C pointer arithmetic and bounds.

C11 6.3.2.1p3: an expression of array type is converted to a pointer to the array’s first element, except when it is the operand of sizeof or unary &, or a string literal used to initialize an array. (N1570 also lists _Alignof there by mistake; C17 removed it, because _Alignof takes a type, not an expression.) 6.5.6p8: when an integer is added to a pointer to an array element, the result points that many elements further on. 6.5.6p7: a pointer to a single object counts as a pointer to the first element of an array of length 1, so &x + 1 may be computed. Only sizeof(char) is fixed, at 1. The sizes 4 and 8 are those of the stepper’s build; its addresses beginning 0xffff come from a 64-bit ARM (aarch64) machine, and x86-64 Linux gives the same sizes. Arithmetic on void * is a GNU extension that steps by one byte; standard C rejects it, and gcc reports it with -Wpointer-arith.

6.5.2.1p2 defines E1[E2] as (*((E1)+(E2))). Because addition does not depend on order, 2[pages] is also valid C and means pages[2]; nobody should write it. 6.5.6p9: two pointers may be subtracted only if both point into the same array object, or one past its last element, and the result is the difference of the two indexes. Subtracting pointers into different objects is undefined behavior, even when the result looks reasonable. For a distance in bytes, convert both to char * first: (char *)q - (char *)p is 8 here.

6.5.6p8 allows a result that points one past the last element, provided it is not the operand of a unary * that is evaluated. &queues[4] is also allowed: 6.5.3.2p3 says & and [] cancel, so nothing is read. 6.5.8p5 defines < and > for pointers into the same array object (or one past it) and for pointers to members of the same struct, where a later member compares greater; a + n compares greater than every element’s address. Comparing pointers to unrelated objects with < is undefined. An empty range needs no special case, because a + 0 is a and the loop does not run. A null pointer is not an array, so in C11 even NULL + 0 is undefined; the next standard, C2y, is changing this so that NULL + 0 gives NULL. A function that takes a pointer and a count and allows NULL with a count of 0 must test for NULL first.

C11 Annex J.2 lists as undefined “an array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression a[1][7] given the declaration int a[4][5])”. The same holds inside a struct: in struct { int a[3]; int b; } s, s.a + 3 may be computed, but reading *(s.a + 3) is undefined even though b is stored there. The stepper’s gcc -O0 build simply loads whatever is stored after the array. An optimizing build may remove or reorder code on the assumption that the read never happens, so a correct-looking -O0 run proves nothing. -fsanitize=address (gcc and clang) places unused bytes around each stack, heap, and global object and reports a read or write that lands in them at run time. It does not see an overflow that stays inside one object, such as *(s.a + 3) reading s.b. -Warray-bounds is part of -Wall, but in gcc it finds most cases only at -O2. On a microcontroller without a memory protection unit, a read just past an array usually returns whatever is stored next; the stack usually grows down, so past a local array lie saved registers and the frame of the function that called it. A read of a reserved or unmapped address can still fault (a BusFault or HardFault on Cortex-M), and a read of a peripheral register can change the device, for example by clearing a status flag.

7.1.1 defines a string as “a contiguous sequence of characters terminated by and including the first null character”, and 7.24.6.3 says strlen returns the number of characters that precede it. 6.7.6.3p7 adjusts a parameter of type “array of T” to “pointer to T”, so a size written in the brackets is not checked and sizeof sees a pointer. The warning above is gcc’s -Wsizeof-array-argument, which is on by default. One more trap: char tag[4] = "lamp"; is valid C. 6.7.9p14 stores the '\0' only if there is room, so tag holds no '\0' and strlen(tag) is undefined. C++ rejects the same line.

7.24.2.4p3: strncpy appends null characters only when the source is a string shorter than n, and then it fills every remaining byte of the n with them, which costs time when n is large. 7.21.6.5p2–3: snprintf discards output beyond the n − 1st character, writes a null character at the end when n is not 0, and returns the number of characters that would have been written for a large enough n, or a negative value on an encoding error; the text is complete only if the result is nonnegative and less than n. 6.2.5p9: unsigned arithmetic is reduced modulo the largest value plus one, so 0 - 1 on a size_t is defined and gives SIZE_MAX. 7.22.3.5p2: realloc deallocates the old object. 6.2.4p2 then makes every pointer to it indeterminate, and Annex J.2 lists using such a value as undefined, so even comparing an old pointer with the new one is undefined, not only reading through it. The warning for the size_t loop is -Wtype-limits, part of -Wextra: “comparison of unsigned expression in ‘>= 0’ is always true”; the stepper builds with -std=c11 -Wall -Wextra -O0. gcc’s -Wstringop-truncation and -Wstringop-overflow look for the first two bugs, but the -O0 build reported neither for them. Annex K’s strncpy_s is optional, and glibc does not provide it.

for (size_t i = 0; i < n; i++) with a[i] and for (p = a; p < a + n; p++) with *p express the same walk, and an optimizing compiler usually produces the same machine code for both. Choose the one that reads better. Pointers fit functions that return a position, such as strchr and memchr, which return a pointer to what they found or NULL; the convention used by C++ iterators returns the end pointer instead.