1

In my previous question: Pointer dereference array index I have asked about struct being dereferenced. (I will paste a snippet of code from there for recap):

#include <stdio.h>
#include <stdlib.h>
struct Test { char c; } foo;

int main (void) {

   struct Test **ar;
   ar=malloc(16);
   *ar=malloc(0); //prerequisite for second case (without getting some address from OS, I cannot go 'through' *ar to (*ar+1). 
   //Does not matter allocation of zero bytes. (only to get some valid address)
   *(ar+1) = &foo;
   //(**(ar+1)).c='c'; //// first case - works
   (*(*ar+1)).c='c'; //// second case - also works, with prerequisite
   printf("%c\n", (*(*ar+1)).c); //prints 'c'

   return 0;
}

I still do understand between pointer adding +1 in first vs second case. Well I do in the second - adding sizeof(struct Test*) to the address *ar, which like array indexing (so *ar is name pointer of array). But in the first case? what does (**(ar+1)) do? How can I add (what?) some kind of pointer type sizeof(struct Test**) when ar is not array? *(ar+1) dereference address that does not belong to me, but (*ar+1) dereference address of pointer (sizeof(struct Test*)) that DOES belong to me (an array member). So why does the first case work? (from the link, I am trying to give my understanding by resolving type being indexed [ e.g. - in first case a "step/index" is made by sizeof(struct Test**) and in second case by sizeof(struct Test*), but both have same size) - just take a look at the link.

Improve this question
3
  • 3
    Beware: "If size is zero, the behavior of malloc is implementation-defined. For example, a null pointer may be returned. " - If your implementation behaves like that, you trigger UB when you dereference the returned pointer. Commented May 8, 2020 at 12:24
  • Yet, from printf(...) it gets printed and I get my result. I could be UB, but still work, and that is part of my question Commented May 8, 2020 at 12:27
  • Well, it is implementation defined in this case, it can be your compiler/library do return a valid pointer (you need to look it up in the compiler documentation to be sure). Commented May 8, 2020 at 12:29

2 Answers 2

Reset to default
1

So why does the first case work?

(**(ar+1)).c='c' doesn't work at all on my specific system.

(**(ar+1)) performs pointer arithmetic on a struct Test ** type, and (*(*ar+1)) performs pointer arithmetic on a struct Test* type.

This means that in the former case, arithmetic is done by sizeof(struct Test *) bytes, in the latter case on sizeof(struct Test) bytes.

The compiler might add padding inside your struct so that it ends up as 4 bytes etc, whatever size a pointer happens to be on your system. So they might end up at the same address by luck. Pointer sizes are commonly 2, 4 or 8 bytes, depending on if a 16, 32 or 64 bit address bus is used.

It is not very meaningful to ponder about what obscure code like this does. Explicit pointer arithmetic in general should be avoided, it is much better practice to use the [] operator to get readable code.

Also please note that malloc(0) gives "either a null pointer is returned, or the behavior is as if the size were some nonzero value, except that the returned pointer shall not be used to access an object." If you get a null pointer and then attempt arithmetic, you have undefined behavior and anything might happen.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

(**(ar+1)).c = 'c' Does work, it is even an answer in my previous question (link). And - to the second case. How can be (**(ar+a)) valid then? I am moving 8 bytes - sizeof(struct Test*) as you denoted - forward. But Forward memory does not belong to me. As I said ar is not array (it is pointer to array). *ar is. Therefor I can only me "moving/indexing" with *ar (e.g. (*ar+1) or *ar[n])
0

So let's break up your code:

Declaring a pointer to pointer to struct Test.

struct Test **ar;

Allocating space for pointers, if your system is 64 bits you are allocating space for exactly 2 contiguous pointers.

ar = malloc(16);

Allocating memory block and assigning it to the first pointer (arr[0] = malloc(0)), this is never used, but without compiler optimization you still need to initialize it, allocating 0 bytes might not be the best option since it invokes undefined behaviour but since you never store anything there it doesn't cause problems.

*ar = malloc(0);

You are storing foo address in pointer number 2, which, since it works, leads me to believe that your system is indeed 64 bits.

*(ar+1) = &foo;

Works, assigning 'c' to char c to one past the foo struct. The same as ar[0][1].c ='c';

(*(*ar+1)).c = 'c'; 

printf("%c\n", (*(*ar+1)).c); //prints 'c'

The out of bounds accesses work because in C one past the end of an array or allocated memory block is available, and it looks like your implementation let's you access it to write and dereference, though it's out of bounds, mine too by the way, this is not always true so you can't expect it to always work.

This all works by chance (or maybe not), because you allocate the needed space for the 2 pointers.

Now lets make some changes to you allocation to compare with what you have, and let's mess around with the structure's paddings to store and access values out of the bounds of the allocated memory.

#include <stdio.h>
#include <stdlib.h>

struct Test
{
  char c;
} foo;

int main(void)
{
  struct Test **ar; //declaring a pointer to pointer to struct Test
  ar = malloc(sizeof(*ar) * 2); //allocation of space for 2 pointers to struct Test.

  //without optimization you still need to allocate space 
  //or otherwise initialize the 1st pointer to avoid UB
  *(ar + 0) = malloc(sizeof(**ar)); //or ar[0] = ... or *ar = ...
  *(ar + 1) = &foo; //or ar[1] = ... storing foo's address in the second pointer

  (*(*ar + 1)).c = 'c'; //works fine, one past the allocated memory
  printf("%c\n", ar[0][1].c); 

  (**(ar + 1)).c = 'b'; //works, actually foo
  printf("%c\n", ar[1][0].c); 

  (*(*(ar + 1) + 1)).c = 'a'; //also works, accessing ou of bounds
  printf("%c\n", ar[1][1].c); 

  printf("%c\n", foo.c); //test print foo

  return 0;
}

Live demo

This is much better not only in terms of readability but also in terms of portability since is the systems who decides what's the size of the pointers.

Now look at this simplified code:

#include <stdio.h>
#include <stdlib.h>

struct Test
{
    char c;
} foo;

int main(void)
{
    struct Test** ar;
    ar = malloc(sizeof(*ar) * 2);

    ar[0] = malloc(sizeof(**ar)); //or *ar = ...
    ar[1] = &foo;                 //or *(ar + 1) = ...

    ar[0]->c = 'a'; 
    printf("%c\n", ar[0]->c);

    ar[1]->c = 'c'; 
    printf("%c\n", ar[1]->c);

    printf("%c\n", foo.c); //ok foo has 'c'

    return 0;
}

Look how easy it is to use double pointers if one doesn't overcomplicate things.

Improve this answer

2 Comments

Why did you do this: //or otherwise initialize the 1st pointer ar[0] = malloc(sizeof(**ar)); 1) init the first memory, if I access the second memoty (ar[1][0] - in this case, dont need the init 1 pointer). 2) Why the .. do you alloc sizeof(**ar) there? that is nonsense, it should be something like malloc(sizeof(struct Test*)) just one depth pointer, not two. Or even could be malloc(0) as in my original post, since I don't use it. But why sizeof(**ar)??
@Herdsman, sizeof(**ar) is the same as sizeof(struct Test), it's just a safeguard programmers use to avoid errors if the type needs to be changed ahead, ar[0] and ar[1] will point to actual structs. The initialization of pointer number 1 is good practice, because if you need to iterate the array it can lead to problems, when testing some prints my code segfaulted exactly because arr[0] wasn't initialized, I thought this was the reason you allocated 0 bytes to your 1st pointer. Anyway, I'm using ar[0] in the code so I had to do it regardless.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.