Analysis on character pointer with dynamic memory allocation

Question

I have written the following code in C. I need to understand how the string copy operations will be performed after the character pointer gets assigned memory via malloc() dynamically.

My code:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#define BUFFSZ 20
int main()
{
        char *name = NULL;
        char my_name[BUFFSZ] ;
        memset(my_name,0,BUFFSZ);
        strcpy(my_name,  "vinothkumarsaradavallivaradathirupathi");
        printf("string copied is %s\n",my_name);
        if ((name = malloc(1 + strlen(my_name)+1)) != NULL)
                strcpy(name,my_name);
        printf("Name is %s\n",name);
        free(name);
        name = NULL;
        return 0;
}

Actual output:

string copied is vinothkumarsaradavallivaradathirupathi
Name is vinothkumarsaradavalliva��

According to the code, I have expected the output below but got only one above. It will be helpful if someone explains this clearly.

Expected output:

string copied is vinothkumarsaradaval
Name is vinothkumarsaradaval

When I ran this code in GDB, I got the following output:

Breakpoint 2, main () at first_pgm.c:12
12              memset(my_name,0,BUFFSZ);
(gdb) n
14              strcpy(my_name,  "vinothkumarsaradavallivaradathirupathi");
(gdb) p name
$1 = 0x0
(gdb) p my_name
$2 = '\000' <repeats 19 times>
(gdb) n

Breakpoint 3, main () at first_pgm.c:15
15              printf("string copied is %s\n",my_name);
(gdb) p my_name
$3 = "vinothkumarsaradaval"
(gdb) n
string copied is vinothkumarsaradavallivaradathirupathi

Here, why "$3" and "string copied" outputs are conflicting?

Answer 1

Expected Output

Wait. You cannot have an expected output out of this code. This code produces undefined behavior.

In your code

 strcpy(my_name,  "vinothkumarsaradavallivaradathirupathi")

you're overrunning the allocated memory. In your case my_name does not have enough memory to hold the complete content of the source string literal.

Result: undefined behavior.

Please allocate enough memory to the destination buffer so that it can hold the source string and the null-terminator.

That said,

1. Do not cast the return value of malloc() and family.

2. The recommended (rather, required) signature of main() is int main(void) when you're not intending to use any command line arguments.

Answer 2

You are copying 19 bytes more than allowed, that causes undefined behavior. Because your array can only store 20 characters but you are copying 39 to it.

Just change

#define BUFSIZE 39

and it will work.

Also, this

if (NULL != (name = (char *)malloc(sizeof(char)*(strlen(my_name)+1))))

is extreamly ugly,

1. Don't cast the return value of malloc() which is void * and it is converted to any other pointer type without casting.
2. Don't use sizeof(char) because it's 1 by definition.

Fixing the code it would look like

if ((name = malloc(1 + strlen(my_name))) != NULL)

And you check for NULL but you still do this

printf("Name is %s\n", name)

this will cause undedfined behavior in case name == NULL.

Answer 3

This is a classic buffer overflow. strcpy will not stop writing characters into its destination buffer until it finds a terminating '\0' character. The memory into which it is writing is implementation-defined, which is why you can't reliably read it back out. Use strncpy to put a ceiling on the amount of data strcpy will copy.