cse333-staff@cs
when needed
unsigned char c = -1;
int status = c;
if (status == -1)
printf("error!\n");
ret == -1
is always false!
bug found in Linux/ffmpeg/…
<type> *
int *
, char *
, void *
, int **
read from memory address p
int a = *p;
write to memory address p
int a = ...;
*p = a;
undefined if out of bounds (buffer overflow)
#include <stdio.h>
int main(void)
{
int x = 42;
int *p = &x;
int **pp = &p;
printf("%p %p %p\n", p, pp, &pp);
}
&x
is the address of variable x
output may vary due to address space layout randomization
void update_status(int status)
{
status = -1;
}
caller:
int st = 0;
update_status(st);
assert(st == 0);
void update_status(int *status)
{
*status = -1;
}
caller:
int st = 0;
update_status(&st);
assert(st == -1);
+
integer → pointer
p + 1
&p[1]
, &1[p]
p + 1
evaluates to ?-
integer: shortcut for “pointer +
(-
integer)”-
pointerarray style | pointer style |
---|---|
int[] |
int * |
p[n] |
*(p + n) |
'\0'
-terminated arraysee also: The Most Expensive One-byte Mistake
I call it my billion-dollar mistake. – C.A.R. Hoare
int *p = NULL;
if (p) { ... } /* if (p != NULL) */
if (!p) { ... } /* if (p == NULL) */
NullPointerException
uint16_t volatile *p = (uint16_t volatile *)0xdeadbeef;
uint16_t a = *p;
uint16_t b = *p;
*p = 42;
often seen in kernel / embedded systems code
memcpy
: copy n
bytes from src
to dst
see also memmove
, memcmp
, memset
, memchr
, …
void *
memcpy(void *restrict dst, const void *restrict src, size_t n);
const
: promise - memcpy
won’t change the content of src
restrict
: requirements - dst
and src
must not overlapreview virtual memory
*p
#include <inttypes.h>
#include <stdio.h>
void foo(uint32_t *p32, uint64_t *p64) {
*p32 = 0xdeadbeaf;
*p64 = 0;
printf("%" PRIx32 "\n", *p32);
}
int main(void) {
uint64_t a;
foo((uint32_t *)&a, &a);
}
s
, and the total length len
of s
s
n
, little endiann
-byte payload#include <stddef.h>
#include <stdint.h>
uint8_t *parse(uint8_t *s, uint32_t len) { ... }