← C

C Standards & Best Practices

← C Standards & Best Practices

Select a question from the sidebar

8 questions in this topic

Question 1 / 8

What are the key differences between C89/C90, C99, C11, and C17?

The C standard has evolved through several major revisions, each adding important features:

C89/C90 (ANSI C / ISO C): The original standard.

Function prototypes required.
Variables must be declared at the start of a block.
No // single-line comments (only /* */).
No inline keyword.
No _Bool type.
No long long type.
No variable-length arrays.

C99 (ISO/IEC 9899:1999): Major modernization.

// single-line comments.
Mixed declarations and code (variables anywhere in a block).
inline functions.
_Bool type (and <stdbool.h>).
long long int (at least 64-bit).
Variable-Length Arrays (VLAs).
Designated initializers: int a[5] = { [2] = 42 }.
Compound literals: (struct point){.x = 1, .y = 2}.
restrict pointer qualifier.
<stdint.h> with uint32_t, int8_t, etc.
<inttypes.h> with PRId32, SCNu64 format macros.
snprintf() (safe formatted output).

C11 (ISO/IEC 9899:2011): Concurrency and safety.

_Generic (type-generic expressions, basis for tgmath.h).
_Static_assert (compile-time assertions).
_Noreturn function specifier.
_Alignas / _Alignof (alignment control).
Anonymous structs and unions.
<stdatomic.h> (atomic operations).
<threads.h> (portable threading).
gets() removed (security hazard).
VLAs made optional (implementations can omit them).

C17/C18 (ISO/IEC 9899:2018): Bug-fix release.

No new features.
Clarifications and defect fixes from C11.
__STDC_VERSION__ = 201710L.

C23 (ISO/IEC 9899:2024): Latest standard.

typeof operator.
#embed directive.
Binary literals (0b1010).
Digit separators (1'000'000).
nullptr constant.
constexpr objects.

Pseudo Code

C89: Variables at top of block only. No // comments.
C99: Mixed declarations, //, VLAs, inline, _Bool, stdint.h, restrict.
C11: _Generic, _Static_assert, atomics, threads, anonymous structs.
C17: Bug fixes only. No new features.
C23: typeof, #embed, binary literals, nullptr.

Code

#include <stdio.h>
#include <stdbool.h>   /* C99: _Bool as bool */
#include <stdint.h>    /* C99: uint32_t, int8_t, etc. */

int main(void) {
    /* C89: only block-start declarations */
    /* C99: mixed declarations and code */
    printf("Hello\n");
    int x = 42;  /* C99: declaration after statement */

    /* C99: // single-line comments */
    // This is a C99 comment

    /* C99: bool type via stdbool.h */
    bool flag = true;

    /* C99: long long */
    long long big = 9223372036854775807LL;

    /* C99: fixed-width integers */
    uint32_t val = 0xDEADBEEF;
    int8_t byte = -128;

    /* Check standard version */
    #if __STDC_VERSION__ >= 201710L
        printf("C17 or later\n");
    #elif __STDC_VERSION__ >= 201112L
        printf("C11\n");
    #elif __STDC_VERSION__ >= 199901L
        printf("C99\n");
    #else
        printf("C89/C90\n");
    #endif

    printf("x=%d, flag=%d, big=%lld, val=0x%X, byte=%d\n",
           x, flag, big, val, byte);

    return 0;
}

Hello
C17 or later
x=42, flag=1, big=9223372036854775807, val=0xDEADBEEF, byte=-128
(Standard version line depends on compiler; shown for C17+)

Key Points

•C99 added mixed declarations, //, VLAs, inline, _Bool, stdint.h, designated initializers, restrict
•C11 added _Generic, _Static_assert, atomics (stdatomic.h), threads (threads.h), anonymous structs
•C17 is a bug-fix release with no new features
•__STDC_VERSION__ macro identifies the standard version at compile time
•C23 adds typeof, #embed, binary literals, nullptr

Gotchas

•VLAs are mandatory in C99 but optional in C11+ (MSVC never supported them)
•C11 threads.h is optional and rarely implemented -- most code uses pthreads instead
•gets() was removed in C11 -- code using it will not compile under C11+
•Many embedded compilers only support C99 or even C89 -- check your toolchain's conformance

C89: basic C. C99: // comments, mixed declarations, VLAs, inline, stdint.h, _Bool, restrict. C11: _Generic, _Static_assert, atomics, threads. C17: bug fixes only. Check with __STDC_VERSION__.

