Why my dangling pointer doesn't cause a segmentation fault?

Question

My code:

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = (int *)malloc(sizeof(int));
    free(p);
    *p = 42;
    return 0;
}

I created a pointer, then I pointed it to allocated space and finally I had assigned 42 to it. In my opinion it should not work, it should cause a segmentation fault, but it works. So, why?

PS: I normally compiled it with Gcc on Linux

You were unlucky. Always a possibility with undefined behaviour. — David Heffernan, Dec 21 '13 at 21:25
Not an exact duplicate since that question is tagged C++, but see http://stackoverflow.com/questions/6441218/can-a-local-variables-memory-be-accessed-outside-its-scope — Pascal Cuoq, Dec 21 '13 at 21:26
Please read http://stackoverflow.com/questions/2346806/what-is-segmentation-fault — James Black, Dec 21 '13 at 21:28

score 13 · Accepted Answer · answered Dec 21 '13 at 21:24

13

Pure luck. The behavior in this case is undefined. I.e.: no expectations can be made as to what may happen.

answered Dec 21 '13 at 21:24

littleadv

20,100
2
36
50

score 3 · Answer 2 · answered Dec 21 '13 at 21:24

In my opinion it should not work [...] but it works.

Don't worry, it doesn't work.

it should cause a segmentation fault

Tell that to the C standards committee. It's just undefined behavior, it isn't required to crash.

score 1 · Answer 3 · answered Dec 21 '13 at 21:31

The more elaborate answer beyond "undefined" is that you can write to arbitrary memory locations in C as long as you stay within the processes allocated memory areas. Depending on OS, overwriting code may be allowed or not. The ill effects only turn up, once some other code of your process gets confused by what is found at the garbled memory location. Since your program exits right away after messing up the memory, the chance for some of its code to get confused is obviously small.

score 0 · Answer 4 · answered Dec 21 '13 at 21:26

0

The behavior in this case is undefined ,

it is a possibility with undefin behavior

answered Dec 21 '13 at 21:26

Imran Ali Khan

8,469
16
52
77

score -1 · Answer 5 · answered Dec 21 '13 at 22:45

you display the memory address of p before and after free to check "p" with :

#include <stdio.h>
#include <stdlib.h>

    int main(void) {
        int *p = (int *)malloc(sizeof(int));
         printf("before \n %p \n",p);
         free(p);
        *p = 42;
         printf("after\n %p \n",p);
         printf(" %d \n",*p);
        return 0;
    }

before and after free we have the same address memory because free() don't assign NULL to p pointer, so *p = 42; work like static assignment although it's undefined behaviour.

suggest to use the FREE macro :

#define FREE(X) \
free(X);\
X=NULL;

test with this macro and you will see the expected behaviour

Why my dangling pointer doesn't cause a segmentation fault?

5 Answers5

Linked