llvm / llvm/llvm-project

[Clang] Type-punning through an uninitialized structure member

Open
#210,476 13 comments 0 reactions 0 assignees View on GitHub
clang question
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

I found the С code that looked something like this:
```c
union U{
int i;
struct {int i; int j;} s;
};
union U u;
u.i = 42; // U::i is active member;
u.s.j = 42; // U::s is the active member with initialized s.j, s.i is the indeterminate value;
int i = u.s.i; // UB? accessing a value while it is indeterminate
int i2 = u.i; // UB? U::i does not have the expected value, even if type-punning is supported
```
In this case, it's difficult for me to even assess whether type-punching is used here (at the moment, I think it's not)?

related:
https://gitlab.winehq.org/wine/wine/-/merge_requests/10547

> C-standart (ISO/IEC 9899:TC2 Committee Draft — May 6, 2005 WG14/N1124):

>
> J.2 Undefined behavior
> — The value of an object with automatic storage duration is used while it is indeterminate (6.2.4, 6.7.8, 6.8).

> 6.7.8 Initialization
> 10 If an object that has automatic storage duration is not initialized explicitly, its value is indeterminate.

Contributor guide

Open the contributing guide

Research direction

Start with the union example in the issue and read the cited ISO/IEC 9899:TC2 sections 6.2.4, 6.7.8, 6.8, and J.2. Compare the interpretation with the linked Wine merge request. Done means establishing and documenting whether the accesses have undefined behavior and whether the issue represents a Clang problem.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.