memory allocation about char *buffer and char buffer[5]

Question

I want to ask about a memory allocation question about char *buffer; buffer = malloc(5); and char buffer[5].

My code for test is below:]

#include <stdio.h>
void echo1();
void echo2();

int main() {
    echo1();
    printf("\n");
    echo2();
    printf("Back to Main \n");
    return 0;
}

void echo1() {
    int i;
    unsigned long addr;
    char *buffer;
    printf("[Echo1] Buffer      : %p \n", buffer);
    printf("[Echo1] &Buffer     : %p \n", &buffer);
    buffer = malloc(5);
    printf("[Echo1] &Buffer     : %p \n", &buffer);
    printf("[Echo1] Buffer      : %p \n", buffer);
    for (i = 0; i < 5; i++) {
        buffer[i] = 'A';
    }
    printf("[Echo1] Buffer[]    : %s \n", buffer); 
    addr = &buffer;
    printf("[Echo1] *Buffer     : %p \n", *buffer); 
    printf("[Echo1] addr        : %p \n", addr); 
    printf("[Echo1] &addr       : %p \n", &addr); 
}

void echo2() {
    int i;
    unsigned long addr;
    char buffer[5];
    printf("[Echo2] Buffer      : %p \n", buffer);
    printf("[Echo2] &Buffer     : %p \n", &buffer);
    for (i = 0; i < 5; i++) {
        buffer[i] = 'A';
    }
    printf("[Echo2] Buffer[]    : %s \n", buffer); 
    addr = &buffer;
    printf("[Echo2] *Buffer     : %p \n", *buffer); 
    printf("[Echo2] addr        : %p \n", addr); 
    printf("[Echo2] &addr       : %p \n", &addr); 
}

I compiled it on ubuntu by typing gcc test.c -o test -m32 (I'm using a 64 machine). And the following figure shows the result.

I think I understand the echo1() case (except for why addr is above buffer), and made a figure to show what happened in the memory.

But I have no idea what happened in echo2() case.

So I want to ask the following questions:

In echo1(), I declared addr before buffer, why addr is placed above buffer in stack? (since stack moves upward, shouldn't the program firstly push addr and then push buffer above it?)
In echo2(), why buffer and &buffer give the same value? Doesn't this mean buffer is pointing to itself?
In echo2(), addr's address and addr's content(address of buffer) is separated by 12 bytes, what is stored in them?
Can anyone make a figure to help me understanding what happened in ehco2()?

Thanks a lot.

When you printf with %s, the argument must be a null-terminated string. You never added a null byte to the buffer. — Barmar
I was trying to cause a buffer overflow... And I also don't know why the program correctly output AAAAA and nothing else... Shouldn't some other characters be output since I didn't add a null at the end? — Emma
Just because you didn't add it doesn't mean there isn't one there. You got lucky. — Barmar
Local variables aren't pushed one at a time on the stack. When a function is called, space is allocated on the stack for all the local variables. The locations of each variable within the stack frame are arbitrary. The compiler may rearrange them to minimize wasted space between variables, for instance. — Barmar

Iharob Al Asimi Iharob Al Asimi · Accepted Answer · 2016-01-28T01:41:05

Why the same?

The address of an array on the stack and the address of it's first element is the same. The difference would be incrementing the resulting pointers because they have different sizes.

What's in between?

The address of a pointer is a stack address while the address returned by malloc() and stored in the pointer is from the heap.

Note: Your code also exhibits many sources of undefined behavior, for example

Printing *Buffer with the "%p" specifier.
Printing uninitialized pointers.
Printing unsigned long addr uninitialized and with the "%p" specifier, both of which invoke undefined behavior.
Printing a non-null terminated array with the "%s" specifier.

So you can't expect a given behavior in echo2() and in general in the whole program.

memory allocation about char *buffer and char buffer[5]

3 Answers