#include<stdio.h>
int main()
{
char str[10];
scanf("%[^\n]", str);
printf("%s\n", str);
}
when this is compile and input is given as "subhash das india". Output is same as subhash das india. I want to know how the string is stored in memory as str size is 10 and size of input given is greater than 10.
printf will continue to print until it finds the null (terminating character):\0 thus although only 10 bytes are set aside the text will still be put in the array as str is just a pointer to an array.
The array str takes 10 bytes from stack of the application.
Some compilers calculate the required stack size by simply sum the number of bytes of all variables, arrays and structures located on stack in all functions plus the number of bytes all function arguments and the function calls would need. But this stack size calculation is definitely always wrong as not all functions are called in a sequence.
Therefore many compilers often define a fixed stack size which is allocated on start of the application before main is called. The stack size can be controlled by a developer, for example when an application needs more than applications usually need because of lots of recursive function calls.
For example, take a look on the Visual Studio page about /F (Set Stack Size). The default stack size for C/C++ applications compiled with Visual C/C++ have 1 MB of stack.
Therefore it is no problem on your simple code that a string with more than 10 bytes is copied on stack to the location on which str points. The string from scanf is terminated with a null byte. printf simply outputs bytes until a null byte is found.
But if you would modify your code by adding a function which contains for example also an array located on stack which is additionally also initialized with something, and this function is called between scanf and printf, you would see a different string on output as used on input.
scanf and printf should be both not used anymore because of no check on array sizes. The C/C++ libraries and the various frameworks/libraries offer more secure functions which check the sizes of the string arrays.
The first ten characters are stored in the array, the rest in the bytes right after the array in memory. You don't know what was supposed to be stored in these bytes, nevertheless you overwrite them with the string "s india". This is bad. Even though it might work in this case, it is not even likely that it will work with a different compiler / on a different system / when you you run the program again.
printf() does not care what you have overwritten, it will only search the string for the terminating null byte, which happens to come somewhere after the end of the array. The unexpected behavior is not likely to take effect until you return from your function (main() in this case), which may segfault, or use some other variables declared in main() which happen to have been overwritten by scanf().
Note, that the behavior of your program is entirely undefined. It is allowed to format your harddrive. It is allowed to save a backup of your computer to the NSA. It is allowed to download a nifty little program that will automatically redirect your browser the next time you try to do online banking. These are real dangers, code like the one you've given is at the heart of the most easily exploitable security holes.
If you want to be safe, use the POSIX-2008 functions: getline() to read entire lines and asprintf() to replace use of sprintf() and strcat(). The GNU implementation of the standard C library also allows you to use the format "%as" with scanf() to allocate enough memory for the string that is to be read, but that is not a part of a standard.
