Pointers and pointer arithmetic

Why it exists

A variable name gives access to one object. Often a program needs to refer to an object indirectly: let a function change its caller's variable, walk along an array, build a list whose cells point to each other, ask the operating system for a block of memory whose size is not known until the program runs. All of these need a value that means "the object over there". That value is an address, and a variable that holds one is a pointer.

A pointer is also the machine's own way of reaching memory. The CPU's indirect addressing works exactly like *p: the instruction names a register, and the register holds the address of the data. C puts that mechanism in your hands, which is why it is both powerful and the source of most C bugs.

Prerequisites

Precise definitions

• Pointer. An object whose value is the address of another object (or function). int *p; declares p as a pointer to int. The type int * records what kind of object p is supposed to point at.
• Address-of &. &x is the address of x, of type int * if x is an int.
• Dereference *. *p is the object that p points at. It can be read (y = *p) or written (*p = 5). Using * in a declaration (int *p) is a different use of the same symbol: it says "p is a pointer".
• Pointer to pointer. int **pp holds the address of an int *. **pp follows two arrows. The animation below does this.
• The null pointer. A null pointer is a valid value that points at no object. It is written with a null pointer constant: an integer constant expression with value 0 (such as 0) or that expression cast to void *. NULL is a macro for one of these. A variable that merely holds 0 (int z = 0; p = z;) is not a null pointer constant. Comparing a pointer with NULL is fine. Dereferencing a null pointer is undefined behaviour.
• Size of a pointer. sizeof(int *) is the size of an address: 8 bytes on a typical 64-bit machine and 4 on a 32-bit one. On such platforms it does not depend on the pointee: int *, char * and double * are all the same size. (The C standard itself only requires that void * and char * match each other; the equal sizes are a property of common platforms, and GATE assumes them.) What differs is sizeof(*p), the size of the pointee.
• Why the pointer type matters. The type tells the compiler (1) how many bytes to read or write for *p, and (2) how far p + 1 moves.
• Pointer arithmetic (C11 6.5.6). For T *p:
  • p + n is the address $\text{address}(p) + n \times \texttt{sizeof(T)}$. It moves n elements, not n bytes. p++ and p-- likewise.
  • p - q (both pointing into the same array) is the number of elements between them, of type ptrdiff_t.
  • p + n is valid only if p points into an array (a single object counts as an array of one element) and the result is inside the array or exactly one past the last element. n may be negative. The one-past pointer may be compared and subtracted, but not dereferenced (forming &a[5] for a 5-element array is still allowed, because & and * cancel). Any other result is undefined behaviour, even if you never dereference it.
  • Relational comparison (<, <=, ...) is defined only between pointers into the same object (the same array, or members of the same struct). == and != work between pointers of compatible type, even into different arrays, though a one-past-the-end pointer may happen to equal the address of a neighbouring object.
  • Adding two pointers, or multiplying or dividing a pointer, is an error.
• void *. A pointer with no type. It can hold any object pointer and converts to and from other object-pointer types without a cast in C (qualifiers such as const must be preserved), but it cannot be dereferenced. Standard C does not allow arithmetic on it (gcc allows it as an extension and treats the size as 1).
• const and pointers. Read the declaration from the name outwards, right to left.

• Bad pointers. A wild (uninitialised) pointer holds an indeterminate value. A dangling pointer holds the address of an object whose lifetime has ended (a returned local, a freed block); in C11 such a pointer's value is indeterminate, so even using it without dereferencing is not allowed. A null pointer is a perfectly good value, but it points at no object and must not be dereferenced. Dereferencing any of the three is undefined behaviour.

How it works

Following arrows

Step through this real run. Watch three things. First, q = p copies an address, so after it there are two arrows to the same x. Second, p = &y changes where p points and leaves x alone, while *p = ... changes the pointee. Third, pp is a pointer to the pointer p.

The two assignments are the most confusing pair in the subject:

Moving through an array

In the next run p walks along an array. Look at the address of p in the cell. Each p++ adds 4, because p points to int. q - p is 3 although the addresses differ by 12: the subtraction divides by the element size.

