59 Functions as values — the function pointer

59.1 The name decays into a pointer

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

static int add(int a, int b) { return a + b; }
static int mul(int a, int b) { return a * b; }

/* a function taking a function pointer — the basic form of a callback */
static int apply(int (*op)(int, int), int a, int b) { return op(a, b); }

int main(void)
{
    /* (1) a function name decays to a pointer the moment it is used as a value */
    int (*p)(int, int) = add;     /* it works without & */
    int (*q)(int, int) = &add;    /* attaching & is the same */
    printf("add == &add : %s\n", p == q ? "same" : "different");

    /* (2) however many stars are attached the result is the same — the dereference decays again */
    printf("p(2,3)=%d  (*p)(2,3)=%d  (***p)(2,3)=%d  (*******p)(2,3)=%d\n",
           p(2, 3), (*p)(2, 3), (***p)(2, 3), (*******p)(2, 3));

    /* (3) & , on the other hand, can be used only once: &&add is a syntax error
          (&add is only a value, and the address of that value cannot be taken again) */

    /* (4) a dispatch table — choosing with an array instead of a switch */
    struct { const char *name; int (*fn)(int, int); } table[] = {
        { "add", add }, { "mul", mul },
    };
    for (size_t i = 0; i < sizeof table / sizeof table[0]; i++)
        printf("%s(6,7) = %d\n", table[i].name, apply(table[i].fn, 6, 7));

    /* (5) there is no guarantee that a function pointer is the size of a data pointer */
    printf("sizeof(void*)=%zu, sizeof(int(*)(int,int))=%zu\n",
           sizeof(void *), sizeof(int (*)(int, int)));

    /* (6) qsort's comparator is a function pointer too */
    int v[] = { 5, 2, 9, 1 };
    int cmp(const void *a, const void *b);   /* defined below */
    qsort(v, 4, sizeof v[0], cmp);
    printf("sorted: %d %d %d %d\n", v[0], v[1], v[2], v[3]);
    return 0;
}

int cmp(const void *a, const void *b)
{
    int x = *(const int *)a, y = *(const int *)b;
    return (x > y) - (x < y);
}

add == &add : same
p(2,3)=5  (*p)(2,3)=5  (***p)(2,3)=5  (*******p)(2,3)=5
add(6,7) = 13
mul(6,7) = 42
sizeof(void*)=8, sizeof(int(*)(int,int))=8
sorted: 1 2 5 9

The first two lines of the output are this chapter’s heart.

add == &add — the function name decays into a pointer, and attaching & gives the same pointer. So the two are equal.

(*******p)(2,3) compiles — the reason any number of stars gives the same result is this. *p dereferences the pointer to obtain a function designator, and the moment that designator is used as a value it decays back into a pointer. That is, each * merely goes once round the loop “pointer → function → pointer” and stays where it was.

The opposite direction does not hold. &&add is a syntax error — &add is already a value (a pointer), and in C the address of a value cannot be taken (to take an address there must be a named place, that is, an lvalue). Hence the asymmetry that **add works while &&add does not.

59.2 The type is the contract

A function pointer’s type is settled by the return type and the parameter list.

int  (*p)(int, int);       /* pointer to a function taking two ints, giving an int */
void (*q)(void);           /* pointer to a function with no arguments and no return */
int  (*r[4])(int);         /* an array of four such pointers */
int  (*(*s)(void))(int);   /* hard to read — use a typedef */

As the last line shows, declarations quickly turn rough. The practice in the field is typedef.

typedef int (*binop_fn)(int, int);
binop_fn table[] = { add, mul };

Casting to a function pointer of a different type and calling it is outside the contract. For example, something stored as void (*)(void) must not be called back as int (*)(int). Only storing and converting back to the original type to call is guaranteed.

int cmp_int(const int *a, const int *b);            /* looks convenient, but */
qsort(v, n, sizeof v[0], (int (*)(const void *, const void *))cmp_int);

59.3 void * and function pointers are different worlds

Chapter 35 taught that void * is “a vessel that holds any data pointer”. Yet function pointers do not go into that vessel. The standard does not define conversion between data pointers and function pointers.

