Returning an address of local variable behaviour

Question

Possible Duplicate:
Can a local variable's memory be accessed outside its scope?

input:

#include <stdlib.h>
#include <stdio.h>
int func2(void);
int* func1(void);

int func2(void)
{
    int* b;
    b = func1();
    printf("%d", *b);
    printf("%d", *b);
    printf("%d", *b);
}

int* func1()
{
    int a = 13;
    return &a;
}

int main()
{
    func2();
}

Output:

13 -1077824828 -1077824828

Can someone explain what happened in the stack and OS? Why the result changed from 13 to garbage after getting the value of the pointer?

Duplicate number infinity plus one. This is undefined behaviour. — Cat Plus Plus, Sep 13 '12 at 21:04
Further, `func2` doesn't `return` anything although it's defined with return type `int`. — Daniel Fischer, Sep 13 '12 at 21:06
To actually answer the question: In your particular case, the first call to `printf()` overwrites the `13` that was leftover on the stack from the call to `func1()`. — Mysticial, Sep 13 '12 at 21:07
Undefined by language standard. Perfectly defined by implementation. — Pavel Radzivilovsky, Sep 13 '12 at 21:09

score 1 · Answer 1 · answered Sep 13 '12 at 21:05

1

Calling printf creates a new stack frame that overwrites the location previously occupied by a.

answered Sep 13 '12 at 21:05

StoryTeller - Unslander Monica

165,132
21
377
458

2

Maybe, or maybe not. You can't really reason in a general sense about what happens when you invoke undefined behavior. – Ed S. Sep 13 '12 at 21:07
Of course you can. Dima is right. It is perfectly defined, but is platform dependent. – Pavel Radzivilovsky Sep 13 '12 at 21:08

score 1 · Accepted Answer · answered Sep 13 '12 at 21:06

1

Sure. The result will differ between debug and release (clean). A local variable is EBP-(some offset) if you look at the assembly. This means, HIGHER IN STACK, as in "further".

This is the address you return.

Normally it would be untouched if the function just returns. In debug build on some compilers, it would be garbaged on purpose to help you catch the dangling pointer error faster. Now, printf call reuses the same addresses in the stack to pass parameters and for its own local variables (it has some). They will be written to the address emptied by func1 return, thus overwriting whatever is pointed by the address you obtained.

answered Sep 13 '12 at 21:06

Pavel Radzivilovsky

18,794
5
57
67

why would printf pass parameters to the stack? aren't they sent to stdout buffer directly? – Nizarazo Sep 13 '12 at 21:32
No they are not and it is important: compiler which is producing the caller code, must not know what "printf" means, and in particular what this function is going to do - like working with stdout. – Pavel Radzivilovsky Sep 14 '12 at 21:41

Returning an address of local variable behaviour

2 Answers2

Linked

Related