How does *(&arr + 1) - arr give the length in elements of array arr?

Question

#include <iostream>
using namespace std;

int main() { 
   int  arr[5] = {5, 8, 1, 3, 6};
   int len = *(&arr + 1) - arr;
   cout << "The length of the array is: " << len;
   return 0;
} 

For the code above, I don't quite understand what these two pieces of codes are doing:

*(&arr + 1) 

and

*(&arr)
&arr

Could someone explains? Because when I run the following two codes, I get the same output for the following:

&arr (I think this point to the address of the first element of arr)

*(&arr) then I don't quite understand what this do, what does the symbol * do to &arr (i.e. to the address here)?, because the two outputs are the same when I run them

and finally what is it exactly happening when an integer say 1 is added to the address by this code here: &arr + 1

Answer 1

This is a mine field, but I'll give it a try:

• &arr returns a pointer to an int[5]
• + 1 steps the pointer one int[5]
• *(&arr + 1) dereferences the result back to an int(&)[5]
  I don't know if this causes undefined behavior, but if it doesn't, the next step will be:
• *(&arr + 1) - arr does pointer arithmetics after the two int[5]'s have decayed to int pointers, returning the diff between the two int pointers, which is 5.

---

Rewritten to make it a bit clearer:

int  arr[5] = {5, 8, 1, 3, 6};

int (*begin_ptr)[5] = &arr + 0;     // begin_ptr is a  int(*)[5]
int (*end_ptr)[5]   = &arr + 1;     // end_ptr is a    int(*)[5]

// Note:
//       begin_ptr + 1        ==  end_ptr
//       end_ptr - begin_ptr  ==  1

int (&begin_ref)[5] = *begin_ptr;   // begin_ref is a  int(&)[5]
int (&end_ref)[5]   = *end_ptr;     // end_ref is a    int(&)[5]   UB here?

auto len = end_ref - begin_ref; // the array references decay into int*
std::cout << "The length of the array is: " << len << '\n'; // 5

I'll leave the question if it's UB or not open but referencing an object before the referenced storage has been allocated does look a bit suspicious.

Answer 2

Given the following facts:

• When you increment/decrement a pointer by an integral value X, the value of the pointer is increased/decreased by X times the number of bytes of the type the pointer is pointing at.

• When you subtract 2 pointers of the same type, the result is the difference between their held addresses, divided by the number of bytes of the type being pointed at.

• When you refer to an array by its name alone, it decays into a pointer to the array's 1st element.

The type of your arr variable is int[5], ie an array of 5 ints. &arr returns an int[5]* pointer to arr (technically, it is actually written like int(*)[5], but lets not worry about that here, for simplicity). Lets call this pointer temp below.

Then, the + 1 increments the value of temp by 1 int[5] element. In other words, the address stored in temp is increased by 1 * sizeof(int[5]), or 1 * (sizeof(int) * 5), number of bytes. This effectively gives you an int[5]* pointer to the end of arr (ie, to &arr[5]). No int[5] element physically exists at that memory address, but it is legal to create a pointer to it, for purposes of pointer arithmetic.

Dereferencing temp gives you a reference to an int[5] at the end of arr. That reference decays into an int* pointer when passed to operator-.

In - arr, the reference to arr decays into an int* pointer to arr[0] when passed to operator-.

Thus, given this code:

int len = *(&arr + 1) - arr;

Which is effectively the same as this:

int len = &arr[5] - &arr[0];

Which is effectively the same as this:

int len = (<address of arr[5]> - <address of arr[0]>) / sizeof(int);

Thus, the result is 5.

Answer 3

Example:

int  arr[] = {1, 2, 3, 4, 5, 6}; 
int size = *(&arr + 1) - arr; 

Here the pointer arithmetic does its part. We don’t need to explicitly convert each of the locations to character pointers.

&arr ==> Pointer to an array of 6 elements. [See this for difference between &arr and arr]

(&arr + 1) ==> Address of 6 integers ahead as pointer type is pointer to array of 6 integers.

*(&arr + 1) ==> Same address as (&arr + 1), but type of pointer is "int *".

*(&arr + 1) - arr ==> Since *(&arr + 1) points to the address 6 integers ahead of arr, the difference between two is 6.

Answer 4

Maybe I am too late to join the discussion, but I think this is a good question and it deserve a more thorough answer.

I originally see the op snippet at here

There are total 4 operations here.

What &arr actually does is to dynamically creating a 2d array, with its first dimension equal to 1, and get the pointer point to the head of this 2d array. If you are not familiar with the 2d array, Shahbaz have introduce it very well at Why can't we use double pointer to represent two dimensional arrays?
In particular, it is the structure of array2 in the post, and the pointer point to this newly created 2d array has type int (*)[5]

The +1 in &arr+1 do the pointer arithmetic on it first dimension. Recalled that the first dimension is just 1. This is exactly why the (&arr + 1) points to the memory address right after the end of the original array.

The * in *(&arr + 1) convert the 2d array pointer (which has type int (*)[5]) back to one dimensional array pointer (which has type int*).

Finally the - arr in *(&arr + 1) - arr is a pointer subtraction. According to the standard (N1570):

6.5.6 Additive operators
....
⁹ When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements.

One final question arised, In the discussion of How do I determine the size of my array in C? We know that the sizeof method only work for arrays on stack, but how about this method? Unfortunately, this method also work on stack only. If you receive the pointer of array inside a function, the array size information is loss and you have no way to dynamically create a 2d array for it. The pointer arithmetic follows will simply fall apart.

Answer 5

&arr ==> Pointer to an array of n elements. (&arr + 1) ==> Address of 6 integers ahead as pointer type is pointer to array of n integers.

*(&arr + 1) ==> Same address as (&arr + 1), but type of pointer is "int *".

*(&arr + 1) - arr ==> Since *(&arr + 1) points to the address n integers ahead of arr, the difference between two is n.

1. (&arr + 1) points to the memory address right after the end of the array.
2. *(&arr + 1) simply casts the above address to an int *.
3. Subtracting the address of the start of the array, from the address of the end of the array,​ gives the length of the array.

MORE ON THIS...>>>>>>>>>>>

The trick is to use the expression (&arr)[1] - arr to get the array arr size. Both arr and &arr points to the same memory location, but they both have different types.

1. arr has the type int* and decays into a pointer to the first element of the array. Hence, any knowledge about the size of the array is gone.

2. &arr results in a pointer of type int (*)[n], i.e., a pointer to an array of n ints. So, &arr points to the entire array and *(&arr + 1) (or &arr)[1]) points to the next byte after the array.

This works because of the way pointer arithmetic works in C. We know that a pointer to int is advanced by sizeof(int) when incrementing by 1. Similarly, a pointer to int[n] is advanced by sizeof(int[n]), which is the size of the entire array.