Checking Bounds

Checking Bounds on Read/Write Operations

To check the bounds of pointers, compile your module with [Q]check-pointers compiler option, specifying the rw argument.

You can also check bounds by specifying the write argument. This also checks the bounds of pointers, but only for pointer write operations.

Consider the case where you create an array with ten elements using the malloc() function and then you write a character to each array element:

char *buf = malloc(10);
for (int i=0; i<=10; i++) { buf[i] = ‘A’ + i; }

The array has ten elements, but the loop iterates eleven times. On the eleventh iteration, the function writes a character to the eleventh element of the array, which is outside of the allocated memory. Regardless of whether you specify bounds checking for read and write operations or only write operations, the pointer checker will report an out-of-bounds error. Even in the case of a statically allocated buffer, the pointer checker will still report an error. Consider this case:

fprintf(stderr, "buf[%d]=%d\n",i,buf[i]);

Here, the reference to buf[i] is a read (or load) operation. Therefore, an out-of-bounds error will not be reported if you specified pointer checking only for write operations.

Pointer Arithmetic and Pointer Checking

Pointer arithmetic does not affect the pointer checker. A pointer can go out of range as long as the pointer does not make an indirect reference to an out of range address.

In the case where you create an array with 100 elements, the following applies:

char *p = malloc(100);
  p += 200;	   // pointer is out of range, but no error
  p[-101] = 0; // access is still in range, it is the original p[99]
  p[0] = 0;    // out-of-bounds error occurs here, because it is original p[200]