Question about malloc()

I have a question regarding the following code

Code:

---

/*I omitted checking malloc() for NULL and didnt use free();
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {
    char *p = malloc(sizeof *p);
    strcpy(p, "Hello, world!");

    printf("%s\n", p);

    return 0;
}

---

When I run it, I get:

$gcc -Wall str.c -o str
$./str
Hello, world!
$


The question is if

Code:

---

char *p = malloc(sizeof *p);

---

only allocates on byte, then how come the entire string can be copied to p since the string is like 15 bytes vs one.

Luck. C doesn't do boundry checking. If you want to trash your memory, it lets you.


Quzah.

the string does not get copied to the pointer. the address of the first character of the string gets copied.

thus printf goes to the address of the beginning of the string and spits out everything until it sees a '\0'

> gcc -Wall str.c -o str
What does this do when you run it?

gcc -Wall str.c -o str -lefence

> the string does not get copied to the pointer
Yes it does.


> then how come the entire string can be copied to p since the string is like 15 bytes vs one.
Maybe so, but the next call to malloc or free is likely to have a lot more "fun"

Running the code with full warnings produced nothing.

$gcc -Wall str.c -o str
$./str
Hello, world!

Running efence(3) with the default arguments produced the following:

$gcc -Wall str.c -o str -lefence
$./str

Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <[email protected]>
Segmentation fault
$gcc -Wall -g str.c -o str -lefence
$gdb str
GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-suse-linux"...Using host libthread_db library " /lib/tls/libthread_db.so.1".

(gdb) run
Starting program: /home/cdalten/str

Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <[email protected]>

Program received signal SIGSEGV, Segmentation fault.
0x40094ee6 in strcpy () from /lib/tls/libc.so.6
(gdb) bt
#0 0x40094ee6 in strcpy () from /lib/tls/libc.so.6
#1 0x0804853c in main () at str.c:8

Ahahahaha. The silent heap abuse! Okay, point proven. You win.

Quote:

---

Originally Posted by jmholber

the string does not get copied to the pointer. the address of the first character of the string gets copied.

---

uh... WTF were you thinking?

Schitzo?