Skip to content

cast pointers to uintptr_t before slab region pointer comparison#347

Open
rdevshp wants to merge 1 commit into
GrapheneOS:mainfrom
rdevshp:pointer_comp_cast
Open

cast pointers to uintptr_t before slab region pointer comparison#347
rdevshp wants to merge 1 commit into
GrapheneOS:mainfrom
rdevshp:pointer_comp_cast

Conversation

@rdevshp
Copy link
Copy Markdown
Contributor

@rdevshp rdevshp commented May 31, 2026

The C standard is quite strict about pointer comparisons. N3220 6.5.9 paragraph 6:

When two pointers are compared, the result depends on the relative locations in the address space
of the objects pointed to. If two pointers to object types both point to the same object, or both point
one past the last element of the same array object, they compare equal. If the objects pointed to
are members of the same aggregate object, pointers to structure members declared later compare
greater than pointers to members declared earlier in the structure, and pointers to array elements
with larger subscript values compare greater than pointers to elements of the same array with lower
subscript values. All pointers to members of the same union object compare equal. If the expression
P points to an element of an array object and the expression Q points to the last element of the same
array object, the pointer expression Q+1 compares greater than P. In all other cases, the behavior is
undefined.

For example, when a large allocation pointer is passed to h_free/h_free_sized/h_free_aligned_sized, the comparison p < get_slab_region_end() && p >= ro.slab_region_start results in undefined behavior.

This pull request casts the pointers to uintptr_t before slab region comparisons to avoid any undefined behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant