0

I read that in function the local variables are put on stack as they are defined after the parameters has been put there first.

This is mentioned also here

5 .All function arguments are placed on the stack. 6.The instructions inside of the function begin executing. 7.Local variables are pushed onto the stack as they are defined.

So I excpect that if the C++ code is like this:

#include "stdafx.h"
#include <iostream>

int main()
{

    int a = 555;
    int b = 666;
    int *p = &a;

    std::cout << *(p+1);
    return 0;
}

and if integer here has 4 bytes and we call the memory space on stack that contains first 8 bits of int 555 x, then 'moving' another 4 bytes to the top of the stack via *(p+1) we should be looking into memory at address x + 4.

However, the output of this is -858993460 - an that is always like that no matter what value int b has. Evidently its some standard value. Of course I am accessing a memory which I should not as for this is the variable b. It was just an experiment.

How come I neither get the expected value nor an illegal access error?

Where is my assumption wrong?
What could -858993460 represent?

Improve this question
3
  • p+1 is ok. *(p+1) is undefined behaviour. Not that it has to do anything, but change p to point to b. With no optimizations, *(&b + 1) printed 555 on Coliru when I ran it. Commented Oct 5, 2013 at 22:24
  • 4
    Also, since the C++ language/standard has no notion of a "stack" whatsoever, the sentence "all function arguments are placed on the stack" is basically BS. And there are compiler optimizations, too (you may want to make your variables volatile and search for a duplicate...) Commented Oct 5, 2013 at 22:25
  • If you are curious have a look at the addresses of the variables with a debugger. (p-1) might work on an Intel CPU. But there are no guarantees about such implementation issues. Commented Oct 6, 2013 at 0:01

2 Answers 2

Reset to default
2

What everyone else has said (i.e. "don't do that") is absolutely true. Don't do that. However, to actually answer your question, p+1 is most likely pointing at either a pointer to the caller's stack frame or the return address itself. The system-maintained stack pointer is decremented when you push something on it. This is implementation dependent, officially speaking, but every stack pointer I've ever seen (this is since the 16-bit era) has been like this. Thus, if as you say, local variables are pushed on the stack as they are initialized, &a should == &b + 1.

Perhaps an illustration is in order. Suppose I compile your code for 32 bit x86 with no optimizations, and the stack pointer esp is 20 (this is unlikely, for the record) before I call your function. This is what memory looks like right before the line where you invoke cout:

4: 12 (value of p)
8: 666 (value of b)
12: 555 (value of a)
16: -858993460 (return address)

p+1, since p is an int*, is 16. The memory at this location isn't read protected because it's needed to return to the calling function.

Note that this answer is academic; it's possible that the compiler's optimizations or differences between processors caused the unexpected result. However, I would not expect p+1 to == &b on any processor architecture with any calling convention I've ever seen because the stack usually grows downward.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

Thank you for bringing more light to this! When I started to search in backward direction I found the values in memory. The value of next int b declared was at p-3 and of another int c at p -6. Seems that -858993460 - 11001100 11001100 11001100 11001100 in binary, is some padding value or default value for unoccupied memory space.
@LeNoob: Out of curiosity, do you still see 0xCCCCCCCC in that position if your function isn't main? Also, I did think of one actual application of a similar pointer math trick - it's called stack smashing, and it's used by malware to mess with code that it tricks into calling it. Remember the fake AV malware that everybody and their dog got a few years ago? It did (an evil version of) what you're doing in its main.
I should add that I know what fake AV did in its main because I disassembled it; I didn't write it. I do not write malware. Issue clarified.
1

Your assumptions are true in theory (From the CS point of view).

In practice there is no guarantee to do pointer arithmetic in that way expecting those results.

For example, your asumption "All function arguments are placed on the stack" is not true: The allocation of function argumments is implementation-defined (Depending on the architecture, it could use registers or the stack), and also the compiler is free to allocate local variables in registers if it feels necesary.

Also the asumption "int size is 4 bytes, so adding 4 to the pointer goes to b" is false. The compiler could have added padding between a and b to ensure memory aligment.

The conclusion here is: Don't use low-level tricks, they are implementation-defined. Even if you have to (Regardless of our advises) do it, you have to know how the compiler works and how it generates the code.

Improve this answer

2 Comments

Ok. So the conclusion is that what I read was very simplistic explanation how it works and in practice there are many other factors which make it more complicated as it is compiler/ architecture specific.
@LeNoob exactly. Its good to know that "tricks", how the code which the compiler generates really works (that is, how your program really works, or what really means the code you have written in C++). But in practice that code depends heavily in the architecture and the optimizations performed by the compiler.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.