap = (void *)a;
void *bp = (void *)b;
printf ("%d\n", ap <= bp); /* UB by §6.5.8.5 */
printf ("%d\n", ap < bp);  /* UB by §6.5.8.5 */
printf ("%d\n", ap == bp); /* false by §6.5.9.6 ?? */

should print zero, as ap and bp are neither pointers to the same object or function, or any of the other bits set out.

In §6.5.8.5 (relational operators) the behaviour is more clear (my emphasis):

When two pointers are compared, the result depends on the relative locations in the address space of the objects pointed to. If two pointers to object or incomplete types both point to the same object, or both point one past the last element of the same array object, they compare equal. If the objects pointed to are members of the same aggregate object, pointers to structure members declared later compare greater than pointers to members declared earlier in the structure, and pointers to array elements with larger subscript values compare greater than pointers to elements of the same array with lower subscript values. All pointers to members of the same union object compare equal. If the expression P points to an element of an array object and the expression Q points to the last element of the same array object, the pointer expression Q+1 compares greater than P. In all other cases, the behavior is undefined.

Questions:

• I am correct that there is some ambiguity as to when equality operators with pointers are permitted UB (comparing the footnote and the body of the text)?

• If there is no ambiguity, when precisely can comparison of pointers with equality operators be UB? For instance, is it always UB if at least one pointer is artificially created (per above)? What if one pointer refers to memory that has been free()d? Given the footnote is non-normative, can one conclude there is never UB, in the sense that all 'other' comparisons must yield false?

• Does §6.5.9.6 really mean that equality comparison of meaningless but bitwise equal pointers should always be false?

Note this question is tagged language-lawyer; I am not asking what in practice compilers do, as I believe already know the answer to that (compare them using the same technique as comparing integers).

Answer 1

Am I correct that there is some ambiguity as to when equality operators with pointers are UB?

No, because this passage from §6.5.9(3):

The == and != operators are analogous to the relational operators except for their lower precedence.

Implies that the following from §6.5.9(6) also applies to the equality operators:

When two pointers are compared [...] In all other cases, the behavior is undefined.

If there is no ambiguity, when precisely can comparison of pointers with equality operators be UB?

There is undefined behaviour in all cases for which the standard does not explicitly define the behaviour.

Is it always UB if at least one pointer is artificially created converted from an arbitrary integer?

§6.3.2.3(5):

An integer may be converted to any pointer type. Except as previously specified, the result is implementation-defined, might not be correctly aligned, might not point to an entity of the referenced type, and might be a trap representation.

What if one pointer refers to memory that has been freed?

§6.2.4(2):

The value of a pointer becomes indeterminate when the object it points to reaches the end of its lifetime.

can one conclude there is never UB, in the sense that all 'other' comparisons must yield false?

No. The standard defines under what conditions two pointers must compare equal, and under what conditions two pointers must compare not equal. Any equality comparisons between two pointers that falls outside both of those two sets of conditions invokes undefined behaviour.

Does §6.5.9(6) really mean that equality comparison of meaningless but bitwise equal pointers should always be false?

No, it is undefined.