How can puts() find the end of an array without a \0 terminator?

Question

In this code:

int length = atoi(argv[1]);
char *tab = malloc(length * sizeof(char));
memset(tab, '-', length);
puts(tab);

no matter what value I passing to argv[1], the output is correct. For example, for argv[1] = "5" i get ----- (five hyphens).

I'm wondering how puts() can find the end of input string when I have not put a '\0' at the end of my array of chars.

Sometimes Undefined Behavior seems to work. Just your bad luck. — aschepler, May 06 '17 at 12:59
By the way, remove the C++ tag - this isn't (valid) C++ code, it's pure C — UnholySheep, May 06 '17 at 13:01
If you want to correct it, allocate an extra byte and add `*(tab + atoi(argv[1])) = '\0';` — byxor, May 06 '17 at 13:01
You should debug and check (length + 1)'th character if it is \0 — Pras, May 06 '17 at 14:01
"no matter what value I passing to argv[1]" Curious, how many values did you try? — chux - Reinstate Monica, May 06 '17 at 14:19
i've paseed manually ~15 values (rather small, < 50) and it worked for all of them. — myschu, May 06 '17 at 14:37
This is highly implementation depended. So without knowing the exact details on the C compiler in use, the Lib-C used, the OS, this is not answerable. From the pure C perspective the code show invoke the infamous Undefined Behaviour, from the `puts()`call on everything can happen. — alk, May 07 '17 at 09:56

cxw · Accepted Answer · 2017-05-06T15:04:28.127

5

What @aschepler said. I am guessing that something — either the operating system or your C runtime or startup code — is zeroing out the memory before you malloc it. As a result, your string is null-terminated by virtue of the fact that you didn't overwrite the \0 bytes that were already there. Don't assume this will always work!

Edit Different compilers, OSes, and libraries initialize memory differently. This question and its answers, and likewise this one, give some examples of initialization patterns and other patterns written to memory to assist debugging. Turns out at least one compiler (IBM XLC) lets you choose the value for uninitialized automatics.

edited May 06 '17 at 15:04

answered May 06 '17 at 13:04

cxw

16,685
2
45
81

1

Just a thought, but I wonder how many bugs would be caught earlier if memory was `\1`'d out rather than zeroed out (or just filled with non-zero garble, for that matter). – byxor May 06 '17 at 13:12
1

@myschu If this answer, or another, resolved your question to your satisfaction, would you please hit the checkmark next to that answer to accept it? That will help future readers of the question know what worked for you, and will clear the question off the no-accepted-answer lists. You and the person whose answer you accept will also get reputation points :) . – cxw Jun 28 '17 at 17:05

chux - Reinstate Monica · Answer 2 · 2017-05-06T14:57:51.253

Try values like 0, 1, 1000, 1000000, 1000000000, 1000000000000, -1.

One steals a few things from a store and does not get caught, does that make stealing OK? Try stealing the whole store and see if it "works".

puts() requires a string, that means a null character certainly ends it - else it is not a string. If code breaks the rules, puts() is not obliged to behave in a certain fashion. It is undefined behavior (UB).

BTW, code should also check if tab != NULL before using it in memset(tab, '-', length);

score 0 · Answer 3 · answered May 06 '17 at 13:17

As stated by @cxw above, you are just lucky (or your system simply zeroes your memory upon malloc) that your string holds a \0 after its content.

I would also like to add that you should however not rely on such methods as it makes your program unstable and prone to crashs. In this case, you end up having an invalid reading error, but in case your malloc would have been larger, you'd be reading uninitialized memory.

You may want to use tools such as Valgrind to spot memory issue. Always keep in mind that any memory error should be fixed before publishing your program as crashs are very likely depending of the platform the program is executed on, but also because such errors could be maliciously used.

How can puts() find the end of an array without a \0 terminator?

3 Answers3