34

I had gone to an interview in which I was asked the question:

What do you think about the following?

int i;
scanf ("%d", i);
printf ("i: %d\n", i);

I responded:

  • The program will compile successfully.
  • It will print the number incorrectly but it will run till the end without crashing

The response that I made was wrong. I was overwhelmed.

After that they dismissed me:

The program would crash in some cases and lead to an core dump.

I could not understand why the program would crash? Could anyone explain me the reason? Any help appreciated.

4
  • 10
    Any decent compiler will complain about how scanf expects a pointer
    – Cole Tobin
    Jan 2, 2016 at 5:49
  • Please don't roll back these tag edits. That tag has been removed for a reason.
    – Brad Larson
    Mar 5, 2016 at 17:41
  • @BradLarson, alright I won't do it. At first I thought the that tag was appropriate for this question. Could you tell me the reason of the tag being removed? Mar 6, 2016 at 2:49
  • 1
    This link was provided in one of the edit reasons: meta.stackoverflow.com/questions/256592/…
    – Brad Larson
    Mar 6, 2016 at 16:36

6 Answers 6

49

When a variable is defined, the compiler allocates memory for that variable.

int i;  // The compiler will allocate sizeof(int) bytes for i

i defined above is not initialized and have indeterminate value.

To write data to that memory location allocated for i, you need to specify the address of the variable. The statement

scanf("%d", &i);

will write an int data by the user to the memory location allocated for i.

If & is not placed before i, then scanf will try to write the input data to the memory location i instead of &i. Since i contains indeterminate value, there are some possibilities that it may contain a value equivalent to the value of a memory address or it may contain a value which is out of range of memory address.

In either case, the program may behave erratically and will lead to undefined behavior. In that case anything could happen.

7
  • 5
    It's almost guaranteed you'll crash, as you'll get a memory protection fault or the equivalent on whatever system is running it. Of course, other things could happen, depending on the size of the program, allocated memory, etc, but my money's on a system/application crash.
    – sfdcfox
    Jan 1, 2016 at 23:54
  • 1
    @sfdcfox my money's on the compiler noticing undefined behavior and treating the respective code block as unreachable (= removing it from the code and redirecting any code path leading to it). Jan 2, 2016 at 8:17
  • @JanDvorak I've seen this idea that the compiler can effectively 'delete' UB mentioned before, but do you know of an example where we can see it in action? It sounds hard to believe - which is why I'm pretty sure it'll be true, as this is C++ after all. ;-) Specifically here, do you mean that the ill-advised scanf might not be reached, so the user could not be asked for input? I didn't know that 'as-if' could produce observable side-effects, but I guess that rule doesn't apply to UB, like all the rest. Jan 2, 2016 at 12:37
  • 1
    @JanDvorak: If compilers would "disable" all UB code that way, a huge number of quite common applications would suddenly cease to function...
    – DevSolar
    Jan 18, 2016 at 13:10
  • 1
    @sfdcfox: You may not assume the presence of memory protection. Outside the desktop niche, there are quite some systems running without -- where UB means "undefined behaviour of this application and all others currently in memory, including the OS". Those are the same systems that react rather poorly to memory not free()d before returning from main()...
    – DevSolar
    Jan 18, 2016 at 13:12
18

Beacuse it invokes undefined behavior. The scanf() family of functions expect a pointer to an integer when the "%d" specifier is found. You are passing an integer which can be interpreted as the address of some integer but it's not. This doesn't have a defined behavior in the standard. It will compile indeed (will issue some warning however) but it will certainly work in an unexpected way.

In the code as is, there is yet another problem. The i variable is never initialized so it will have an indeterminate value, yet another reason for Undefined Behavior.

Note that the standard doesn't say anything about what happens when you pass a given type when some other type was expected, it's simply undefined behavior no matter what types you swap. But this particular situation falls under a special consideration because pointers can be converted to integers, though the behavior is only defined if you convert back to a pointer and if the integer type is capable of storing the value correctly. This is why it compiles, but it surely does not work correctly.

19
  • But in my college days, when I was studying from Spirit of C, there was a statement like this: scanf ("%s", name); Jan 1, 2016 at 14:57
  • 10
    ^ that works becauce name is probably a char array, and the name of an array is equal to the address of the first element in that array.
    – kfx
    Jan 1, 2016 at 14:58
  • That is very different. Surely name was an array and arrays are autmatically converted to pointers to their first element. Also, it would be safer char name[100]; scanf("%99s", name);. Jan 1, 2016 at 14:58
  • So, basically you mean to say, that scanf will try to store the value at location with variable i. Jan 1, 2016 at 15:02
  • 1
    Although your comment is not clear I think that you did understand so Yes, that's how it works. Jan 1, 2016 at 15:03
10

You passed data having the wrong type (int* is expected, but int is passed) to scanf(). This will lead to undefined behavior.

Anything can happen for undefined behavior. The program may crash and may not crash.

In a typical environment, I guess the program will crash when some "address" which points to a location which isn't allowed to write into by the operating system is passed to scanf(), and writing to there will have the OS terminate the application program, and it will be observed as a crash.

10

One thing that the other answers haven't mentioned yet is that on some platforms, sizeof (int) != sizeof (int*). If the arguments are passed in a certain way*, scanf could gobble up part of another variable, or of the return address. Changing the return address could very well lead to a security vulnerability.

* I'm no assembly language expert, so take this with a grain of salt.

5

I could not understand why the program would crash? Could anyone explain me the reason. Any help appreciated.

Maybe a little more applied:

int i = 123;
scanf ("%d", &i);

With the first command you allocate memory for one integer value and write 123 in this memory block. For this example let's say this memory block has the address 0x0000ffff. With the second command you read your input and scanf writes the input to memory block 0x0000ffff - because you are not accessing (dereferencing) the value of this variable i but it's address.

If you use the command scanf ("%d", i); instead you are writing the input to the memory address 123 (because that's the value stored inside this variable). Obviously that can go terribly wrong and cause a crash.

1
  • thanks. +1 for the good explanation. (Also nice name taken from The Martian. Jan 4, 2016 at 14:56
0

Since there is no &(ampersand) in scanf(as required by the standard), so as soon as we enter the value the program will terminate abruptly, no matter how many lines of code are written further in the program.

-->> I executed and found that in code blocks.

Same program if we run in turbo c compiler then it will run perfectly all the lines even which are after scanf, but the only thing, as we know the value of i printed would be garbage.

Conclusion:- Since at some compiler it will run and at some it would not, so this is not a valid program.

1
  • 1
    As some of the other answers explain, while it's true that the program is incorrect and will probably terminate right away, we can't say this for sure. There's a chance it will successfully write the scanned integer into an indeterminate location, and continue. Jul 25, 2021 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.