C++ 指针移动

Question

int main() 
{ 
    char *A[] = { "abcx", "dbba", "cccc"}; 
    char var = *(A+1) - *A+1; 
    cout << (*A + var); 
} 

Hi, the code gives output bba. I am unable understand, how the integer value of var becomes 6. In what order, the var value is solved. Please explain. Thanks in advance.

Answer 1

A is an array of pointers to character arrays. AKA, strings. Each array is 5 characters long because of the 4 character string literals, each of which has one hidden null terminator.

Because you got lucky and your compiler does the simple thing , the character literals are placed into the program one after the other.

So *A is the address of the first array. *(A+1) is the address of the second array. Subtract them and that is 5. Add 1 for 6.

This kind of C code is obfuscated. It can also be dangerous. I would not rely on accessing through a pointer outside of an array even if you are pretty sure there's a second array following. Assuming that will only lead to pain. And suffering.

Because *A + var when var is greater than the array size is undefined behavior . In this case the valid array size is 5, so valid values of var are 0..4.

Undefined behavior means that the compiler's optimizer is allowed to assume that it does not happen. Because if your program DID have undefined behavior, it would not be a defined program and would automatically be WRONG . So obviously you'd never do that. Hah.

Here's some modified code that will hopefully explain better:

#include <iostream>

int main() {
  char *A[] = {"abcx", "dbba", "cccc"};
  char var = *(A + 1) - *A + 1;
  std::cout << (void *)*A << std::endl;
  std::cout << (void *)*(A + 1) << std::endl;
  std::cout << (*A + var) << std::endl;
  return 0;
}

Running it:

0x402010
0x402015
bba

Those are memory addresses on my particular machine, yours may be different. But the important thing is they are 5 bytes different.

Now I'm going to use a hex dump tool called xxd . You can find other good ones. If I dump the binary executable as hex and search for dbba I find a line:

00002010: 6162 6378 0064 6262 6100 0000 011b 033b  abcx.dbba......;

Oh wait, let me rebuild that without optimization. See what I mean about this being risky business?

00002010: 6162 6378 0064 6262 6100 6363 6363 0000  abcx.dbba.cccc..

The optimizer had completely removed the third array element from the binary because no one used it.

If we'd written the code just a little differently the optimizer could have removed both the second and third array element and you'd be trying to print binary garbage data.