C programme assigns a value beyond the array length limit

Question

The following code would print arr[1] ~ arr[5].

int arr[5], i=0;
while(i<5){
    arr[i]=++i;
    printf("%d, ", arr[i]);
}

My question is for an array with a fixed length: can we just add a new element behind that without any limitation?

If you did, that would be a buffer overflow - and in certain circumstances, can lead to gapping security holes. — Rowland Shaw, Apr 09 '14 at 06:54
No; fixed size arrays are a fixed size. There's no guarantee whether `i` is stored before or after the array (or, indeed, it could be in a register only and hence not in memory at all). Your code has undefined behaviour because you're indexing by `i` and incrementing `i` all between two sequence points. If you write beyond the end of the array, you're running into a [stack overflow](http://stackoverflow.com/). — Jonathan Leffler, Apr 09 '14 at 06:55
possible duplicate of [C array setting of array element value beyond size of array](http://stackoverflow.com/questions/13772057/c-array-setting-of-array-element-value-beyond-size-of-array) — Jens Gustedt, Apr 09 '14 at 07:00

score 6 · Answer 1 · edited May 23 '17 at 10:33

6

we can just add new element behind that without any limitation?

No you cannot do that. Arrays are fixed size you mention in your question and something which is fixed means it cannot be changed. You can make a linked list if you want a data structure which can grow.

Also this code invokes undefined behavior:

arr[i]=++i;

Please go through - Why are these constructs undefined behavior?

edited May 23 '17 at 10:33

Community

1
1

answered Apr 09 '14 at 06:52

Sadique

22,572
7
65
91

Or, later on probably, use dynamic allocation for the array. – Jonathan Leffler Apr 09 '14 at 06:57
@Jon - but the OP will still not be able to add items on the fly in contiguous memory location which i think the question was about. – Sadique Apr 09 '14 at 06:58
1

With `realloc()` and care, the array can grow as needed. But it isn't for beginners, and neither is a linked list. There are different sets of issues for lists versus arrays. The indexed access to the array is very convenient and not an option with a list; the incremental growth of a list is sometimes convenient, but on a 64-bit machine, the linked list node would probably be 16 bytes long (before the overhead imposed by `malloc()`), whereas the array can (probably) store 4 `int` values in the same amount of space. It will depend on what else you're going to do with the data. – Jonathan Leffler Apr 09 '14 at 07:01
@al-Khwārizmī in fact i know also it is not right. but my gcc compiler just allows the att[5] which doesnot exist and print 5 for it. Do you probably know the reason? Shouldn't it be forbiddened? – web rocker Apr 09 '14 at 07:01
2

@webrocker: No, it is not forbidden by C. If you want a language that protects you from your mistakes, you've been given the wrong language to work with (Pascal, Modula-N, Oberon, … will give you bounds checking; even C++ can if you use an array class — but C won't). This is why security people rail against C. The compiler believes you know what you're doing. – Jonathan Leffler Apr 09 '14 at 07:04
It is also of relevance here that the standard allows to have a pointer to an element just beyond the array bound. However, dereferencing it is illegal. – ajay Apr 09 '14 at 07:07
@ajay: Strictly, it isn't so much 'allows' as 'requires'; given an array `int a[N];`, you must be able to form the address `&a[N]`, but accessing the data at the address via the pointer `&a[N]` is undefined behaviour. (If you have some other pointer, such as `&i`, that happens to be at the same address, then the behaviour is defined when you access it via `&i`.) – Jonathan Leffler Apr 09 '14 at 07:08
@JonathanLeffler Please explain why must I be able to form the address `&a[N]` if I never access the value at that location? – ajay Apr 09 '14 at 07:40
Access is easy: if you have an array `int a[N];`, the valid elements are `a[0]` through `a[N-1]`, so accessing `a[N]` is accessing a non-existent element of the array and leads to undefined behaviour. Formation is trickier to track down. It is because 'the standard says so'. What is less obvious is where it says so, but in fact sections §6.5.6 Additive operators, §6.5.8 Relational operators, and §6.5.9 Equality operators all address the issue. The term to search for is 'last element'. (The relevant sections are the same in C99 and C11; the wording is extremely similar if not identical.) – Jonathan Leffler Apr 09 '14 at 14:24

C programme assigns a value beyond the array length limit

1 Answers1