cse333-staff@cs when needed
unsigned char c = -1;
int status = c;
if (status == -1)
printf("error!\n");
ret == -1 is always false!
bug found in Linux/ffmpeg/…
<type> *
int *, char *, void *, int **read from memory address p
int a = *p;
write to memory address p
int a = ...;
*p = a;
undefined if out of bounds (buffer overflow)
#include <stdio.h>
int main(void)
{
int x = 42;
int *p = &x;
int **pp = &p;
printf("%p %p %p\n", p, pp, &pp);
}
&x is the address of variable x
output may vary due to address space layout randomization
void update_status(int status)
{
status = -1;
}
caller:
int st = 0;
update_status(st);
assert(st == 0);
void update_status(int *status)
{
*status = -1;
}
caller:
int st = 0;
update_status(&st);
assert(st == -1);
+ integer → pointer
p + 1&p[1], &1[p]p + 1 evaluates to ?- integer: shortcut for “pointer + (- integer)”- pointer| array style | pointer style |
|---|---|
int[] |
int * |
p[n] |
*(p + n) |
'\0'-terminated arraysee also: The Most Expensive One-byte Mistake
I call it my billion-dollar mistake. – C.A.R. Hoare
int *p = NULL;
if (p) { ... } /* if (p != NULL) */
if (!p) { ... } /* if (p == NULL) */
NullPointerException
uint16_t volatile *p = (uint16_t volatile *)0xdeadbeef;
uint16_t a = *p;
uint16_t b = *p;
*p = 42;
often seen in kernel / embedded systems code
memcpy: copy n bytes from src to dst
see also memmove, memcmp, memset, memchr, …
void *
memcpy(void *restrict dst, const void *restrict src, size_t n);
const: promise - memcpy won’t change the content of srcrestrict: requirements - dst and src must not overlapreview virtual memory
*p
#include <inttypes.h>
#include <stdio.h>
void foo(uint32_t *p32, uint64_t *p64) {
*p32 = 0xdeadbeaf;
*p64 = 0;
printf("%" PRIx32 "\n", *p32);
}
int main(void) {
uint64_t a;
foo((uint32_t *)&a, &a);
}
s, and the total length len of ss
n, little endiann-byte payload#include <stddef.h>
#include <stdint.h>
uint8_t *parse(uint8_t *s, uint32_t len) { ... }