Thread: Dereferencing mystery?

I find it strange that NULL is passed to printf below. Since p is NULL, it seems more likely that p->s would blow up before the function call.

Code:

#include <stdio.h>
 
typedef struct {
    char s[100];
} Object;
 
int main() {
    Object *p = NULL;
    printf("%s\n", p->s);   // prints (null)
    return 0;
}

Originally Posted by john.c

I find it strange that NULL is passed to printf below. Since p is NULL, it seems more likely that p->s would blow up before the function call.

Code:

#include <stdio.h>
 
typedef struct {
    char s[100];
} Object;
 
int main() {
    Object *p = NULL;
    printf("%s\n", p->s);   // prints (null)
    return 0;
}

s is the first member of struct "Object". So the address of the member is constrained to be the same as the address of the structure. You are treating NULL as the base address of the Object pointed to by p, and taking the address of the array s, which is also constrained to be null.
If printf() is documented as handling a NULL argument to %s, it is not actually undefined behaviour.

@christop, Obviously it's undefined behavior. That's not the point. And I have no problem with printf printing "(null)". The point is how does the printf get called at all? Why doesn't it blow up as soon as the p->s is executed (i.e., obviously before the printf call)? Remember that p->s means (*p).s. One might expect that *p would blow up, since it is dereferencing NULL.

But because it's "undefined behavior" to dereference a NULL the implementation is allowed to just assume p is not NULL, notice that s is the first member, and simply pass the value of p cast to the type of s.

So the answer has to do with char s[100] being the first member in the struct, as Malcolm points out. Move it to second place and it segfaults.

Originally Posted by christop

Ah, I think Malcolm hit the nail on the head. I overlooked that it's an array. It's an array so it "decays" to a pointer to the first element of the array, and since it's the first field in the struct it has the same address as the struct itself.

But dereferencing a NULL pointer like that is still undefined behavior, AFAIK, that just happens to give you "expected" results.

To be fair, you'd have to go through the C standard chapter and verse to see whether it is defined or not. It's clearly buggy code.