Write to dynamic two dimension array outside the range without Segmentation fault

[lovecreatesbea...]

This code snippet is an exercise on allocating two dimension array
dynamically. Though this one is trivial, is it a correct one?
Furthermore, when I tried to make these changes to the original
example:

for (i = 0; i < ROW + 2; ++i){ /*line 14*/
strcpy(array[i], "C! C!"); /*line 15*/

Apparently, the modified code wrote to the memory unit outside the
allocated array, but the program ran well and there was no Segmentation
fault. Thank you.

#include <stdlib.h>
#include <string.h>
#include <stdio.h>

#define ROW 4
#define COL 3

int main(void){
char (*array)[COL];
int i;

array = malloc(ROW * sizeof *array);
if (array){
for (i = 0; i < ROW; ++i){ /*line 14*/
strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);
}
}
free(array);

return 0;
}

[bwaichu]

lovecreatesbea. [e-mail] wrote:

strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);

strcpy doesn't nul terminate, so your call to printf will fault.

[Coos Haak]

Op 3 Sep 2006 10:28:48 -0700 schreef bw*****@yahoo.c om:

lovecreatesbea. [e-mail] wrote:

> strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);

strcpy doesn't nul terminate, so your call to printf will fault.

strcpy does, memcpy doesn't.
printf won't fail here.
--
Coos

[Flash Gordon]

bw*****@yahoo.c om wrote:

lovecreatesbea. [e-mail] wrote:

> strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);

strcpy doesn't nul terminate,

What on earth makes you think that? strcpy is a *string* copy, so of
course it is defined to copy the null termination, otherwise it would be
called something like,
CopyJustTooLitt leOfAStringToBe Usefull99Percen tOfTheTimeOrMor e.

so your call to printf will fault.

Even if you were write about strcpy (which you are not) that would still
not guarantee that the call to printf would fault.
--
Flash Gordon

[Flash Gordon]

lovecreatesbea. [e-mail] wrote:

This code snippet is an exercise on allocating two dimension array
dynamically. Though this one is trivial, is it a correct one?
Furthermore, when I tried to make these changes to the original
example:

for (i = 0; i < ROW + 2; ++i){ /*line 14*/
strcpy(array[i], "C! C!"); /*line 15*/

Apparently, the modified code wrote to the memory unit outside the
allocated array, but the program ran well and there was no Segmentation
fault. Thank you.

Excuse me mister policeman, but why are you telling me I should not
drive with my eyes close? I just managed to drive 100 yards down the
road with my eyes closed and I didn't crash!

Just because you do something wrong it does not guarantee a crash. All
it guarantees is that you have done something wrong.

#include <stdlib.h>
#include <string.h>
#include <stdio.h>

#define ROW 4
#define COL 3

int main(void){
char (*array)[COL];
int i;

array = malloc(ROW * sizeof *array);
if (array){
for (i = 0; i < ROW; ++i){ /*line 14*/
strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);
}
}
free(array);

return 0;
}

For more flexible approaches I suggest you read question 6.16 of the
comp.lang.c FAQ.
--
Flash Gordon

[bwaichu]

Coos Haak wrote:

Op 3 Sep 2006 10:28:48 -0700 schreef bw*****@yahoo.c om:

lovecreatesbea. [e-mail] wrote:

strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);

strcpy doesn't nul terminate, so your call to printf will fault.

strcpy does, memcpy doesn't.
printf won't fail here.

You mis-read my comment. The OP only allocated array[0], so the
designation
array[1] through array[3] has not be allocated. Therefore, when you
strcpy, there is no way you can nul terminate since the designation is
smaller than the string being copied.

[bwaichu]

Here's one that will work since I have allocated the array each
time through the for loop. And strcpy will nul terminate because
the destination is big enough to hold the nul terminator.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(void) {

char *string[20];
int i;

for (i = 0; i < 4; i++) {
string[i] = calloc(6, sizeof(char));
strcpy(string[i], "hello");
printf("%s\n", string[i]);
}
for (i = 0; i < 4; i++) {
free(string[i]);
}
return 0;
}

[lovecreatesbea...]

Flash Gordon wrote:

lovecreatesbea. [e-mail] wrote:

#include <stdlib.h>
#include <string.h>
#include <stdio.h>

#define ROW 4
#define COL 3

int main(void){
char (*array)[COL];
int i;

array = malloc(ROW * sizeof *array);
if (array){
for (i = 0; i < ROW; ++i){ /*line 14*/
strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);
}
}
free(array);

return 0;
}

For more flexible approaches I suggest you read question 6.16 of the
comp.lang.c FAQ.

Isn't the approach in my code example flexible enough? Isn't it correct?

[exacube]

Isn't the approach in my code example flexible enough? Isn't it correct?

No, it's not. For one,

char (*array)[COL];

Is errorneous. It is different from:

char *array[COL];

You should know that [] precedes the * operator. Insted of creating an
array of pointers to characters, you created a pointer to an array of
characters. See the difference?

Vardhan

[websnarf]

lovecreatesbea. [e-mail] wrote:

This code snippet is an exercise on allocating two dimension array
dynamically. Though this one is trivial, is it a correct one?

Yes, its a 2 dimensional storage used for holding a 1 dimensional array
of C strings, being filled then output one at a time.

Furthermore, when I tried to make these changes to the original
example:

for (i = 0; i < ROW + 2; ++i){ /*line 14*/
strcpy(array[i], "C! C!"); /*line 15*/

Apparently, the modified code wrote to the memory unit outside the
allocated array, but the program ran well and there was no Segmentation
fault. Thank you.

Yes, this is called a buffer overflow. array is defined for ROW (== 4)
rows only, not ROW+2 rows. Furthermore each row can hold at most 3
characters, even though storing "C! C!" requires 6 characters. You can
read more about this condition here:

http://en.wikipedia.org/wiki/Buffer_overflow

Just because there happened to be valid memory past the end of your
well defined objects doesn't mean that accessing them is valid. The
lack of a Segmentation fault is not proof of correctness. (In fact
more buffer overflows in real world programs do not lead to immediate
Segmentation Faults.)

#include <stdlib.h>
#include <string.h>
#include <stdio.h>

#define ROW 4
#define COL 3

int main(void){
char (*array)[COL];
int i;

array = malloc(ROW * sizeof *array);
if (array){
for (i = 0; i < ROW; ++i){ /*line 14*/
strcpy(array[i], "C!"); /*line 15*/
printf("%s\n", array[i]);
}
}
free(array);

return 0;
}

--
Paul Hsieh
http://www.pobox.com/~qed/
http://bstring.sf.net/