Segmentation fault in malloc()

Question

I need to create a function which returns an array ofints. This int array should contain all values between min and max (both included).

If min >= max a null pointer should be returned.

The question is why when (min = -2147483468) and (max = 2147483647) and len becomes 4294967296 I get "Segmentation fault". My code:

   #include <stdlib.h>
   #include <stdio.h>

   int *ft_range(int min, int max)
   {
       int         *range;
       long int    len;
       long int    i;

       range = NULL;
       if (min >= max)
           return (NULL);
       len = max - min + 1;
       if(!(range = (int *)malloc(sizeof(int) * len)))
           return (NULL);
       i = 0;
       while (min < max)
       {
           range[i] = min;
           min++;
           i++;
       }
       range[i] = max;
       return (range);
   }

But if I enter (min = -2147483468) and (max = 2147483646) with (len = 4294967295) it works.

len = max - min + 1; --> len = 1L + max - min; to avoid int overflow when long is wider. Better to use size_t len and (size_t)1. — chux - Reinstate Monica
That assumes long int is is larger than int, so it's not portable code, but it will work on the OP's system. — ikegami
@RaphaelRakhimov: What exactly do you mean by "neither worked"? Did both give you a segmentation fault? — Andreas Wenzel
First I tried 1L, doesn't work. Then I tried with size_t len and (size_t)1 - doesn't work too. — Raphael Rakhimov

chux - Reinstate Monica chux - Reinstate Monica · Accepted Answer · 2021-09-23T17:04:02

int overflow with max - min + 1;

Use wider math for size calculations.

int *ft_range(int min, int max) {
  // Add required test explicitly
  if (min >= max) {
    return NULL;
  }

  long long size = 1LL + max - min; // Use long long math
  if (size > SIZE_MAX || size < 1) {
    return NULL;
  }
  size_t usize = (size_t)size;

  int *range = malloc(sizeof *range * usize);
  if (range == NULL) {
    return NULL;
  }

  size_t i = 0;
  while (min < max) {
    range[i] = min;
    min++;
    i++;
  }
  range[i] = max;
  return range;
}

Segmentation fault in malloc()

2 Answers