Macro for allocation in C

Question

As we all know, the syntax of allocating memory is a bit clunky in C. The recommended way is:

 int *p;
 int n=10;
 p = malloc(n*sizeof *p);

You can use sizeof (int) instead of sizeof *p but it is bad practice.

I made a solution to this with a macro:

#define ALLOC(p,n) do{ *p=malloc(n*sizeof **p); } while(0)

This get called this way:

 int *p;
 int n=10;
 ALLOC(&p, n);

The reason I want to pass the address of p rather than p, is to offer a bit of protection. When you call a function with foo(x), then foo can never change the value of x. If you're not passing the address, the argument will not change. (Sure there are ways around that too.)

Any comments?

Answer 1

p = malloc(n*sizeof *p);

This is dangerous if n gets large, because the multiplication could overflow. After the overflow, too little memory has been allocated but code will continue without detecting the error.

This is especially dangerous if n comes from untrusted source, such as some file format or remote user. Then it gives attacker easy way to overwrite parts of memory with exploit code.

The easy safe solution is to use calloc() which will detect the overflow (at least on most common libc implementations). If you really need to use malloc() for some reason, you can check for overflow separately.

Answer 2

You've taken an expression statement and unnecessarily made a do/while statement out of it. You need parentheses around your macro parameters. You don't need to pass in the pointer you're assigning to as a pointer.

Put all that together and you end up with:

#define ALLOC(p, n)  ((p) = malloc((n) * sizeof *(p)))

This puts fewer restrictions on how it is used, and allows things like

struct monster *AddMonsters(monster *monsters, int which_monster, int how_many)
{
    int difficulty_add = ExtraMonsters();
    return ALLOC(monsters + which_monster, how_many + difficulty_add);
}

Yes, you could use monsters[which_monster], add the extra before using the macro, and put a separate return statement, but all that would be unnecessary restrictions on its use.

Answer 3

There are a couple questionable things here, first since ALLOC() is a macro you don't need to pass the address of p. If ALLOC() were a function call then you would want to pass the address of p.

Second, for an array I would probably use calloc() rather than malloc().

Answer 4

First of all, remove the unnecessary parts, which can cause errors and make the code harder to read.

#define ALLOC(p,n) p=malloc(n*sizeof *p)

You can make your code more readable with describing names. After months it will be quite hard to understand even your own code.

#define ALLOC(pointer, size) pointer = malloc(size * sizeof *pointer)

Parenthesizes are important! The following call: ALLOC(pointer, size + 1); would be equal with pointer = malloc(size + 1 * sizeof *pointer);, which clearly is a bug.

#define ALLOC(pointer, size) (pointer) = malloc((size) * sizeof(*pointer))

Use calloc instead of malloc, because of security reasons.

#define ALLOC(pointer, size) (pointer) = calloc((size), sizeof(*pointer))

Lastly, do not use function-like macros, instead a function would be a better choice. https://rules.sonarsource.com/c/tag/preprocessor/RSPEC-960

Answer 5

Based on your question, a similar question I asked yesterday, and some of the answers, I did a version that tries to have the benefits of all of them.

Disclaimer: Code is GCC specific (although probably works in similar compilers such as Clang).

Usage:

int *p;

/* Want >int p[47];< */
if (mallocs(&p, 47))
        goto err;
...
free(p);

Properties:

• Avoid having to type sizeof
• Can be used inside an if
• Returns an int error code
• Check for invalid input pointer: mallocs(NULL, 47) == EINVAL
• Check for negative nmemb: mallocs(&p, -47) == -EOVERFLOW (and p set to NULL)
• Check for overflow due to high nmemb: mallocs(&p, TOO_HIGH) == EOVERFLOW (and p set to NULL)
• Check for malloc error: mallocs(&p, 47) == ENOMEM (and p set to NULL) (correct input, but malloc fails for some reson)
• Sets errno on any failure (malloc shall set errno on failure, so if this is going to be in a library, it would make sense to set errno on failure too)
• I don't need a pointer to a pointer given that this is a macro, but I think a user that doesn't know this would probably be happier passing a pointer to a pointer, and keep thinking it is a function :) I would have to read the code if some tells me that (what looks like) a function call modifies a pointer without a pointer to it.
• Prevents double evaluation of arguments
• Removes the possibility that someone may cast the result of malloc

Code: (Edited: This code has problems; at the end of the answer is the fixed one)

#include <errno.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>


/*
 * int  mallocs(type **restrict p, ptrdiff_t nmemb);
 */
#define mallocs(ptr, nmemb)     (                                       \
{                                                                       \
        ptrdiff_t   nmemb_  = (nmemb);                                  \
        __auto_type ptr_    = (ptr);                                    \
        int         err_;                                               \
                                                                        \
        err_    = 0;                                                    \
        if (ptr_ == NULL) {                                             \
                errno   = EINVAL;                                       \
                err_    = EINVAL;                                       \
                goto ret_;                                              \
        }                                                               \
        if (nmemb_ < 0) {                                               \
                *ptr_   = NULL;                                         \
                errno   = EOVERFLOW;                                    \
                err_    = -EOVERFLOW;                                   \
                goto ret_;                                              \
        }                                                               \
        if (nmemb_ > (PTRDIFF_MAX / (ptrdiff_t)sizeof(**ptr_)) {        \
                *ptr_   = NULL;                                         \
                errno   = EOVERFLOW;                                    \
                err_    = EOVERFLOW;                                    \
                goto ret_;                                              \
        }                                                               \
                                                                        \
        *ptr_   = malloc(sizeof(**ptr_) * nmemb_);                      \
        if (*ptr_ == NULL)                                              \
                err_    = ENOMEM;                                       \
ret_:                                                                   \
        err_;                                                           \
}                                                                       \
)

I named it mallocs (malloc safe)

---

EDIT:

After finding that the code above can only be called once in a function, I improved it making use of an inline. Now there is the possibility to call the function or the macro, depending on your preferences (both can be called multiple times):

#include <errno.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>


#define mallocs(ptr, nmemb) (                               \
{                                                           \
        __auto_type     ptr_    = (ptr);                    \
                                                            \
        *ptr_   = mallocarray((nmemb), sizeof(**ptr_));     \
                                                            \
        !(*ptr_);                                           \
}                                                           \
)


inline
void    *mallocarray(ptrdiff_t nmemb, size_t size);


inline
void    *mallocarray(ptrdiff_t nmemb, size_t size)
{

    if (nmemb < 0)
        goto ovf;
    if (nmemb > (PTRDIFF_MAX / (ptrdiff_t)size))
        goto ovf;

    return  malloc(size * nmemb);
ovf:
    errno   = EOVERFLOW;
    return  NULL;
}

I named mallocarray() after the BSD extension reallocarray()