Malloc的char数组具有意外的输出

Question

My problem is simple, I don't understand why this program doesn't output correctly :

int size = 35;
// malloc size for text
char *txt = malloc(size * sizeof(char *));
if(!txt) {
    fprintf(stderr, "Allocation for text data failed.\n");
    return EXIT_FAILURE;
}

for(int i = 0; i < size; i++) { // for each character in text
    txt[i] = 'a';
}
printf("%s\n", txt);
free(txt);

Expected output :

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Actual output :

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa8 9 10 1 0 12 11 6 37 44 3 45 56 0 64 77 5 68 83 0 39 46 0 19 16 9 8 2 6 3 1 4 17 12 9 17 6 0 25 10 3 31 16 13 21 9 9 11 7 4 2 3 0 7 6 1 9 5 2 11 2 5 19 6 13 21 8 15 8 0 0 7 0 0 29 20 13 62 50 0 49 35 0 41 27 1 38 25 9 25 13 0 21 11 0 24

---

Tried debugging with valgrind --leak-check=yes , the only error it shows is the following :

==3999== Conditional jump or move depends on uninitialised value(s)
==3999== at 0x4C30F78: strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3999== by 0x4EA969B: puts (ioputs.c:35)
==3999== by 0x400B39: main (decode.c:85) // this is the printf line

I thought it was because it didn't know when to stop printing, but I tried :

while(txt != NULL) {
    printf("%c", *(txt++));
}

And I also tried :

txt[size - 1] = '\0';

while((*txt) != '\0') {
    printf("%c", *(txt++));
}

Those gave even worse results where it would fill my console with special characters.

Answer 1

Put the \\0 in the char array. Otherwise printf will have undefined behavior .

Also in malloc you are allocating for char not char* .

Example

int size = 35;
// malloc size for text
char *txt = malloc((size+1) * sizeof(char ));
if(!txt) {
    fprintf(stderr, "Allocation for text data failed.\n");
    return EXIT_FAILURE;
}
memset(txt,0,size+1); 
for(int i = 0; i < size; i++) { // for each character in text
    txt[i] = 'a';
}

printf("%s\n", txt);
free(txt);
txt=NULL;

1. Alternatively one can set txt[size]='\\0' also because all other position are overwritten with characters inputted. [ Peter commented this]

Answer 2

int size = 35;
// malloc size for text
char *txt = malloc(size * sizeof(char *));

You have not malloc'ed 35 bytes, but instead 35 pointers (ie 140 bytes on 32-bit or 280 bytes on 64-bit).

This should be 'malloc(size * sizeof(char))' or just malloc(size).

for(int i = 0; i < size; i++) { // for each character in text
    txt[i] = 'a';
}

You've initialized only the first 35 of 140 or 280 bytes allocated. You haven't null terminated your string.

printf("%s\n", txt);

Now you are printing a string that isn't null terminated and valgrind has correctly warned you that it is accessing uninitialized memory when trying to perform strlen() on the input txt.

Answer 3

char *txt = malloc(size + 1); ...

for(int i = 0; i < size; i++) { // for each character in text
    txt[i] = 'a';
}
txt[size] = '\0';
printf("%s\n", txt);