*p++, (*p)++, *++p

Postfix ++ binds tighter than unary *, and prefix ++ and * group right to left. So:

Worked examples

#include <stdio.h>
 
int main(void) {
    int x = 10;
    int *p = &x;
    *p = 11;
    printf("%d %d %d\n", x, *p, p == &x);
    return 0;
}

11 11 1

#include <stdio.h>
 
int main(void) {
    int x = 10, y = 20;
    int *p = &x;
    int **pp = &p;
    *pp = &y;
    **pp = *p + 1;
    printf("%d %d %d\n", x, y, *p);
    return 0;
}

10 21 21

#include <stdio.h>
 
int main(void) {
    int a[5] = {10, 20, 30, 40, 50};
    int *p = a;
    p++;
    int *q = p + 3;
    printf("%d %td %d\n", *q, q - p, *(q - 1));
    return 0;
}

50 3 40

#include <stdio.h>
 
int main(void) {
    int a[4] = {10, 20, 30, 40};
    int *p = a;
    int x = *p++;
    int y = (*p)++;
    int z = *++p;
    printf("%d %d %d %d %td\n", x, y, z, a[1], p - a);
    return 0;
}

10 20 30 21 2

#include <stdio.h>
 
int main(void) {
    int *ip;
    char *cp;
    double *dp;
    printf("%zu %zu %zu %zu %zu %zu\n", sizeof ip, sizeof cp, sizeof dp,
           sizeof *ip, sizeof *cp, sizeof *dp);
    return 0;
}

8 8 8 4 1 8

#include <stdio.h>
 
int main(void) {
    unsigned int x = 0x12345678;
    unsigned char *c = (unsigned char *)&x;
    printf("%x %x\n", c[0], c[3]);
    return 0;
}

78 12

Cheat box

Traps and GATE patterns

Connections

Pointers and arrays are tied together: an array name decays to a pointer in most expressions, and a[i] is *(a + i). The arrays, strings and pointers page works through the consequences. Where a pointer variable and its target live is on the memory layout page. Dynamic memory is the main source of pointers whose target is not a named variable. A CPU's indirect addressing mode is the hardware version of *p.

PYQs

Consider this C code to swap two integers and these
five statements:

void swap(int *px, int *py) {

*px = *px - *py

*py = *px + *py;

*px = *px - *py;

}

S1: will generate a compilation error

S2: may generate a segmentation fault at runtime
depending on the arguments passed

S3: correctly implements the swap procedure for all
input pointers referring to integers stored in memory
locations accessible to the process

S4: implements the swap procedure correctly for
some but not all valid input pointers

S5: may add or subtract integers and pointers.

Consider the following ANSI-C program.

#include <stdio.h>

int main() {

int *ptr, a, b, c;

a = 5;

b = 11;

c = 20;

ptr = &a;

*ptr = c;

ptr = &c;

a = *(&b);

c = *ptr - a;

printf("%d", c);

return 0;

}
The output of this program is __________. (answer
in integer)

Consider the following C program:

#include < stdio.h >
void foo(int *p, int x) {
    *p = x;
}
int main() {
    int *z;
    int a = 20, b = 25;
    z = &a;
    foo(z, b);
    printf("%d", a);
    return 0;
}

The output of the given C  program is__________  .
(Answer in integer)

#include<stdio.h>
void fun1(char *s1, char *s2)  {
    char *tmp;
    tmp = s1;
     s1 = s2;
     s2 = tmp;
}
void fun2(char **s2, char **s2)  {
     char *tmp;
     tmp = *s1;
     *s1 = *s2;
     *s2 = tmp;
}
int main ()  {
     char *str1 = "Hi", *str2 = "Bye";
      fun1(str1, str2);
      printf("%s %s", str1, str2);
      fun2(&str1, &str2);
      printf("%s %s", str1, str2);
      return 0;
}

The output of the program above is

Consider the following function implemented in
void printxy (int x, int y)   {
int *ptr;
x = 0;
ptr = &x;
y = *ptr;
*ptr = 1;
printf("%d,%d",x,y);
}
The output of invoking printxy(1, 1) is_____

#include<stdio.h>
void mystery(int *ptra, int *ptrb) {
int *temp;
temp = ptrb;
ptrb = ptra;
ptra = temp;
}
int main() {
int a=2016, b=0, c=4, d=42;
mystery(&a, &b);
if (a < c)
mystery(&c, &a);
mystery(&a, &d);
printf("%d\n", a);
}
The output of the program is ________.

Consider the following C program.
# include<stdio.h>
int main( )
{
  static int a[] = {10, 20, 30, 40, 50};
  static int *p[] = {a, a+3, a+4, a+1, a+2};
  int **ptr = p;
ptr++;
printf("%d%d", ptr - p, **ptr};
}
The output of the program is _________

Consider the following program in C language:
#include <stdio.h>
main()
{
    int i;
    int *pi = &i;
scanf("%d", pi);
printf("%d\n", i+5);
}
Which one of the following statements is TRUE?

Self-check

#include <stdio.h>
 
int main(void) {
    int a[4] = {1, 2, 3, 4};
    int *p = a + 1;
    printf("%d %d %d\n", *p + 1, *(p + 1), p[-1]);
    return 0;
}

3 3 1

Revision card

References