C - strcpy with malloc size less than argument's size

Question

char* init_array()
{
    const int size = 5;
    char *p = (char*) malloc(size * sizeof(char));
    strcpy(p, "Hello, world! How are you?");

    return p;
}

with size = 5, malloc should get 5 free chars from memory, but given string does not fit into 5 chars, yet it works.

My question is why? First I thought the result would get truncated but p is the fully string, not just "Hello" or "Hell\0"

I'm using GCC on Linux. Is it related to the compiler or it is standard stuff?

how do you know it works? what you observe is "undefined behaviour". You know your code is faulty, but these faults don't always lead to failures or crashes, in fact, anything might happen. — Andreas Grapentin, Jun 09 '15 at 14:17
Welcome to Stack Overflow! Standard warning: [Do not cast the result of malloc](http://stackoverflow.com/q/605845/1151654) — Eregrith, Jun 09 '15 at 14:18
Simply by printing the return pointer, using printf("%s", init_array()); — usrc, Jun 09 '15 at 14:19
@ usrc then, read here and read right. see the link @Eregrith added. — Sourav Ghosh, Jun 09 '15 at 14:20
When programs fail, they don't do so in a deterministic, consistent or predictable manner. — Lundin, Jun 09 '15 at 14:33
This is called **undefined behaviour**. Think about the implications of the word **undefined**. — too honest for this site, Jun 09 '15 at 14:40

Iharob Al Asimi · Accepted Answer · 2015-06-09T15:36:33.727

It's called undefined behavior, since it's undefined sometimes it works. Yes you can write past a memory block in c, but that's illegal because it invokes undefined behavior, the behavior is therefore not predictable and your program might or might not work.

What you expect from strcpy() doesn't happen because strcpy() copies as many characters as it finds before the '\0' terminating byte, it doesn't care if the destination buffer is large enough, that's something you must be responsible about.

If you want to copy an exact number of bytes (let's say 5) you can use

memcpy(p, "Hello, this string is very large but it doesn't matter", 5);

but beware that p is not a valid string after that, because it has no terminating '\0'.

You also have 2 other common bad practice that new c programmers do

You don't need to cast the return value from malloc().
You don't need to use sizeof(char) because it's 1 by definition.

So,

p = malloc(size);

should be enough to allocate space for a size - 1 characters string.

I hereby suggest to replace `mistake` with `bad practice`. Would you mind? :-) — Natasha Dutta, Jun 09 '15 at 15:01

score 0 · Answer 2 · answered Jun 09 '15 at 14:18

0

What you are experiencing is a buffer overflow

In short, you write to invalid memory addresses invoking Undefined Behavior. Anything can happen.

answered Jun 09 '15 at 14:18

Spikatrix

20,225
7
37
83

haccks · Answer 3 · 2015-06-09T14:24:16.667

0

It seems that it worked but in fact your code invokes undefined behavior. You are writing data to unallocated memory location.

You should note that in

strcpy(str1, str2);

strcpy has no way to check whether the string pointed to by str2 will fit into the character array str1. In your case it will continue to copy the characters from "Hello, world! How are you? to past the array p points to.

edited Jun 09 '15 at 14:24

answered Jun 09 '15 at 14:18

haccks

104,019
25
176
264

C - strcpy with malloc size less than argument's size

3 Answers3