strcat() implementation works but causes a core dump at the end

Question

My implementation of strcat(char*, const char*) seems to work but then it causes a core dump.

strcat() implementation:

char* strcat(char* dest, const char* src)
{
    char* tmp = dest;
    while(*tmp) ++tmp ;
    while( (*tmp++ = *src++ ) != '\0') ;
    return (dest);
}

Code in int main() where I call strcat():

char arr3[] = "Mr. ";
char arr4[] = "Smith";
printf("Hello %s!", strcat(arr3, arr4));

It actually concatenated both strings and printed it out but still caused a core dump.

output : Hello Mr. Smith!Aborted (core dumped)

What did I do wrong?

Although old and you have accepted but read updated answer added some interesting details... — Grijesh Chauhan, Jul 08 '13 at 18:15
That's probably because when you don't specify a size, the array automatically chooses the ideal size to fit its contents. So `arr3` is 5 bytes long, and adding `"Smith"` requires a 10-byte string. Why it's a core dump rather than a segmentation fault, I cannot tell you. — Braden Best, Jan 03 '16 at 23:54

Grijesh Chauhan · Accepted Answer · 2013-07-08T09:11:13.993

Your program doing buffer overflow at runs time, by strcat(arr3, arr4) because arr3 size is just equals to length of "Mr." string , it has no extra memory space for extra chars (from arr4).

size of arr3 should be atlest string length of a "Mr. " + "Smith" + 1
(extra 1 for string termination \0 char)

My Suggestion is use dynamic memory allocation for sufficient size buffer, do something like code below:

char arr3[] = "Mr. ";
char arr4[] = "Smith";
length = strlen(arr3) + strlen(arr4) + 1;  //cal-length (sufficient long buffer)
char* new_arr = malloc(length);  // allocate memory 
strcpy(new_arr, arr3);  // copy first string 
strcat(new_arr, arr4);  // then check your function to concat strings

Reason of Core-Dump:

In your code :

char arr3[] = "Mr. ";

The size of arr2 is = length of string "Mr." length + 1 (1 because of \0) chars. The strcat() first moves temp pointers to point null in first while loop while(*tmp) ++tmp ;.

After that in second while loop while( (*tmp++ = *src++ ) != '\0') ; you are trying to accessing and assigning on memory that is not allocated ( my be out of your process control) and access a memory that you have not allocated is undefined behavior in C.

Edit:

In code arr3 is something like below in diagram, where temp points to arr3 array:

                arr3

   temp          5   6  7  8    
  +-----+      +--+--+--+---+
  | 5   +----->|M |r |. |\0 |
  +-----+      +--+--+--+---+

when loop while(*tmp) ++tmp ; breaks temp starts pointing to memory location 8 where null \0 is stored, like below diagram.

                arr3

   temp          5   6  7  8    
  +-----+      +--+--+--+---+
  | 8   |      |M |r |. |\0 |
  +-----+      +--+--+--+---+
     |                    ^
     +--------------------|

When you do temp++ in loop while( (*tmp++ = *src++ ) != '\0') ; , temp increment to point to memory location 9 and onwards, but access and assigning on memory 9, 10.. is illegal because its not allocated. This causes OS kernel send a signal core dump to the your process which caused the exception. (interesting to note: as OS detects memory right violation by a process -- An invalid access to valid memory gives: SIGSEGV And access to an invalid address gives: SIGBUS).

Program Error Signals:
When one of these program error signals terminates a process, it also writes a core dump file which records the state of the process at the time of termination. The core dump file is named `core' and is written in whichever directory is current in the process at the time. (On the GNU system, you can specify the file name for core dumps with the environment variable COREFILE.) The purpose of core dump files is so that you can examine them with a debugger to investigate what caused the error.

If you allocates extra memory (as @JerryCoffin and @Paul R suggested) then you can access memory beyond \0 (memory location 8) is no problem.

Note: If you not gives size at declaration then size of array will be equals to size of string e.g. in char arr3[] = "Mr. "; size is 5. But if you give size explicitly as char arr3[84] = "Mr. "; then size of aar3 will be 84 and initial memory contains Mr. then 0 in rest of all locations.

In my solution I completely allocate new memory blocks that is as large as both string arr3 and arr4 can be stored with null symbol using dynamic memory allocation (malloc() function). Additionally If you allocates dynamic memory using ptr = malloc() or ptr = calloc() then you should free memory explicitly when work done using free(ptr).

So the only thing stopping me from going beyond the '\0' is the OS Kernel? On a machine without an OS, could I go beyond? — Davlog, Jul 12 '13 at 15:41
@Davlog Not `'\0'`, but beyond the allocated space. How can you run your simple C code on a machine without OS (second question is not valid). — Grijesh Chauhan, Jul 12 '13 at 15:49

score 2 · Answer 2 · answered May 25 '13 at 15:22

You haven't allocated any additional space in str3 so attempting to append characters using strcat will overflow the allocated storage - change your code to e.g.:

char arr3[80] = "Mr. "; // <<< allocate additional storage for appending more characters
char arr4[] = "Smith";
printf("Hello %s!", strcat(arr3, arr4));

score 1 · Answer 3 · answered May 25 '13 at 15:23

1

The problem isn't with your strcat, but with how you're using/invoking it. You're writing past the end of the target array.

Change arr3 to something like char arr3[32] = "Mr. "; and all will be well.

answered May 25 '13 at 15:23

Jerry Coffin

476,176
80
629
1,111

would it work if I use malloc() inside the function for dest? – Davlog May 25 '13 at 15:26
@Davlog basic problem is that `arr3` is small, it has no extra space to accommodate extra chars from `arr4`, even if you allocates memory using `malloc()` it will you `strcat()` work if you allocate extra spaces – Grijesh Chauhan May 25 '13 at 15:44
@Davlog: You could, for example, allocate a new block of memory as large as both input strings (+1 for a NUL terminator) and create a concatenated string there. That would be different from how `strcat` normally works though. – Jerry Coffin May 25 '13 at 16:02

strcat() implementation works but causes a core dump at the end

3 Answers3

Linked