malloc为C中的无符号int分配零字节

Question

#include<stdio.h>
#include<stdlib.h>

void main(){

unsigned int *p, a[25];
unsigned char *s = "goodcoffee";
unsigned int size, size1, size2, test_variable;

size1 = sizeof(unsigned int);
size2 = sizeof(unsigned int *);
size = sizeof(unsigned int)/sizeof(unsigned int *);

p = malloc(sizeof(unsigned int)/sizeof(unsigned int*));

test_variable = 0xFFFFFFFF;
*p = 0xFFFFFFFF;

strcpy(a,s);

printf("Size of int: %d , Size of int *: %d, Size: %d, Test variable:                     %d\n",size1,size2,size,test_variable);

printf("%s %d \n", a, *p);

return;

}

Hi, I am trying to understand why the below mentioned behavior is seen. I need your help to understand what happens with this code. Here malloc is allocating zero bytes. (This was an interview question).

output:

 size of int: 4,  size of int *: 4, size:1 , Test_variable: -1
 goodcoffee -1

I could not understand why Test_variable is showing -1 though it is an unsigned int. This happens only with the last nibble. I tried giving range of value from 0 to F as last nibble. code was giving different negative values. But if I get rid of last nibble, ieTest_variable is 0xFFFFFFF, the output was 268435455.

Answer 1

Here malloc is allocating zero bytes.

Malloc is not allocating 0 bytes, its allocating 1 bytes for your machine.. as

size = sizeof(unsigned int)/sizeof(unsigned int*) //gives 1

so, p is pointing to 1 byte

and

*p = 0xFFFFFFFF;

you are trying to store a 4 byte number in p while p is pointing at a 1 byte allocated space. Its undefined behaviour.

Answer 2

Printf format %d is used to print a signed integer. Use %u to print an unsigned integer. The representation of the unsigned integer 0xFFFFFFFF for a signed integer is -1.

Answer 3

Read more about malloc(3) ; it wants the number of bytes (not of data items), and it could fail. So code, if p is supposed to contain one unsigned integer:

p = malloc(sizeof(unsigned int));
if (!p) { perror("malloc"); exit(EXIT_FAILURE); };
*p = 0xFFFFFFFF;

Your code incorrectly called malloc with either 0 or 1 byte which is not enough for an unsigned int (on my Debian/x86-64 machine, sizeof(unsigned int) is 4, and pointers want 8 bytes, so sizeof(unsigned int*) is 8, so 4/8 is 0).

BTW, if your system has it, use valgrind . Don't forget to compile with all warnings & debug info ( gcc -Wall -Wextra -g ). Then use the debugger ( gdb )

Answer 4

The negative value is stored in 2's compliment form in memory.

In your case test_variable = 0xFFFFFFFF; represent -1 in decimal.

That is what printed on the console.

Here its how it is done

1 represent 00000001 in binary
1's complement of 1 is 11111110
adding 1 gives 11111111=> represent ffff.

No of bits depends on the memory layout used by the system.