The reason lies in history and hardware. On a machine using a Harvard architecture, code and data are in different address spaces — the AVR microcontroller is representative, and there “address 0” exists separately in the code region and in the data region. Even the widths of the addresses may differ. On such a machine, putting the two pointers in the same vessel is impossible to begin with.

That is why the example printed the two sizes together. On this machine they happened to be equal, but there is no guarantee anywhere that they are.

That this split is not an academic worry has a proof at the heart of Unix. The POSIX function dlsym, which finds a function in a dynamic library, returns a void *, while what the caller wants is a function pointer — that is, a widely used API demands a conversion the standard does not define. This story is followed to its end later in the chapter, in the section on printing function pointers.

59.4 How to print a function pointer

The previous section said void * and function pointers are different worlds. The place that fact trips people up most often is logging — you want to record “which callback ran”, and chapter 35′s printf("%p", (void *)p) does not work here.

/* Printing a function pointer — three roads for a value %p will not take. */
#include <inttypes.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>

static int add(int a, int b) { return a + b; }
static int sub(int a, int b) { return a - b; }
static int mul(int a, int b) { return a * b; }

typedef int (*binop)(int, int);

/* ── Road 1: lift the bytes and print them in hex ───────────────────
   Casting a function pointer to void* is outside the standard. Moving the
   bytes with memcpy is inside the contract everywhere — the size is all. */
static void fmt_funcptr(char *out, size_t cap, binop f)
{
    unsigned char raw[sizeof f];
    memcpy(raw, &f, sizeof raw);

    size_t k = 0;
    k += (size_t)snprintf(out + k, cap - k, "0x");
    for (size_t i = sizeof raw; i-- > 0 && k + 2 < cap; )
        k += (size_t)snprintf(out + k, cap - k, "%02X", raw[i]);
}

/* ── Road 2: carry the name alongside (the practical answer) ─────── */
struct named_op {
    const char *name;
    binop       fn;
};

static const struct named_op ops[] = {
    { "add", add }, { "sub", sub }, { "mul", mul },
};

static const char *name_of(binop f)
{
    for (size_t i = 0; i < sizeof ops / sizeof *ops; i++)
        if (ops[i].fn == f) return ops[i].name;      /* comparing function pointers is legal */
    return "(unknown function)";
}

int main(void)
{
    printf("sizeof(function pointer) = %zu, sizeof(void *) = %zu\n\n",
           sizeof(binop), sizeof(void *));

    puts("[Road 1] print the bytes — portable, but a riddle to a reader");
    char buf[2 + 2 * sizeof(binop) + 1];
    fmt_funcptr(buf, sizeof buf, add);
    printf("  length of add's address string: %zu characters (the value differs per run)\n",
           strlen(buf));
    printf("  does it start with \"0x\": %s\n", strncmp(buf, "0x", 2) == 0 ? "yes" : "no");

    puts("\n[Road 2] print the name — this is what a log should keep");
    binop chosen[] = { mul, add, sub };
    for (size_t i = 0; i < sizeof chosen / sizeof *chosen; i++)
        printf("  call %zu: %s(7, 3) = %d\n",
               i, name_of(chosen[i]), chosen[i](7, 3));

    puts("\n[comparing function pointers is inside the contract]");
    binop f = add, g = add, h = sub;
    printf("  equal when they point at the same function: %s\n", f == g ? "yes" : "no");
    printf("  different when the functions differ:      %s\n", f != h ? "yes" : "no");
    puts("  So \"which function is it\" can be answered without printing an address.");

    puts("\n[what not to do]");
    puts("  printf(\"%p\", f);          <- a function pointer to %p: outside the contract");
    puts("  printf(\"%p\", (void *)f);  <- outside ISO C (POSIX allows it). -Wpedantic warns");
    puts("  printf(\"%p\", (void *)&f); <- compiles, but that is the *variable's* address");
    return 0;
}

sizeof(function pointer) = 8, sizeof(void *) = 8

[Road 1] print the bytes — portable, but a riddle to a reader
  length of add's address string: 18 characters (the value differs per run)
  does it start with "0x": yes

