Example: pointer_offset_from_subtraction_1_global.c

#include <stdio.h>
#include <string.h> 
#include <stdint.h>
#include <inttypes.h>
int  y = 2, x=1;
int main() {
  intptr_t ux = (intptr_t)&x;
  intptr_t uy = (intptr_t)&y;
  intptr_t offset = uy - ux;
  printf("Addresses: &x=%"PRIiPTR" &y=%"PRIiPTR\
         " offset=%"PRIiPTR" \n",ux,uy,offset);
  int *p = (int *)(ux + offset);
  int *q = &y;
  if (memcmp(&p, &q, sizeof(p)) == 0) {
    *p = 11; // is this free of undefined behaviour?
    printf("x=%d  y=%d  *p=%d  *q=%d\n",x,y,*p,*q); 
  }
}

Experimental data (what does this mean?)

gcc-8.1-O0
 
Addresses: &x=6294132 &y=6294128 offset=-4 
x=1  y=11  *p=11  *q=11

gcc-8.1-O2
 
Addresses: &x=6293968 &y=6293972 offset=4 
x=1  y=11  *p=11  *q=11

gcc-8.1-O3
 
Addresses: &x=6293968 &y=6293972 offset=4 
x=1  y=11  *p=11  *q=11

gcc-8.1-O2-no-strict-aliasing
 
Addresses: &x=6293968 &y=6293972 offset=4 
x=1  y=11  *p=11  *q=11

gcc-8.1-O3-no-strict-aliasing
 
Addresses: &x=6293968 &y=6293972 offset=4 
x=1  y=11  *p=11  *q=11

clang-6.0-O0
 
Addresses: &x=6295612 &y=6295608 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-O2
 
Addresses: &x=6295612 &y=6295608 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-O3
 
Addresses: &x=6295612 &y=6295608 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-O2-no-strict-aliasing
 
Addresses: &x=6295612 &y=6295608 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-O3-no-strict-aliasing
 
Addresses: &x=6295612 &y=6295608 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-UBSAN
 
Addresses: &x=6495060 &y=6495056 offset=-4 
x=1  y=11  *p=11  *q=11

clang-6.0-ASAN
 
Addresses: &x=7433120 &y=7433056 offset=-64 
x=1  y=11  *p=11  *q=11

clang-6.0-MSAN
 
Addresses: &x=7043828 &y=7043824 offset=-4 
x=1  y=11  *p=11  *q=11

icc-19-O0
 
Addresses: &x=6294420 &y=6294416 offset=-4 
x=1  y=11  *p=11  *q=11

icc-19-O2
 
Addresses: &x=6309572 &y=6309568 offset=-4 
x=1  y=11  *p=11  *q=11

icc-19-O3
 
Addresses: &x=6309572 &y=6309568 offset=-4 
x=1  y=11  *p=11  *q=11

icc-19-O2-no-strict-aliasing
 
Addresses: &x=6309572 &y=6309568 offset=-4 
x=1  y=11  *p=11  *q=11

icc-19-O3-no-strict-aliasing
 
Addresses: &x=6309572 &y=6309568 offset=-4 
x=1  y=11  *p=11  *q=11

cerberus-concrete
 
BEGIN EXEC[0]
Killed {msg: MerrAccess Store [pointer_offset_from_subtraction_1_global.c:15:5-12] OutOfBoundPtr}
END EXEC[0]
Time spent: 0.054263 seconds

cerberus-symbolic
 
BEGIN EXEC[0]
Undefined [other_location(Core parser)]{id: [DUMMY(rev_listFromStr_aux)]}
END EXEC[0]
BEGIN EXEC[1]
Undefined [other_location(Core parser)]{id: [UB036_exceptional_condition]}
END EXEC[1]
BEGIN EXEC[2]
Undefined [other_location(Core parser)]{id: [UB036_exceptional_condition]}
END EXEC[2]
Time spent: 0.167791 seconds

gcc-4.9-shadowprov
 
exit codes: compile 0 / execute 134

CHERI:MIPS-O0
 
Addresses: &x=196644 &y=196640 offset=-4 
x=1  y=11  *p=11  *q=11

CHERI:MIPS-O2
 
Addresses: &x=196644 &y=196640 offset=-4 
x=1  y=11  *p=11  *q=11

CHERI:MIPS-O2-no-strict-aliasing
 
Addresses: &x=196644 &y=196640 offset=-4 
x=1  y=11  *p=11  *q=11

CHERI:CHERI-O0-uintcap-addr-exact-equals
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O2-uintcap-addr-exact-equals
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O2-no-strict-aliasing-uintcap-addr-exact-equals
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O0-uintcap-offset-exact-equals
 
Addresses: &x=0 &y=0 offset=0 

CHERI:CHERI-O2-uintcap-offset-exact-equals
 
Addresses: &x=0 &y=0 offset=0 

CHERI:CHERI-O2-no-strict-aliasing-uintcap-offset-exact-equals
 
Addresses: &x=0 &y=0 offset=0 

CHERI:CHERI-O0-uintcap-addr
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O2-uintcap-addr
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O2-no-strict-aliasing-uintcap-addr
 