•C99: mixed decls, stdint.h, VLAs, restrict, inline
•C11: _Generic, _Static_assert, atomics; C17: bug fixes

#if __STDC_VERSION__ >= 201112L
  /* C11 features available */
  _Static_assert(sizeof(int) == 4, "int must be 4 bytes");
#endif

#if __STDC_VERSION__ >= 199901L
  /* C99 features available */
  bool flag = true;  /* stdbool.h */
  uint32_t x = 42;   /* stdint.h */
#endif

VLAs are optional in C11+ -- do not rely on them for portable code

Question 2 / 8

What are the most important C99 features (designated initializers, VLAs, inline, _Bool, mixed declarations)?

C99 was the biggest modernization of C. Here are the features most commonly asked about in interviews:

1. Designated initializers: Initialize specific elements of arrays or struct members by name.

int arr[5] = { [2] = 42, [4] = 99 };  /* arr = {0,0,42,0,99} */
struct point p = { .y = 10, .x = 5 };  /* order doesn't matter */

2. Variable-Length Arrays (VLAs): Array size determined at runtime.

void func(int n) { int arr[n]; }  /* size n known only at runtime */

VLAs are allocated on the stack. They cannot be static or extern. Made optional in C11.

3. inline keyword: Suggests the compiler inline a function (expand it at the call site). The function must be defined in every translation unit that uses it (typically in a header). static inline is the common safe pattern.

4. _Bool type: A true boolean type. <stdbool.h> provides bool, true, false macros. Converting any non-zero value to _Bool gives 1.

5. Mixed declarations and code: Variables can be declared anywhere in a block, not just at the top.

6. Compound literals: Create unnamed objects inline.

struct point *p = &(struct point){ .x = 1, .y = 2 };

7. restrict keyword: Tells the compiler that a pointer is the only way to access the memory it points to, enabling better optimization.

8. <stdint.h>: Fixed-width integer types: int8_t, uint32_t, int64_t, etc.

Pseudo Code

Designated initializers:
  int a[10] = { [0]=1, [5]=50, [9]=90 };  /* rest are 0 */
  struct rgb c = { .r=255, .g=0, .b=128 };

VLA:
  void process(int n) { double data[n]; }

inline:
  static inline int max(int a, int b) { return a > b ? a : b; }

_Bool:
  _Bool flag = 42;  /* flag == 1 (any non-zero -> 1) */

Code

#include <stdio.h>
#include <stdbool.h>
#include <stdint.h>

/* 1. Designated initializers */
struct color { uint8_t r, g, b; };

void designated_init_demo(void) {
    /* Array: initialize specific indices */
    int lookup[10] = { [0] = -1, [5] = 50, [9] = 100 };
    /* Unspecified elements are zero */
    printf("lookup[5]=%d, lookup[3]=%d\n", lookup[5], lookup[3]); /* 50, 0 */

    /* Struct: initialize by name (order independent) */
    struct color red = { .r = 255, .g = 0, .b = 0 };
    struct color blue = { .b = 255 }; /* r and g are 0 */
    printf("red.r=%d, blue.b=%d\n", red.r, blue.b);
}

/* 2. Variable-Length Array */
void vla_demo(int n) {
    int arr[n]; /* VLA: size determined at runtime */
    for (int i = 0; i < n; i++)
        arr[i] = i * i;
    printf("VLA arr[%d-1] = %d\n", n, arr[n - 1]);
}

/* 3. inline function */
static inline int max(int a, int b) {
    return (a > b) ? a : b;
}

/* 4. _Bool type */
void bool_demo(void) {
    _Bool a = 42;   /* _Bool conversion: any non-zero -> 1 */
    bool  b = true; /* via stdbool.h */
    printf("_Bool of 42 = %d\n", a); /* 1 */
    printf("bool true = %d\n", b);   /* 1 */
}

