A main can be changed by a function local without passing anything to the function?

ananthbv · 05-04-2004, 12:21 PM

sorry, the question should have been

"a main 'variable' can be changed by a function local without passing anything to the function?"

Hi,
I have this piece of code:

Code:

main()
{
	int i = 5;
	func();
	printf("%d", i);
}

func()
{
	int x;
	int *y = &x;
	x[4] = 20;
}

Surprisingly, this prints 20 and not 5. Someone please tell me what is happening here.

aluser · 05-04-2004, 12:37 PM

Code:

13:33 aluser@alf:~/C$ cat foo.c
#include <stdio.h>
main()
{
        int i = 5;
        func();
        printf("%d", i);
}

func()
{
        int x;
        int *y = &x;
        x[4] = 20;
}
13:33 aluser@alf:~/C$ gcc -o foo foo.c
foo.c: In function `func':
foo.c:13: error: subscripted value is neither array nor pointer

This is on gcc 3.3.3.

I can't imagine that x[4] would compile, because x is not a pointer or array and, even if the compiler wanted to interpret x as a pointer, what would be the size of its target?

What compiler are you using?

ananthbv · 05-04-2004, 12:59 PM

extremely sorry, that should be y[4], NOT x[4].

I am using the gcc compiler ( i don't know the exact version) on Redhat 7.3.

aluser · 05-04-2004, 01:03 PM

You can type gcc --version to get the version.

Using y[4] I get 5 as the output, as expected. Same with gcc 2.95.4.

aluser · 05-04-2004, 01:05 PM

still, given that change it's not inconceivable that y[4], since it goes off the end of what effectively is a one element array, ends up writing into a variable in another stack frame on your system. Somebody more familiar with the low level details should confirm.

One thing you could do to check if this is the case is printf("%p\n", &y[4]) in func() and printf("%p\n", &i) in main(), and see if the addresses are the same.

ananthbv · 05-04-2004, 01:15 PM

yeah, i tried printing all possible addresses, like
&i, &x, y, &y[0], &y[1], &y[2], &y[3], &y[4].
the addresses of i and x differed by 16. so the contents of (y + offset of 4) should give the value of i, right? but isn't this dangerous? a function may alter contents of another function and bugs like these are most difficult to find. what can i do to avoid this?

infamous41md · 05-04-2004, 01:20 PM

you're just manually moving up the stack frame into main's territory, like aluser said. here is pic of teh stack when u enter function func:

Code:

[   y             ]  // end main stack frame
[  saved eip  ]  ///begin func() stack frame
[  saved ebp ]
[   x             ]
[    y            ]

so if u count up 4 indices u can see you are invading main's stack frame and changing y. and no u should NOT be doing this.

ananthbv · 05-04-2004, 01:24 PM

right, but if i have to do it, i should declare an array of required number of elements and keep myself within the limits, is that it?

aluser · 05-04-2004, 01:24 PM

ah ok, then you understand the situation perfectly

This is a reason that not many languages have pointers like C and C++. Through a pointer you can access *any* memory address which is writable (or readable depending on what you're doing) by your process. There's really no magic answer except be careful.

If you're doing a lot of dynamic allocations you can use Electric Fence or dmalloc to help catch errors where you write past the end of an array (they do this by hacking malloc() and friends so that they always return a pointer to memory which is lined up against a non-readable non-writable page, so an overrun will seg fault). dmalloc can help debug memory leaks too.

Java (and a mess of other languages) people like to rub all this in C/C++ people's noses. C/C++ people point out that they want to tell the language what to do, not the other way around.

edit: I wrote this in response to

Quote:

yeah, i tried printing all possible addresses, like
&i, &x, y, &y[0], &y[1], &y[2], &y[3], &y[4].
the addresses of i and x differed by 16. so the contents of (y + offset of 4) should give the value of i, right? but isn't this dangerous? a function may alter contents of another function and bugs like these are most difficult to find. what can i do to avoid this?

but other responses were added in the meantime.

aluser · 05-04-2004, 01:27 PM

oh yeah, it's also a reason why other languages have dynamic bounds checking on arrays. C/C++ people point out that this adds a bunch of extra code/bloat, and the program can be made faster by omitting the checks and making sure you don't run off the ends : )

ananthbv · 05-04-2004, 01:31 PM

okkk, thanks a lot, you guys are great!