Addresses: &x=0 &y=0 offset=-4 

CHERI:CHERI-O0-uintcap-offset
 
Addresses: &x=0 &y=0 offset=0 

CHERI:CHERI-O2-uintcap-offset
 
Addresses: &x=0 &y=0 offset=0 

CHERI:CHERI-O2-no-strict-aliasing-uintcap-offset
 
Addresses: &x=0 &y=0 offset=0 

RV-Match
 
exit codes: compile 0 / execute 1

ch2o
 
In file included from /usr/local/Cellar/gcc/7.3.0_1/lib/gcc/7/gcc/x86_64-apple-darwin17.3.0/7.3.0/include/stdint.h:9:0,
                 from pointer_offset_from_subtraction_1_global.c:3:
/usr/local/Cellar/gcc/7.3.0_1/lib/gcc/7/gcc/x86_64-apple-darwin17.3.0/7.3.0/include-fixed/stdint.h:27:10: fatal error: sys/_types/_int8_t.h: No such file or directory
 #include <sys/_types/_int8_t.h>
          ^~~~~~~~~~~~~~~~~~~~~~
compilation terminated.

compcert-3.2
 
Addresses: &x=6295620 &y=6295616 offset=-4 
x=1  y=11  *p=11  *q=11

compcert-3.2-O
 
Addresses: &x=6295620 &y=6295616 offset=-4 
x=1  y=11  *p=11  *q=11

compcert-3.2-interp
 
Time 0: calling main()
--[step_internal_function]-->
Time 1: in function main, statement
  ux = (int) &x;
  uy = (int) &y;
  offset = uy - ux;
  printf(__stringlit_1, ux, uy, offset);
  p = (int *) (ux + offset);
  q = &y;
  if (memcmp(&p, &q, sizeof(int *)) == 0) {
    *p = 11;
    printf(__stringlit_2, x, y, *., *.);
  }
  return 0;
--[step_seq]-->
Time 2: in function main, statement
  ux = (int) &x;
  uy = (int) &y;
  offset = uy - ux;
  printf(__stringlit_1, ux, uy, offset);
  p = (int *) (ux + offset);
  q = &y;
  if (memcmp(&p, &q, sizeof(int *)) == 0) {
    *p = 11;
    printf(__stringlit_2, x, y, *., *.);
  }
--[step_seq]-->
Time 3: in function main, statement ux = (int) &x;
--[step_do_1]-->
Time 4: in function main, expression ux = (int) &x
--[red_var_local]-->
Time 5: in function main, expression <loc ux> = (int) &x
--[red_var_global]-->
Time 6: in function main, expression <loc ux> = (int) &<loc x>
--[red_addrof]-->
Time 7: in function main, expression <loc ux> = (int) <ptr x>
--[red_cast]-->
Time 8: in function main, expression <loc ux> = <ptr x>
--[red_assign]-->
Time 9: in function main, expression <ptr x>
--[step_do_2]-->
Time 10: in function main, statement /*skip*/;
--[step_skip_seq]-->
Time 11: in function main, statement
  uy = (int) &y;
  offset = uy - ux;
  printf(__stringlit_1, ux, uy, offset);
  p = (int *) (ux + offset);
  q = &y;
  if (memcmp(&p, &q, sizeof(int *)) == 0) {
    *p = 11;
    printf(__stringlit_2, x, y, *., *.);
  }
--[step_seq]-->
Time 12: in function main, statement uy = (int) &y;
--[step_do_1]-->
Time 13: in function main, expression uy = (int) &y
--[red_var_local]-->
Time 14: in function main, expression <loc uy> = (int) &y
--[red_var_global]-->
Time 15: in function main, expression <loc uy> = (int) &<loc y>
--[red_addrof]-->
Time 16: in function main, expression <loc uy> = (int) <ptr y>
--[red_cast]-->
Time 17: in function main, expression <loc uy> = <ptr y>
--[red_assign]-->
Time 18: in function main, expression <ptr y>
--[step_do_2]-->
Time 19: in function main, statement /*skip*/;
--[step_skip_seq]-->
Time 20: in function main, statement
  offset = uy - ux;
  printf(__stringlit_1, ux, uy, offset);
  p = (int *) (ux + offset);
  q = &y;
  if (memcmp(&p, &q, sizeof(int *)) == 0) {
    *p = 11;
    printf(__stringlit_2, x, y, *., *.);
  }
--[step_seq]-->
Time 21: in function main, statement offset = uy - ux;
--[step_do_1]-->
Time 22: in function main, expression offset = uy - ux
--[red_var_local]-->
Time 23: in function main, expression <loc offset> = uy - ux
--[red_var_local]-->
Time 24: in function main, expression <loc offset> = <loc uy> - ux
--[red_rvalof]-->
Time 25: in function main, expression <loc offset> = <ptr y> - ux
--[red_var_local]-->
Time 26: in function main, expression <loc offset> = <ptr y> - <loc ux>
--[red_rvalof]-->
Time 27: in function main, expression <loc offset> = <ptr y> - <ptr x>
Stuck state: in function main, expression <loc offset> = <ptr y> - <ptr x>
Stuck subexpression: <ptr y> - <ptr x>
ERROR: Undefined behavior
In file included from pointer_offset_from_subtraction_1_global.c:1:
In file included from /usr/include/stdio.h:64:
In file included from /usr/include/_stdio.h:68:
/usr/include/sys/cdefs.h:81:2: warning: "Unsupported compiler detected" [-W#warnings]
#warning "Unsupported compiler detected"
 ^
1 warning generated.