/* 5. Compound literal */
struct point { int x, y; };
void print_point(const struct point *p) {
    printf("(%d, %d)\n", p->x, p->y);
}

/* 6. restrict keyword */
void add_arrays(int * restrict dst,
                const int * restrict a,
                const int * restrict b,
                int n) {
    /* restrict: compiler assumes dst, a, b don't alias */
    for (int i = 0; i < n; i++)
        dst[i] = a[i] + b[i]; /* can be vectorized */
}

int main(void) {
    designated_init_demo();

    /* 5. Mixed declarations and code (C99) */
    printf("Before declaration\n");
    int late_var = 100; /* C89 would require this at top */
    printf("late_var = %d\n", late_var);

    vla_demo(5);
    printf("max(3,7) = %d\n", max(3, 7));
    bool_demo();

    /* Compound literal: create struct inline */
    print_point(&(struct point){ .x = 10, .y = 20 });

    return 0;
}

lookup[5]=50, lookup[3]=0
red.r=255, blue.b=255
Before declaration
late_var = 100
VLA arr[5-1] = 16
max(3,7) = 7
_Bool of 42 = 1
bool true = 1
(10, 20)

Key Points

•Designated initializers: {.field=val} for structs, {[idx]=val} for arrays
•VLAs: runtime-sized stack arrays; optional in C11+
•static inline is the safe portable inline pattern
•_Bool converts any non-zero to 1; stdbool.h provides bool/true/false
•Compound literals create unnamed objects inline: (type){initializer}

Gotchas

•VLAs are on the stack -- a large n causes stack overflow with no way to check for failure
•VLAs are optional in C11+; MSVC does not support them at all
•An inline function without static may cause linker errors (multiple definitions) if defined in a header
•Compound literals have block scope -- a pointer to one becomes dangling after the block ends

C99 highlights: designated initializers ({.x=1}), VLAs, static inline, _Bool/stdbool.h, mixed declarations, compound literals, restrict, stdint.h. VLAs are optional in C11+.

•Designated initializers, VLAs, inline, _Bool, mixed declarations
•VLAs optional in C11+; use static inline for safe inlining

int a[5] = { [2] = 42 };          /* designated init */
struct pt p = { .x = 1, .y = 2 }; /* named members */
int n = 10; int vla[n];            /* VLA */
static inline int sq(int x) { return x * x; }
bool flag = true;                  /* stdbool.h */

VLAs on the stack can overflow it -- no way to check for allocation failure

Question 3 / 8

What are the key C11 features (_Generic, _Static_assert, _Noreturn, anonymous structs, atomics)?

C11 added several important features focused on type safety, concurrency, and expressiveness:

1. _Generic: Type-generic selection. Enables function-like macros that dispatch based on the type of an argument. This is how <tgmath.h> works.

#define abs(x) _Generic((x), int: abs_int, double: fabs)(x)

2. _Static_assert: Compile-time assertion. Causes a compilation error if the condition is false. C23 allows omitting the message.

_Static_assert(sizeof(int) == 4, "int must be 4 bytes");

3. _Noreturn: Specifies that a function never returns (like exit(), abort(), infinite loop). Helps the compiler optimize and warn about dead code.

4. Anonymous structs/unions: Unnamed struct/union members whose fields are accessed directly.

struct { union { int x; float f; }; int tag; } val;
val.x = 42; /* access union member directly */

5. <stdatomic.h>: Atomic types and operations for lock-free concurrency.

atomic_int, atomic_flag
atomic_load(), atomic_store(), atomic_fetch_add()
Memory ordering: memory_order_relaxed, memory_order_acquire, memory_order_release, memory_order_seq_cst

6. <threads.h>: Portable threading API (thrd_create, mtx_lock, cnd_wait). Optional and rarely implemented.

7. Alignment: _Alignas(N) forces alignment; _Alignof(type) queries alignment.

8. gets() removed: The unsafe gets() function was finally removed from the standard.

