scope rules in C

Question

I recently read about scope rules in C. It says that a local or auto variable is available only inside the block of the function in which it is declared. Once outside the function it no longer is visible. Also that its lifetime is only till the end of the final closing braces of the function body.

Now here is the problem. What happens when the address of a local variable is returned from the function to the calling function ?

For example :-

 main()
 {
     int *p=fun();
 }

 int * fun()
 { 
     int  localvar=0;
     return (&localvar);
 }

once the control returns back from the function fun, the variable localvar is no longer alive. So how will main be able to access the contents at this address ?

Answer 1

The address can be returned, but the value stored at the address cannot reliably be read. Indeed, it is not even clear that you can safely assign it, though the chances are that on most machines there wouldn't be a problem with that.

You can often read the address, but the behaviour is undefined (read 'bad: to be avoided at all costs!'). In particular, the address may be used for other variables in other functions, so if you access it after calling other functions, you are definitely unlikely to see the last value stored in the variable by the function that returned the pointer to it.

---

Why then is a function returning a pointer ever required?

One reason is often 'dynamic memory'. The malloc() family of functions return a pointer to new (non-stack) memory.

Another reason is 'found something at this location in a value passed to me'. Consider strchr() or strstr().

Another reason is 'returning pointer to a static object, either hidden in the function or in the file containing the source for the function'. Consider asctime() et al (and worry about thread-safety).

There are probably a few others, but those are probably the most common.

Note that none of these return a pointer to a local (stack-based) variable.

Answer 2

Referencing that location in memory after the function has returned is dangerous. Of course the location still exists (and it may still contain your value), but you no longer have any claim to that memory region and it will likely be overwritten with new data as the program continues and new local variables are allocated on the stack.

gcc gives me the following warning:

t.c: In function ‘test’:
t.c:3:2: warning: function returns address of local variable [enabled by default]

Consider this test program:

int * test(int p) {
    int loc = p;
    return &loc;
}

int main(void) {
    int *c = test(4);
    test(5);
    printf("%d\n", *c);
    return 0;
}

What do you think this prints?

Answer 3

The variable is gone, but the memory location still exists and might even still contain the value you set. It will however probably get overwritten pretty fast as more functions are called and the memory address gets reused for another function's local variables. You can learn more by reading about the Call Stack, which is where local variables of functions are stored.