[Road 2] print the name — this is what a log should keep
  call 0: mul(7, 3) = 21
  call 1: add(7, 3) = 10
  call 2: sub(7, 3) = 4

[comparing function pointers is inside the contract]
  equal when they point at the same function: yes
  different when the functions differ:      yes
  So "which function is it" can be answered without printing an address.

[what not to do]
  printf("%p", f);          <- a function pointer to %p: outside the contract
  printf("%p", (void *)f);  <- outside ISO C (POSIX allows it). -Wpedantic warns
  printf("%p", (void *)&f); <- compiles, but that is the *variable's* address

59.4.1 Why it cannot be passed to %p

The reasons stack three deep. Peel them off one at a time.

First, %p takes a void * (or a character pointer) only (chapter 35). A function pointer is not on that list.

Second, a variadic function will not do the conversion for you. As chapter 58 showed, an argument passed through ... undergoes only the default argument promotions — integers to int, float to double. There is no such promotion for pointers. So the void * that %p requires has to be produced by an explicit cast at the call site. “It will sort itself out” does not apply here.

Third, and that cast is itself outside the standard, exactly as the previous section said. So the line below has no basis in the standard’s text, even where a compiler accepts it.

printf("%p", (void *)f);      /* a conversion ISO C does not define */

GCC’s own reaction, as checked for this book, says the same: turn on -Wpedantic and you get “ISO C forbids conversion of function pointer to object pointer type”.

★ The three layers in one line: %p demands a void *, a variadic call will not convert for you, and the conversion you write by hand is undefined. And the last link runs deepest — as the previous section showed, function pointers are a family of their own, separate from object pointers, so on a Harvard machine or an ABI built on function descriptors there is no guarantee that a void * can even hold a function address. It is not a problem of syntax but of the vessel.

printf("%p", f);              /* 1: the function pointer itself — outside the contract */
printf("%p", (void *)f);      /* 2: a conversion outside ISO C (POSIX allows it) */
printf("%p", (void *)&f);     /* 3: compiles, warns about nothing, and… */

void (*fn)(void);
*(void **)&fn = dlsym(handle, "do_work");   /* the idiom that skirts the gap */

dlfunc_t dlfunc(void *restrict handle, const char *restrict symbol);

struct __dlfunc_arg { int __dlfunc_dummy; };
typedef void (*dlfunc_t)(struct __dlfunc_arg);   /* FreeBSD <dlfcn.h> */

59.4.2 The portable road — lift the bytes

To solve it with the standard alone, do not read the pointer as a value; move its bytes. memcpy is inside the contract for any type.

unsigned char raw[sizeof f];
memcpy(raw, &f, sizeof raw);
for (size_t i = sizeof raw; i-- > 0; ) printf("%02X", raw[i]);

The demonstration’s fmt_funcptr is that shape. What it gains and loses is plain — it compiles everywhere with no warning, and it is a riddle to a reader. On some platforms those bytes are not even the function’s entry point but the address of a descriptor (see the platform note below).

59.4.3 The best answer — a name instead of an address

The practical answer is the third road: do not print the address, print the name.

The demonstration’s struct named_op is that pattern. Keep a name string in the function table and the log holds a line a person reads at once, such as mul(7, 3) = 21. Comparing function pointers is guaranteed by the standard (equal when they point at the same function), so scanning the table for the name is inside the contract too.

