Strange segment fault when initialize using {0} in GCC

Question

Here is the code:

char s[8];
int i = 0;
void **p = &s;
for (; i < 8; ++i) {
    putchar( ((char*)(*p))[i] );
}

The code above could work but gave some rubbish chars. So what I did was simply initialize s[8]:

char s[8] = {0};

Then segmentation fault, but if I compile and run it using VC++, it works fine. Weird. Could anybody explain? Thanks!

UPDATE: So many guys said the codes above were stupid... this update is for you. What the original codes look like:

static void* 
copy_and_move(void **dst, int dsz, const void **src, int ssz) {
      const int sz = ssz > dsz ? dsz : ssz;      
      memcpy(*dst, *src, sz);
      return *dst + sz;
}

Then the calling codes:

char d[10], s[8];
copy_and_move(&d, sizeof(char) * 10, &s, sizeof(char) * 8);

Answer 1

Let's see:

void **p = &s;

There, p points to s, that is, it contains the address of the first byte of s.

And it is a pointer-to-pointer, so *p is read as a pointer, it will use the first n bytes of s, being n equal to sizeof(void*) (4 or 8).

And then you are using that pointer *p to read bytes of memory...

Now, which bytes are in the memory of s that will be read as a memory address?

• If the array is uninitialized: garbage, that in VC++ happens to look like a real pointer to who-knows-where. You read some random bytes.
• If the array is initialized to {0], they will be all zeroes, so *p will be a NULL pointer and segfaults.

Answer 2

Your expression void **p = &s; is equivalent to void **p = &s[0];. Now subsequent *p gives you s[0], after which ((char*)(*p))[i] is s[0][i], which after initialization would be equivalent to *(((char*)0)+i), or, at first iteration, *(char*)NULL.

Answer 3

void **p = &s; There is no rational reason to cast an array pointer into a pointer-to-pointer-to-void. There is no reason to use a void** at all.

So the code doesn't make any sense, this is what it actually does:

void **p = &s;

You tell the program that the address of an array should be stored in a pointer variable. That pointer variable assumes that the address given in turn points to another valid address. This is incorrect.

(char*)(*p)

Here you take the contents of the pointer-to-pointer and treats it as an address. But the contents of the pointer is the actual data of the array. You are invoking undefined behavior.

(char*)(*p)[i]

Here you are taking any random garbage address and treating it as if it was an array. This is also undefined behavior.

And since undefined behavior means that anything can happen, the program could crash or the program can seem to work okay. It is not meaningful to analyse why you get a certain program behavior when you invoke undefined behavior. Simply accept that your program contains bugs that you may or may not detect when you execute, depending on compiler and system.

Answer 4

So, as you say,

char s[8] = {0};
int i = 0;
void **p = &s;
for (; i < 8; ++i) {
    putchar( ((char*)(*p))[i] );
}

segfaults.

What you do is

• declare a void ** pointing to your original char[]
• use that void ** by continuously casting it.

I don't know if it hurts anyway, but it is unneededly complicated, leading to errors.

Let's have a closer look:

You do ((char*)(*p))[i], i. e. you dereference p - which points to your array - getting the value stored there as a pointer. This is dereferenced again in order to get the chars.

This is wrong.

Unless you are trying out something, I'd suggest

for (; i < 8; ++i) {
    putchar(s[i]);
}

If you want to learn what happens in the original case, I'd further suggest to break ti down into parts:

char s[8] = {0};
int i = 0;
void **p = &s;
char * base = *p;

printf("&s: %p\n", &s);
printf("p: %p\n", p);
printf("*p: %p\n", *p); // be aware that even this might be undefined...
printf("base: %p\n", base);
for (; i < 8; ++i) {
    putchar( base[i] ); // will lead to crash.
}

It is undefined behaviour to take a random bunch of bytes and treating them as a pointer.

Anything may happen here. In this case, the bytes consist of all NUL bytes (s is initialized with 0 all over its length), in your original case, the data were uninitialized and by luck containing a valid pointer (on the stack, this is likely to happen). Undefined nevertheless.

Answer 5

Too many *: p holds the address of the array. *p dereferences that pointer, and interpretes the array contents as void *. This pointer contains rubbish, including that 0 you used for initialization. So you have to drop one level of *:

void *p = &s;
for (; i < 8; ++i) {
    putchar( ((char*)(p))[i] );
}

Answer 6

As

void ** p = &s; /* p points to an array of 8 char. */

loses significant type information, apply it back by casting first, and dereference after, like so:

putchar( (*((char(*)[8]) p))[i] );

Answer 7

As explain in a comment, this is why you have sigfault:

How come an array's address is equal to its value in C?

In short:

if you declare an array as static, char array[N], array and &array have the same address;

if you declare an array as pointer, char * array, array and &array have a different address;