C memory layout: text, data, heap, stack

Why it exists

A running program is not just "variables in memory". The operating system gives it one address space, and the compiler and linker sort every object in the program into regions with different rules (the loader then maps them into memory). Where something lives decides how long it exists, what value it starts with, whether you can change it, and how fast it can grow. Questions of the form "which of these is stored where", and many pointer-bug questions, come from this one picture.

Prerequisites

Precise definitions

A C program's address space has six regions that matter. From the lowest addresses of the program image upward:

This table describes the usual gcc and Linux layout. The C standard itself defines only storage durations and says that modifying a string literal or a const-defined object is undefined; it does not say which memory region holds them.

Definitions to know exactly:

• Storage duration (C11 6.2.4). Static: exists for the whole run (globals, static locals, string literals). Automatic: exists from entering the block to leaving it (ordinary locals and parameters). Allocated: exists from malloc (or calloc, realloc) to free. C11 also has thread storage duration (_Thread_local), which is not needed for GATE.
• Stack frame. The block of the stack belonging to one function call (see recursion and the call stack).
• Text, data and BSS are the three columns printed by the size command. Its text column covers the code and the read-only data; data is initialised writable data; bss is zero-initialised data. Everything except BSS takes space in the executable file; BSS is recorded as a size only. (The file actually has more than three sections, such as .rodata; size just groups them.)
• Initialisation rule. Objects with static storage duration that you do not initialise are set to zero. Automatic objects you do not initialise have an indeterminate value; reading one is a bug.

Growth directions. On the usual x86 layout the stack grows toward lower addresses (each new call's frame sits below the caller's) and the classic heap (the one extended with brk) grows toward higher addresses; large malloc requests may instead be served from separate mappings elsewhere. This is a property of the platform, not of C. GATE questions that mention a direction state it.

How it works

Step through a real program. Each step places one object: you see its declaration, the region it landed in, and its real address. The addresses come from a run with address randomisation turned off so they are stable. With randomisation on, the absolute numbers change on every run, but the usual order of the regions and which object goes where do not (the gaps between regions do change).

What to take from it:

• Only the pointer is on the stack. p is a local, so p itself is on the stack, but the four integers it points to were obtained from malloc and are on the heap. name is likewise a stack variable holding the address of characters that sit in read-only memory.
• static int calls is not on the stack even though it is declared inside main. Its initial value 3 is stored in the file, so it is in the data region, next to total.
• Uninitialised globals cost nothing in the file. count and hits have no initialiser, so they are in BSS. The size line at the end shows the real split for this program.
• Code has addresses too. main is a function, and it has an address in the text region. A function name used in an expression is converted to a pointer to that code.

Here is a fact the animation cannot show, but a real run can: writing to a string literal.

#include <stdio.h>
int main(void) {
    char *s = "GATE";
    s[0] = 'g';
    printf("%s\n", s);
    return 0;
}

(no output)

(no output)

Worked examples

#include <stdio.h>
 
int next(void) {
    static int n = 0;
    int fresh = 0;
    n++;
    fresh++;
    return n * 10 + fresh;
}
 
int main(void) {
    int first = next();
    int second = next();
    int third = next();
    printf("%d %d %d\n", first, second, third);
    return 0;
}

11 21 31

#include <stdio.h>
 
int g[3];
static int s;
 
int main(void) {
    printf("%d %d %d %d\n", g[0], g[1], g[2], s);
    return 0;
}

0 0 0 0

#include <stdio.h>
 
int main(void) {
    char *s = "GATE";
    char t[] = "GATE";
    t[0] = 'g';
    printf("%zu %zu\n", sizeof s, sizeof t);
    printf("%s %s\n", s, t);
    return 0;
}

8 5
GATE gATE

#include <stdio.h>
#include <stdlib.h>
 
int *from_static(void) {
    static int v = 5;
    return &v;
}
 
int *from_heap(void) {
    int *p = malloc(sizeof *p);
    *p = 6;
    return p;
}
 
int main(void) {
    int *a = from_static();
    int *b = from_heap();
    printf("%d %d\n", *a, *b);
    free(b);
    return 0;
}

5 6

Cheat box

Traps and GATE patterns

(needs verification: whether GATE treats a const global as read-only data or just as "data". gcc places it in read-only data, as the animation shows, but the C standard does not mandate a region, so a question that simplifies to "initialised data" may expect data.)

Connections

The same six regions are what the operating system builds for every process; see the process address space. A compiler thinks of this as storage organisation, and each stack frame is an activation record.

PYQs

In C runtime environment, which one of the
following is stored in heap?

Match the following:

(P) static char var ;
(i)
Sequence
of
memory
locations
to
store address
(Q) m= malloc (10);
m = NULL;
(ii) A variable located
in data section
of memory
(R) char*ptr[10];
(iii)
Request
to
allocate a CPU
register to store
data
(S) register int var1;
(iv) A lost memory
which cannot be
freed

If the numerical value of a 2-byte unsigned integer on
a little-endian computer is 255 more than that on a
big-endian computer, which of the following choices
represent(s) the unsigned integer on a little-endian
computer?

Self-check

#include <stdio.h>
 
void f(void) {
    static int s = 0;
    int a = 0;
    s++;
    a++;
    printf("%d %d\n", s, a);
}
 
int main(void) {
    f();
    f();
    return 0;
}

1 1
2 1

Revision card

References