Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Keith Thompson <kst-u@mib.org>
Newsgroups: comp.lang.c
Subject: Re: double free
Date: Thu, 14 Jul 2016 13:15:35 -0700
Organization: None to speak of
Lines: 64
Message-ID: <lnpoqgvuvs.fsf@kst-u.example.com>
References: <d5964270-015f-4955-9f7a-6a06bcfb5944@googlegroups.com> <577ba42f.13700328@news.xs4all.nl> <slrnnnqlqn.5q5.grahn+nntp@frailea.sa.invalid> <48c43c3f-8e7e-0509-5b9d-04133e7bb537@verizon.net> <pan.2016.07.09.05.13.42.40000@nowhere.invalid> <d3c0b115-927f-af9a-2c65-7893df4cbba9@verizon.net> <nm0vt6$ogf$1@dont-email.me> <57856cf1.441531@news.xs4all.nl> <nm3qrp$5ed$1@dont-email.me> <lnlh16h1wz.fsf@kst-u.example.com> <9cfaefc2-92a1-4e03-aa6b-d071a0988c87@googlegroups.com> <nm54ga$gnd$1@dont-email.me> <c12f846d-c679-4534-95d6-689491d322de@googlegroups.com> <suffix-20160714184734@ram.dialup.fu-berlin.de> <nm8lq2$6kc$1@dont-email.me> <lntwfsvws4.fsf@kst-u.example.com> <nm8qqs$qdp$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: mx02.eternal-september.org; posting-host="945944de09706c9b4e29b53c9d2efdc2"; logging-data="31567"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19N1P3tLkD8jsC5IStij0c8"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.1 (gnu/linux)
Cancel-Lock: sha1:a2z00aaHDHUDOqje+hFrfXd35hg= sha1:4NxBO0UWaCqnqiqGj2gTw4lSFuo=
Xref: csiph.com comp.lang.c:90374

BartC <bc@freeuk.com> writes:
> On 14/07/2016 20:34, Keith Thompson wrote:
>> BartC <bc@freeuk.com> writes:
>>> Interesting. But it doesn't work here:
>>>
>>> int (*array)[];
>>> int a,i;
>>>
>>> a=array[0][i];
>>
>> So you defined a pointer to an incomplete array type.  You can't
>> use the prefix `*` dereference operator on it either.
>
> It seems to work (with *) on the six compilers I tried (with warnings 
> and extra warnings shown).
>
> Why shouldn't it work? And how /should/ I index such an array? (Ie. 
> pointer to an array of unknown length as might be used for a dynamic 
> array or passed to a function.)

I was mistaken.  (I rarely use incomplete array types.)

Here's a complete example:

    #include <stdio.h>
    int main(void) {
        int (*array_ptr)[];
        int arr[5] = { 10, 20, 30, 40, 50 };
        array_ptr = &arr;

        int elem = (*array_ptr)[0];
        printf("elem = %d\n", elem);
    }

The output:

    elem = 10

array_ptr is of type "array of int", where the array has unspecified
bounds.  It decays to "pointer to array of int".  We don't need the
bounds to be able to index it.

But if we change:
    int elem = (*array_ptr)[0];
to:
    int elem = (array_ptr[0])[0];
it fails to compile; gcc says:

    c.c: In function ‘main’:
    c.c:7:9: error: invalid use of array with unspecified bounds
             int elem = (array_ptr[0])[0];
             ^~~

`array_ptr[0]` is by definition equivalent to `(*array_ptr + 0)`.
Since we don't know the size of the pointed-to object, we can't
perform arithmetic on the pointer (not even adding 0).

So `*p` and `p[0]` are not equivalent in all cases.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"