59.5 Dispatch tables — an array instead of a switch

The example’s ④ is that. Pair names with functions and lay them out in an array, and you choose by data instead of by branching. To add an item you mend only the table, not the code, and combined with chapter 57′s X macro you can even generate the table from a single list.

Grow this pattern and it becomes a state machine, a command interpreter, a plugin structure. And grow it further — that is the next section’s story.

59.6 The virtual function table — object orientation built in C

C has no classes. But put, as a struct’s first member, a pointer to a table of function pointers and you obtain polymorphism, the heart of object orientation.

#include <stdio.h>
#include <string.h>

/* Object orientation built by hand in C: the table of virtual functions
   (a vtable) is kept apart from the data. The same skeleton GTK's GObject uses. */

struct shape;                       /* a forward declaration */

/* (1) the vtable — one per type, not one per instance */
struct shape_vtable {
    const char *name;
    double (*area)(const struct shape *self);
    void   (*describe)(const struct shape *self);
};

/* (2) the base "class": the first member of every object points at the table */
struct shape {
    const struct shape_vtable *vt;
};

/* (3) the derived "class": put the base first and the pointers convert to each other */
struct circle { struct shape base; double r; };
struct rect   { struct shape base; double w, h; };

static double circle_area(const struct shape *s)
{
    const struct circle *c = (const struct circle *)s;   /* being the first member, the address is the same */
    return 3.14159265358979 * c->r * c->r;
}
static double rect_area(const struct shape *s)
{
    const struct rect *r = (const struct rect *)s;
    return r->w * r->h;
}
static void generic_describe(const struct shape *s)
{
    printf("  %-9s area %.2f\n", s->vt->name, s->vt->area(s));
}

/* (4) the table is constant and one per type — an instance holds only a pointer */
static const struct shape_vtable circle_vt = { "circle",    circle_area, generic_describe };
static const struct shape_vtable rect_vt   = { "rectangle", rect_area,   generic_describe };

static struct circle make_circle(double r) { return (struct circle){ { &circle_vt }, r }; }
static struct rect   make_rect(double w, double h) { return (struct rect){ { &rect_vt }, w, h }; }

int main(void)
{
    struct circle c = make_circle(2.0);
    struct rect   r = make_rect(3.0, 4.0);

    /* (5) the same code handles different types — polymorphism */
    const struct shape *objs[] = { &c.base, &r.base };
    for (size_t i = 0; i < sizeof objs / sizeof objs[0]; i++)
        objs[i]->vt->describe(objs[i]);

    /* (6) the cost, seen with the eyes */
    printf("object sizes: circle=%zu, rect=%zu (the %zu-byte table pointer included)\n",
           sizeof(struct circle), sizeof(struct rect), sizeof(void *));
    printf("table size  : %zu (only one exists per type)\n", sizeof(struct shape_vtable));
    return 0;
}

  circle    area 12.57
  rectangle area 12.00
object sizes: circle=16, rect=24 (the 8-byte table pointer included)
table size  : 24 (only one exists per type)

The design has four bones.

1. One table per type (static const). Copying the function pointers into every instance makes objects large and the cache worse — so the table is kept separately in a single copy, and the object holds only one pointer to it.
2. The base struct is the first member. The standard guarantees that “a struct’s first member begins at the same address as the struct itself”, so struct circle * and struct shape * can be safely gone between (chapter 46).
3. Calls go through the table — s->vt->area(s). This one line does exactly what a C++ virtual function call does.
4. The object itself is passed as the first argument. Writing by hand the this that C++ hides.

The last two lines of the output show the cost. What grows per object is one pointer (8 bytes) only, and the table exists once per type.

We are equipped even to handle functions as values. Yet several times in this chapter there were places where the declaration itself was hard to read and we fled to typedef — things like int (*(*s)(void))(int);. The next chapter pays that debt: C’s most notorious place, reading declarations, met head on with two ways of reading and with typedef.