C Blocks indirection and misalignment - objective-c

Question

The following code throws an EXC_BAD_ACCESS error (specifically a general protection fault error) and I would like to know why you cannot misalign a block pointer and execute it.
#include <stdio.h>
int main(int argc, const char * argv[])
{
void (^blocky)() = ^{
printf("Hello!\n");
printf("Hello Again!\n");
};
blocky = *(&blocky+1);
blocky = *(&blocky-1);
blocky();
return 0;
}
But the following works:
#include <stdio.h>
int main(int argc, const char * argv[])
{
void (^blocky)() = ^{
printf("Hello!\n");
printf("Hello Again!\n");
};
blocky = *(&blocky+1-1);
blocky();
return 0;
}
Edit (answer to misaligning code blocks):
If you treat a block like a structure, you can find that the value that points to the executable code in memory is offset 16 bytes from the start of the block and is 8 bytes long.
You are able to change this value effectively pointing execution to another place in memory. Generally, this will crash.
Assuming you know the specific address in memory for another piece of executable code, you may direct it there.
Why this is useful:
It isn't. Never do this. Really. Never.

Answer 1

The pointer manipulation in the first example is wrong. Try this:
#include <stdio.h>
typedef void (^blocky_t)();
int main(int argc, const char * argv[])
{
blocky_t blocky = ^{
printf("Hello!\n");
printf("Hello Again!\n");
};
printf("blocky=%p\n", blocky);
blocky = (blocky_t)((char *)blocky + 1);
printf("blocky=%p\n", blocky);
blocky = (blocky_t)((char *)blocky - 1);
printf("blocky=%p\n", blocky);
blocky();
return 0;
}
$ clang -o blocky blocky.c
$ ./blocky
blocky=0x10574d040
blocky=0x10574d041
blocky=0x10574d040
Hello!
Hello Again!
When I ran your code, I got:
blocky=0x10e0ba040
blocky=0x7fff51b46c10
blocky=0x1300000000
Where:
The first address is within the __TEXT segment of the program.
The second address is near the stack.
The third is who-knows-where.

Answer 2

Your question really has nothing to do with blocks. You're just manipulating pointers to local variables in a way that doesn't make sense.
First, you never use the block pointer that you assign to blocky. You take the address of the local variable blocky on the stack, and then add one word to it, and dereference it. Depending on the architecture, the stack probably grows down, which means this is before all the variables on the stack frame, and is probably the return address of the current stack frame. Or it may be something else. You then assign this value to blocky.
Then, you take the address of the local variable blocky on the stack again, and then subtract one word from it, and dereference it. Again, assuming the stack grows down, this might be past the end of the current stack frame, which would be garbage. You then assign this value to blocky. You then try to run this as a pointer to a block. Of course this doesn't work.
In the second piece of code, you take the address of the local variable blocky on the stack again, and then add and subtract one word from it (which of course is the pointer to the local variable blocky again), and dereference it (which is the value of blocky), and assign it to blocky. This operation does nothing.