Loss of provenance
This common compiler warning
is triggered when casting a non-capability type (e.g., long) to a pointer.
As mentioned in Pointer provenance
validity, the result of this cast is a NULL-derived capability with the address set to the integer value.
As any NULL-derived capability is untagged, any attempt to dereference it will trap.
Usually, this warning is caused by programmers incorrectly assuming that long is able to store pointers.
The fix for this problem is to change the type of the cast source to a provenance-carrying type such as intptr_t or uintptr_t (see Recommended use of
C-language types):
char *example_bad(long ptr_or_int) {
return strdup((const char *)ptr_or_int);
}
char *example_good(intptr_t ptr_or_int) {
return strdup((const char *)ptr_or_int);
}
<source>:2:17: warning: cast from provenance-free integer type to pointer type
will give pointer that can not be dereferenced [-Wcheri-capability-misuse]
return strdup((const char *)ptr_or_int);
^
1 warning generated.
In some cases, this warning can be a false positive.
For example, it is common for C callback APIs take a void * data argument that is passed to the callback.
If this value is in fact an integer constant, the warning can be silenced by casting to uintptr_t first:
void invoke_cb(void (*cb)(void *), void *);
void callback(void *arg);
void false_positive_example(int callback_data) {
invoke_cb(&callback, (void *)callback_data); // warning
invoke_cb(&callback, (void *)(uintptr_t)callback_data); // no warning
}
<source>:4:24: warning: cast from provenance-free integer type to pointer type
will give pointer that can not be dereferenced [-Wcheri-capability-misuse]
invoke_cb(&callback, (void *)callback_data); // warning
^
<source>:15:24: warning: cast to 'void *' from smaller integer type 'int'
[-Wint-to-void-pointer-cast]
invoke_cb(&callback, (void *)callback_data); // warning
^
2 warnings generated.