Pseudo Code

_Generic: dispatch on argument type at compile time
_Static_assert: compile-time check, error if false
_Noreturn: function never returns (exit, abort, infinite loop)
Anonymous struct/union: access inner members directly
stdatomic.h: atomic_int, atomic_load, atomic_store, fences
threads.h: thrd_create, mtx_lock (optional, rarely used)

Code

#include <stdio.h>
#include <stdlib.h>
#include <stdatomic.h>
#include <assert.h>

/* 1. _Generic: type-generic macro */
#define type_name(x) _Generic((x), \
    int:     "int",            \
    double:  "double",         \
    char *:  "char *",         \
    default: "unknown")

#define print_val(x) _Generic((x),       \
    int:    printf("%d\n", (x)),         \
    double: printf("%f\n", (x)),         \
    char *: printf("%s\n", (x)))

/* 2. _Static_assert: compile-time checks */
_Static_assert(sizeof(int) >= 4, "int must be at least 4 bytes");
_Static_assert(sizeof(void *) == 8 || sizeof(void *) == 4,
               "pointer must be 4 or 8 bytes");

/* 3. _Noreturn */
_Noreturn void die(const char *msg) {
    fprintf(stderr, "FATAL: %s\n", msg);
    exit(EXIT_FAILURE);
    /* No return statement needed -- compiler knows */
}

/* 4. Anonymous struct/union */
struct variant {
    int tag;
    union {        /* anonymous union */
        int i;
        double d;
        char s[16];
    };             /* no name -- members accessed directly */
};

/* 5. Atomics */
void atomics_demo(void) {
    atomic_int counter = 0;
    atomic_store(&counter, 10);
    int old = atomic_fetch_add(&counter, 5); /* returns 10, counter=15 */
    int val = atomic_load(&counter);
    printf("atomic: old=%d, current=%d\n", old, val);

    /* atomic_flag: guaranteed lock-free on all platforms */
    atomic_flag lock = ATOMIC_FLAG_INIT;
    while (atomic_flag_test_and_set(&lock)) { } /* spin-lock acquire */
    /* critical section */
    atomic_flag_clear(&lock); /* release */
}

/* 6. _Alignas */
_Alignas(64) int cache_line_aligned_data[16]; /* 64-byte aligned */

int main(void) {
    /* _Generic */
    printf("42 is: %s\n", type_name(42));        /* int */
    printf("3.14 is: %s\n", type_name(3.14));    /* double */
    printf("str is: %s\n", type_name("hello"));  /* char * */

    print_val(42);     /* calls printf("%d\n", 42) */
    print_val(3.14);   /* calls printf("%f\n", 3.14) */

    /* Anonymous struct/union */
    struct variant v;
    v.tag = 0;
    v.i = 42;  /* access union member directly (no .u.i) */
    printf("variant: tag=%d, i=%d\n", v.tag, v.i);

    /* _Alignof */
    printf("Alignment of double: %zu\n", _Alignof(double));
    printf("Alignment of cache_line_data: %zu\n",
           _Alignof(cache_line_aligned_data));

    atomics_demo();

    return 0;
}

42 is: int
3.14 is: double
str is: char *
42
3.140000
variant: tag=0, i=42
Alignment of double: 8
Alignment of cache_line_data: 64
atomic: old=10, current=15

Key Points

•_Generic enables type-dispatched macros (C's version of function overloading)
•_Static_assert catches errors at compile time -- no runtime cost
•_Noreturn informs the compiler a function never returns (exit, abort)
•Anonymous structs/unions allow direct member access without intermediate names
•stdatomic.h provides atomic types and operations for lock-free concurrency

Gotchas

•_Generic evaluates at compile time based on TYPE, not value -- all branches must compile even if not selected
•threads.h is optional in C11 and most compilers do not implement it -- use pthreads instead
•atomic_int may not be lock-free on all platforms -- only atomic_flag is guaranteed lock-free
•C11 made VLAs optional -- code relying on VLAs is no longer strictly portable

_Generic: type-dispatched macros. _Static_assert: compile-time check. _Noreturn: for exit/abort. Anonymous structs/unions. stdatomic.h for atomic operations. threads.h (optional).

