What is the default behavior of uninitialized c++ pointer

Question

I have the following code to reverse a linked list. Why do I get a runtime error:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==31==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x000000370a97 bp 0x7fffed631a10 sp 0x7fffed6318c0 T0)
==31==The signal is caused by a READ memory access.
==31==Hint: address points to the zero page.
    #4 0x7f165e0300b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
AddressSanitizer can not provide additional info.
==31==ABORTING

IF I comment out the line "cout<<pre<<endl;"?

/**
 * Definition for singly-linked list.
 * struct ListNode {
 *     int val;
 *     ListNode *next;
 *     ListNode() : val(0), next(nullptr) {}
 *     ListNode(int x) : val(x), next(nullptr) {}
 *     ListNode(int x, ListNode *next) : val(x), next(next) {}
 * };
 */
class Solution {
public:
    ListNode* reverseList(ListNode* head) {
        if(!head) return head;
        ListNode* temp = head;
        ListNode* pre;
        cout<<pre<<endl;
        ListNode* cur = head;
        while(cur->next){
            temp = cur->next;
            cur->next = pre;
            pre = cur;
            cur = temp;
        }
        cur->next = pre;
        return cur;
    }
};

if I don't comment out the line, cout would print a random address each time, and the program would successfully reverse the linked list without any errors. Link to the problem: https://leetcode.com/problems/reverse-linked-list/

Answer 1

An uninitialized variable has an indeterminate value (except when the variable is declared in static memory, then it has an initial value of 0 if you don't set a value explicitly). See Default variable value.

In the case of pointers, trying to dereference a pointer that is not pointing at valid memory is undefined behavior.

In your example, you need to initialize pre to NULL for your code to work correctly, otherwise your list will end up corrupted, containing invalid pointers.

For example, say you start with this list:

----------       ----------       ----------
| val=1  |   /-> | val=2  |   /-> | val=3  |
| next=2 | -/    | next=3 | -/    | next=0 |
----------       ----------       ----------
    ^
    |
head, cur

After the 1st loop iteration, the list will now look like this:

----------       ----------       ----------
| val=1  |       | val=2  |   /-> | val=3  |
| next=P |       | next=3 | -/    | next=0 |
----------       ----------       ----------
                     ^
                     |
                    cur

After the next iteration, the list will now look like this:

----------       ----------       ----------
| val=1  | <-\   | val=2  |       | val=3  |
| next=P |    \- | next=1 |       | next=0 |
----------       ----------       ----------
                                      ^
                                      |
                                     cur

And then the loop ends, cur->next is updated one last time, so the list will finally look like this:

----------       ----------       ----------
| val=1  | <-\   | val=2  | <-\   | val=3  |
| next=P |    \- | next=1 |    \- | next=2 |
----------       ----------       ----------
                                      ^
                                      |
                                    return

Notice the issue?

You have effectively reversed the list, but where is next=P on the "last" node pointing?

• If pre were not initialized, then next=P would be indeterminate (let's assume pre didn't randomly initialize to NULL, which would be extremely rare). Thus, any code that tries to traverse the list afterwards will not be able to determine where the list ends, and will try to access a node that doesn't exist!

• If pre had been properly initialized to NULL instead, then next=P would be NULL as expected, terminating the list properly.

Answer 2

Consider your code:

        ListNode* pre;
        cout<<pre<<endl;
        ListNode* cur = head;
        while(cur->next){
            temp = cur->next;
            cur->next = pre;

pre is clearly uninitialized, and is used to initialize cur->next, which would be head->next. So, head->next would hold an uninitialized pointer value when the routine returns.

If there is code checking your Solution after calling it, that code would need to validate the an invalid pointer value, which would lead to undefined behavior.