Memory Safety and Undefined Behavior in C: A Formal Analysis of Pointer Arithmetic

MEMORY SAFETY AND UNDEFINED BEHAVIOR IN C: A FORMAL ANALYSIS OF POINTER ARITHMETIC The C programming language offers direct access to the memory space of a computer, trading isolation safety for hardware-level control and execution speed. While pointer arithmetic is a powerful mechanism, it represents a primary vector for spatial memory unsafety. Because the C language specification does not enforce bounds checking at runtime, accessing indices outside of allocated blocks leads to undefined behavior. THE MECHANICS OF SPATIAL MEMORY UNSAFETY When an array is declared in C, the compiler allocates a contiguous block of memory. int data[10]; This allocates 40 bytes of contiguous memory (assuming a standard 4-byte integer size). In C, the array identifier "data" acts as a constant pointer to the first element (&data[0]). The syntax data[i] is defined as *(data + i). During execution, if the program attempts to read or write data[12], the CPU translates this directly to *(data + 12), shifting the address pointer by 48 bytes (12 * 4 bytes) from the base address. Because C does not verify if this offset falls within the boundaries of the allocated block, the operation proceeds. If this offset overlaps with adjacent variables or return addresses on the stack frame, the operation corrupts the program state. COMPILER OPTIMIZATIONS AND UNDEFINED BEHAVIOR In ANSI C, out-of-bounds array access is classified as Undefined Behavior (UB). This means the compiler is not required to generate code that handles the error gracefully. Instead, modern compiler architectures (such as GCC and Clang) assume that undefined behavior never occurs in valid code. For example, a compiler might optimize away a bounds-checking condition if it mathematically determines that the condition is only met when undefined behavior (like integer overflow or out-of-bounds access) has already occurred. This optimization can lead to security vulnerabilities where checking logic is compiled out of the final executable binary. Reference: Ray Dawson, "Programming in ANSI C", Section 10: Pointers.