•_Generic dispatches on type; _Static_assert checks at compile time
•stdatomic.h for thread-safe operations

/* _Generic: type-based dispatch */
#define print(x) _Generic((x), int: printf("%d",x), double: printf("%f",x))

/* _Static_assert: compile-time check */
_Static_assert(sizeof(int) == 4, "int must be 4 bytes");

/* Atomic counter */
atomic_int count = 0;
atomic_fetch_add(&count, 1); /* thread-safe increment */

threads.h is optional and rarely implemented -- use pthreads

Question 4 / 8

What does the restrict keyword do and how does it help optimization?

The restrict qualifier (C99) is a promise from the programmer that a pointer is the sole means of accessing the memory it points to during its lifetime. This allows the compiler to generate more efficient code by assuming no aliasing.

The aliasing problem: Without restrict, the compiler must assume any two pointers might point to overlapping memory. This prevents optimizations like vectorization, reordering stores, or caching values in registers.

Example:

void add(int *a, const int *b, int n) {
    for (int i = 0; i < n; i++) a[i] += b[i];
}

Without restrict, the compiler cannot assume a and b don't overlap. If a[0] and b[1] are the same memory location, writing a[0] changes b[1]. The compiler must re-read b[i] from memory after every write.

With restrict, the compiler knows a and b don't overlap, enabling SIMD vectorization and register optimization.

Standard library usage: memcpy uses restrict (no overlap allowed), while memmove does not (handles overlap):

void *memcpy(void * restrict dst, const void * restrict src, size_t n);
void *memmove(void *dst, const void *src, size_t n);

Important: restrict is a contract. If you lie (pass overlapping pointers), the behavior is undefined. The compiler trusts you and optimizes accordingly.

Pseudo Code

Without restrict:
  compiler must assume *a and *b may alias
  every write to a[i] may change b[j]
  cannot vectorize or reorder

With restrict:
  compiler knows a and b don't overlap
  can keep b[i] in registers
  can vectorize the loop (SIMD)
  typically 2-4x faster for tight loops

Code

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <time.h>

/* Without restrict: compiler assumes a and b might alias */
void add_no_restrict(int *a, const int *b, int n) {
    for (int i = 0; i < n; i++)
        a[i] += b[i]; /* must re-read b[i] after writing a[i] */
}

/* With restrict: compiler knows a and b don't overlap */
void add_restrict(int * restrict a, const int * restrict b, int n) {
    for (int i = 0; i < n; i++)
        a[i] += b[i]; /* can vectorize: SIMD, register caching */
}

/* memcpy vs memmove */
void copy_examples(void) {
    char buf[20] = "Hello, World!";

    /* memcpy: restrict -- undefined if src and dst overlap */
    char dst[20];
    memcpy(dst, buf, 14); /* OK: no overlap */
    printf("memcpy: %s\n", dst);

    /* memmove: handles overlapping regions */
    memmove(buf + 3, buf, 10); /* OK: overlap handled */
    printf("memmove: %s\n", buf);
}

/* Real-world: restrict on function parameters */
void matrix_multiply(float * restrict C,
                     const float * restrict A,
                     const float * restrict B,
                     int n) {
    for (int i = 0; i < n; i++)
        for (int j = 0; j < n; j++) {
            float sum = 0.0f;
            for (int k = 0; k < n; k++)
                sum += A[i * n + k] * B[k * n + j];
            C[i * n + j] = sum;
        }
    /* restrict lets compiler vectorize the inner loop */
}

int main(void) {
    const int N = 1000000;
    int *a = malloc(N * sizeof(int));
    int *b = malloc(N * sizeof(int));
    for (int i = 0; i < N; i++) { a[i] = i; b[i] = i; }

    clock_t start;

    start = clock();
    add_no_restrict(a, b, N);
    printf("No restrict: %.3f ms\n",
           1000.0 * (clock() - start) / CLOCKS_PER_SEC);

    start = clock();
    add_restrict(a, b, N);
    printf("With restrict: %.3f ms\n",
           1000.0 * (clock() - start) / CLOCKS_PER_SEC);

    copy_examples();

    free(a);
    free(b);
    return 0;
}

No restrict: <X> ms
With restrict: <Y> ms
memcpy: Hello, World!
memmove: HelHello, Wor
(Times vary; restrict version may be faster with -O2)

