Using malloc(0) and memcpy

Question

I read somewhere: Dereferencing a pointer returned by a "new" allocation of size zero is UB. Is it same in C? If yes, is the following code UB? (assuming size = 0)

 a->object[index].data = malloc(size);  
 memcpy(a->object[index].data, bytes, size);

To my understanding: NO. Just wanted to double check.

Answer 1

When you pass 0 as an argument to malloc, then it free the allocated memory to the pointer which malloc returns to.

Result is implementation defined.

C11: 7.22.3 Memory management functions:

[...] If the size of the space requested is zero, the behavior is implementation-defined: either a null pointer is returned, or the behavior is as if the size were some nonzero value, except that the returned pointer shall not be used to access an object.

Also standard says:

The free function causes the space pointed to by ptr to be deallocated, that is, made available for further allocation. If ptr is a null pointer, no action occurs.

So, in either case of implementation defined behavior, freeing will not invoke undefined behavior.

Now moving to another part of the question.

7.1.4 Use of library functions:

If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined.

C11: 7.24.1 p(2):

Where an argument declared as size_t n specifies the length of the array for a function, n can have the value zero on a call to that function. Unless explicitly stated otherwise in the description of a particular function in this subclause, pointer arguments on such a call shall still have valid values, as described in 7.1.4. On such a call, a function that locates a character finds no occurrence, a function that compares two character sequences returns zero, and a function that copies characters copies zero characters.

Answer 2

According to my reading of the current standard (or n1570, the final public draft of it), the code has Undefined Behaviour:

7.24.1 String function conventions

2. Where an argument declared as size_t n specifies the length of the array for a function, n can have the value zero on a call to that function. Unless explicitly stated otherwise in the description of a particular function in this subclause, pointer arguments on such a call shall still have valid values, as described in 7.1.4.

7.1.4 Use of library functions

1. Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined.

(Emphasis added.)

Answer 3

 size_t size = 0;
 a->object[index].data = malloc(size);  
 memcpy(a->object[index].data, bytes, size);

Technically, it is undefined behavior.

malloc may return a null pointer for an allocation of zero bytes and passing a null pointer to memcpy is undefined behavior (even if ìts third argument is 0).

From the mighty C Standard (emphasis mine):

(C99, 7.1.4p1) "[...] unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined"