35 Objects, addresses, pointers

35.1 Three notations — declaration, &, *

Pointer syntax is three pieces and no more.

Declaration — int *p; declares “a variable p holding the address of an int.” The knack of reading it is from the back: “p is a pointer (*p), and at the place it points there is an int.”

Taking an address — &n is the value “n’s address.” The & brushed past in chapter 25′s sscanf(..., &n) has finally got its formal name — the operator that detaches the number tag of the locker called n.

Dereference — *p means “go to the address written in p and that slot.” In a reading position it reads that slot’s value; on the left of an assignment it writes to that slot. That the * of a declaration, the * of an expression (dereference) and the * of multiplication use the same character is C’s notorious thrift — position is the only way to tell them apart.

The demonstration shows all three at once, including chapter 33′s homework — the proper method by which a function changes an original.

#include <stdio.h>

void set_to(int *target, int value)
{
    *target = value;            /* it follows the address and writes to the original */
}

int main(void)
{
    int n = 1;
    int *p = &n;                /* p holds the address of n */

    printf("n at first: %d\n", n);
    printf("p == &n ? %d\n", p == &n);

    *p = 55;                    /* dereference: write where p points (= n) */
    printf("n after *p = 55: %d\n", n);

    set_to(&n, 99);             /* chapter 29's homework — a function changes the original */
    printf("n after set_to: %d\n", n);
    return 0;
}

n at first: 1
p == &n ? 1
n after *p = 55: 55
n after set_to: 99

Read the route of set_to(&n, 99) exactly and half of pointers is done — ① &n (the value that is an address) is copied into the parameter target (chapter 33′s copy-by-value rule is untouched!), and ② inside the function *target = value goes to that address and writes into the original slot. The world of copying values was not broken at all — what was copied happened to be an address.

35.2 sizeof — asking the size of a container

The last deferred credit — sizeof is the operator that puts out the size in bytes of a type or an object (its value is of type size_t, an unsigned integer just for sizes, printed with %zu). Chapter 25′s fgets(line, sizeof line, stdin) now reads completely: “tell fgets the number of bytes in the container called line.” Being an operator rather than a function, its value is mostly settled at compile time, and it works on a type (sizeof(int)) as well as on an object (sizeof line).

35.2.1 The type sizeof yields — size_t

That sizeof yields a size_t is not a footnote but a contract. Know this one type exactly and several traps in later chapters are closed off in advance.

★ What bites most often is that it has no sign. Set beside a signed integer, the usual arithmetic conversions pull the signed side up into the unsigned one (chapter 29) — so the following holds.

int n = -1;
if (n < sizeof arr) { … }     /* looks true, and is *false* */

This book checked it directly — the value of -1 < sizeof arr was 0, and GCC warns with -Wsign-compare about “comparison of integer expressions of different signedness”. The -1 turned into an enormous positive number. The infinite backwards loop of chapter 41 has the same root.

35.3 What kind of number is an address — name, size, order

We have said several times that a pointer cannot be seen as “just a number”. What kind of number is it, then? Splitting the uses of number into three makes the answer sharp.

An address is not one of the three: it is all three, and none of them wholly.

- As a nominal number: the most basic use. &x is the name of the object x, and whether two addresses are the same may always be asked (which is why == and != are allowed even between different objects, appendix A). This is exactly what a locker number does. - As an ordinal number: within one array, before and after mean something. &a[1] < &a[2] is true, and on that rest sorting, searching and bounds checks. But between different arrays the question cannot be asked — which is why ordering them is outside the contract (appendix A). What has an order is not addresses in general but addresses within one object. - As a cardinal number: the difference of two addresses counts — not bytes but elements (chapter 38). &a[4] - &a[1] is 3, meaning “three elements lie between”. And this subtraction, too, means something only within one array.

In short: an address may always be used as a nominal number; as an ordinal or a cardinal number only within one object. Half the strangeness of C’s pointer rules lives here — we learned numbers as things that are all three at once, while an address is whichever of the three the context allows.

Figure 35.1 — The three things that travel with one pointer value. The same address does not make the same pointer.

35.3.1 Why an integer, of all things

Naming an object could have been done otherwise — a name string, an index into a table, a handle; languages and operating systems have done all of these. C chose an integer for a simple reason: the machine was already doing it that way. As chapters 4 and 5 showed, a machine address is a number, adding to it gives the neighbouring slot, and CPUs have circuitry that computes “base + index × size” in one step. Choose an integer and arrays, strings and struct access all follow for free.

That choice became C’s power and its danger. The power is expressiveness — arrays arrive with no extra syntax (chapter 38), and memory can be handled in bulk (chapter 88). The danger is the illusion that the number may be handled like any other number.

35.3.2 The abstraction has thickened with time

Pointers were not always as delicate as they are now. In early C a pointer was close to a transcription of the machine address, and it was common practice to convert one to an integer, play with it and convert back. Machines were simple then — memory was one layer, instructions ran in the order written, and the compiler did not greatly rearrange what a person had written.

Since then the layers underneath have thickened.

• Memory split into levels (chapter 11) — registers, caches, DRAM, and above them virtual addresses and page tables. The number a program sees has already been translated.
• Execution began to overlap (chapter 12) — pipelines, out-of-order execution, branch prediction. “In the order written” is no longer true.
• The compiler became an editor (chapter 13) — it rewrites code wholesale so long as the observable behaviour is kept. One of the premises that rewriting rests on is “this pointer does not touch that object”.

The thicker those layers grew, the more the language had to ask of pointers. For a compiler to reorder on the premise that “distinct objects do not touch one another”, it needs a promise that the program will not break that premise. So pointers have drifted away from being numbers and been refined into located values with a contract — the alignment rules (chapter 37), provenance (chapter 37), and the rule against forming an address outside its array (chapter 38) are all clauses in that direction.

35.4 How to print an address

The first thing anyone does when debugging is look at where a pointer points. Even this ordinary act has a contract.

/* Addresses in a form people read — the contract of %p and the alternatives.
   * Addresses differ from run to run (ASLR), so this demonstration prints
     properties, not values: what is printed here must be the same every time. */
#include <inttypes.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>

int main(void)
{
    int n = 42;

    /* (1) %p takes a void* (and, from C23, a character-type pointer) only.
          Cast anything else — better to make it a habit. */
    puts("[the contract of %p]");
    printf("  a null pointer via %%p: %p   <- the form is implementation-defined\n",
           (void *)nullptr);
    puts("  Other addresses differ per run, so they are not printed here.");

    /* (2) print one address two ways and compare the strings */
    char a[64], b[64];
    snprintf(a, sizeof a, "%p", (void *)&n);
    snprintf(b, sizeof b, "%#" PRIxPTR, (uintptr_t)(void *)&n);
    printf("\n[do %%p and PRIxPTR produce the same text?]\n");
    printf("  on this implementation: %s\n", strcmp(a, b) == 0 ? "yes" : "no");
    printf("  same number of characters: %s (the value is not printed)\n",
           strlen(a) == strlen(b) ? "yes" : "no");

    /* (3) the guaranteed round trip is void* <-> uintptr_t */
    uintptr_t u = (uintptr_t)(void *)&n;
    printf("\n[the uintptr_t round trip]\n");
    printf("  is the pointer back equal to the original: %s\n",
           (void *)u == (void *)&n ? "yes — the standard promises it" : "no");

    /* (4) a fixed width keeps a log tidy (padded with zeroes) */
    char line[80];
    snprintf(line, sizeof line, "obj=0x%016" PRIxPTR, u);
    printf("\n[making one line of a log]\n");
    printf("  length of the line produced: %zu characters (constant, whatever the address)\n",
           strlen(line));

    /* (5) compare layout inside one array — subtracting across objects is outside the contract */
    int arr[3];
    printf("\n[comparing layout]\n");
    printf("  arr[0] to arr[1]: %td bytes (legal — the same array)\n",
           (char *)&arr[1] - (char *)&arr[0]);
    printf("  equal to sizeof(int): %s\n",
           (size_t)((char *)&arr[1] - (char *)&arr[0]) == sizeof(int) ? "yes" : "no");

    /* (6) a human-facing log wants names and ordinals, not addresses */
    puts("\n[names instead of addresses]");
    static const struct { const char *name; const void *at; } table[] = {
        { "n", nullptr }, { "arr", nullptr },
    };
    for (size_t i = 0; i < sizeof table / sizeof *table; i++)
        printf("  #%zu %-4s <- this name is what the log keeps\n", i, table[i].name);
    puts("  An address means something only within that run; the next run differs.");
    return 0;
}

[the contract of %p]
  a null pointer via %p: (nil)   <- the form is implementation-defined
  Other addresses differ per run, so they are not printed here.

[do %p and PRIxPTR produce the same text?]
  on this implementation: yes
  same number of characters: yes (the value is not printed)

[the uintptr_t round trip]
  is the pointer back equal to the original: yes — the standard promises it

[making one line of a log]
  length of the line produced: 22 characters (constant, whatever the address)

[comparing layout]
  arr[0] to arr[1]: 4 bytes (legal — the same array)
  equal to sizeof(int): yes

[names instead of addresses]
  #0 n    <- this name is what the log keeps
  #1 arr  <- this name is what the log keeps
  An address means something only within that run; the next run differs.

35.4.1 The exact contract of %p

What the standard fixes (§7.23.6.1) is two lines.

Two practical rules follow at once.

First, cast anything else. Passing an int * straight in, as in printf("%p", &n), is outside the contract: variadic arguments carry no type check (chapter 58), and nothing guarantees that pointer types share a representation — the standard says only that void * and character pointers do, and states plainly that pointers to other types may not (§6.2.5p33).

printf("%p", (void *)p);      /* like this */
printf("%p", p);              /* not like this */

Second, do not lean on the output’s form. The demonstration printing a null pointer is the proof: this implementation writes (nil). The 0x prefix, the number of digits and the letter case all vary. So never write code that parses what %p produced.

35.4.2 When it has to become a string — uintptr_t and PRIxPTR

To put an address into a log buffer or to line columns up, %p is not enough. That is what uintptr_t from <stdint.h> and PRIxPTR from <inttypes.h> are for.

uintptr_t u = (uintptr_t)(void *)p;
snprintf(line, sizeof line, "obj=0x%016" PRIxPTR, u);

What the standard promises uintptr_t is exactly this — any valid void * converted to it and back compares equal to the original (§7.22.1.4). The demonstration checks that round trip.

Two things to know. uintptr_t is optional, so an implementation may lack it (rare today), and the round trip is guaranteed for void * only — function pointers are outside that sentence (chapter 59).

35.4.3 But — does the address need printing at all?

The last part of this section matters most. An address means something only within that run.

Today’s operating systems randomise the layout at every launch (ASLR), so the 0x7ffd… in yesterday’s log means nothing in today’s run. And once such a value gets out, it tells an attacker how memory is laid out — the first thing they look for.

35.5 The size of a pointer is not one number

Here is why the answer above said “8 bytes on this machine” so carefully. The widespread belief runs: “a pointer is just an address, so within one machine they are all the same size.” On the x86-64 Linux we use today that is true, which is why the belief is so rarely contradicted. But the C standard never promised it, and real machines have broken it more than once.

What the standard actually promises is much narrower.

• void * and the character-type pointers (char *, signed char *, unsigned char *) have the same representation and alignment requirements as each other. Those four go together.
• Pointers to structures share a representation with one another; so do pointers to unions.
• Beyond that, nothing is promised. There is no rule that int * and double * must be the same size, and none that an object pointer and a function pointer must share a representation.

Why leave it so loose — because machines really were different.

Nor is this only in the past tense.

The concept of the pointer is in place. The next chapter is this part’s first safety rule — how to handle “points nowhere.” The three nulls whose faces we learned in chapter 6 get their formal treatment, this time in syntax and practical rules.