Let's say I have a variant type in C implemented as an annotated union:

enum var_mode {

union var_data {
    int a;
    double b;

struct var_type {
    enum var_mode mode;
    // 'a' member only valid if mode is TYPE_A, 'b' only if TYPE_B.
    union var_data data;

Whether or not type-punning this union is undefined behaviour or implementation defined behaviour depends on the standard being written to (I think). However in my program I consider it an error, and would like to detect it. For example, this would be an error:

int main(void)
    struct var_type example;
    example.mode = TYPE_B;
    example.data.b = 3.5e8;

    printf("Data: %d\n", example.data.a);

Compare it to the usefulness of detecting memory leaks, which are not undefined behaviour but generally considered errors in a program. Or to unsigned integer wrapping — it's not undefined behaviour but tools exist to detect it as an error (eg. LLVM Clang's -fsanitize=unsigned-integer-overflow) because it's often unintentional.

Is there a tool — maybe like Valgrind's suite of tools or LLVM Clang's sanitisers — that will allow me to detect such errors without substantial refactoring of an existing code base? My preference would be to not rely on the annotation ie. ideally it would work with bare unions, since the underlying assumption is that the programmer isn't perfect, but I'll consider anything.

  • Note about the tags: programming had no description, and I'm not sure if it's too broad. There seemed to be no tags for tools for eg. development, code analysis, error checking. Open to ideas.
    – detly
    May 9 '18 at 0:52
  • To detect an error in union misuse, it seems that what you want to know is if a you have a union with members X and Y, that the code assigns to X and then reads from Y. That is surely a mistake; I'm not a C language lawyer but I assume its undefined behavior. ....
    – Ira Baxter
    Aug 27 '18 at 0:26
  • ... However, your example insists that you have union that has an an associated tag variable (you happened to put them both in a single struct) and that accesses to the union must only match the state of the tag variable. How is such a tool supposed to know where the tag variable instance is, for an instance union? How is it supposed to know which states of the tag variable, correspond to which union members? We assume such a tool isn't going to read your comment line.
    – Ira Baxter
    Aug 27 '18 at 0:26
  • If you can define specific rules for these (e.g., "any struct containing an enum followed by a union should be treated as a tagged union and investigated"), I might have an answer.
    – Ira Baxter
    Aug 27 '18 at 0:29
  • @IraBaxter FYI it's not UB, it's implementation defined. Some people use it for eg. serialising data on embedded systems to be sent to other ICs. But it is often a mistake, you're right.
    – detly
    Aug 27 '18 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.