Key Points

•restrict promises the pointer is the only way to access that memory -- no aliasing
•Enables compiler optimizations: vectorization, register caching, store reordering
•memcpy uses restrict (no overlap); memmove does not (handles overlap)
•Violating the restrict contract causes undefined behavior
•Most effective on tight loops processing arrays -- can give 2-4x speedup

Gotchas

•If you pass overlapping pointers to a restrict function, behavior is UNDEFINED -- the compiler will generate wrong code silently
•restrict is C99 only -- C++ does not have it (though compilers offer __restrict as an extension)
•restrict only applies to pointer parameters -- it has no effect on global variables
•The compiler is not required to optimize based on restrict -- it is a hint, not a guarantee

restrict tells the compiler a pointer does not alias any other pointer, enabling vectorization and register optimization. memcpy uses it (no overlap); memmove does not. Violating the promise is UB.

•restrict = no aliasing promise, enables optimization
•memcpy requires no overlap; memmove handles overlap

/* restrict: a and b don't overlap */
void add(int * restrict a, const int * restrict b, int n) {
    for (int i = 0; i < n; i++)
        a[i] += b[i]; /* compiler can vectorize */
}

/* memcpy: restrict (no overlap allowed) */
memcpy(dst, src, n);
/* memmove: no restrict (overlap OK) */
memmove(dst, src, n);

Passing overlapping pointers to restrict parameters is undefined behavior

Question 5 / 8

What is undefined behavior in C and what are the most common examples and consequences?

Undefined Behavior (UB) means the C standard imposes no requirements on what happens. The compiler may do anything: crash, silently produce wrong results, optimize away seemingly necessary code, or even appear to work correctly.

Why UB exists: It gives compiler writers freedom to optimize. If signed overflow is UB, the compiler can assume x + 1 > x is always true and optimize based on that.

Most common UB in interviews:

Signed integer overflow: INT_MAX + 1 is UB (unsigned overflow wraps and is well-defined).
Null pointer dereference: *NULL is UB. The compiler may optimize away null checks that follow a dereference.
Uninitialized variable read: Reading an uninitialized local variable is UB. The value is not merely "garbage" -- the compiler may assume it never happens.
Buffer overflow: Accessing past array bounds.
Use-after-free / double-free: Accessing freed memory or freeing twice.
Strict aliasing violation: Accessing an object through a pointer of an incompatible type (except char *).
Signed integer shift: Shifting a negative value left, or shifting by >= bit width.
Division by zero: x / 0 is UB for integers.
Modifying a string literal: char *s = "hello"; s[0] = 'H'; is UB.
Missing return value: A non-void function that reaches the end without returning.

Why UB is dangerous: Modern compilers use UB for aggressive optimization. If UB occurs on one code path, the compiler may eliminate that entire path, including safety checks. This creates security vulnerabilities.

Pseudo Code

Common UB examples:
1. INT_MAX + 1          -- signed overflow
2. *((int *)NULL)       -- null dereference
3. int x; if (x > 0)   -- uninitialized read
4. arr[10] (size 5)     -- buffer overflow
5. free(p); *p          -- use-after-free
6. *(int *)float_ptr    -- strict aliasing
7. x << 32 (32-bit int) -- shift by >= width
8. x / 0               -- division by zero

Compiler may: crash, silently compute wrong result,
optimize away the check, or appear to work

Code

#include <stdio.h>
#include <limits.h>
#include <stdlib.h>
#include <stdint.h>

/* 1. Signed overflow: UNDEFINED BEHAVIOR */
void signed_overflow_ub(void) {
    int x = INT_MAX;
    /* int y = x + 1; */  /* UB! Compiler may assume this never happens */
    /* Result: compiler can optimize assuming x+1 > x is always true */

    /* SAFE: use unsigned or check before adding */
    if (x < INT_MAX) {
        int y = x + 1; /* safe */
        printf("y = %d\n", y);
    }

    /* Unsigned wraps (well-defined) */
    unsigned int u = UINT_MAX;
    unsigned int w = u + 1; /* wraps to 0 -- defined behavior */
    printf("UINT_MAX + 1 = %u\n", w); /* 0 */
}

/* 2. Null pointer dereference: UB */
void null_deref_ub(void) {
    int *p = NULL;
    /* int x = *p; */  /* UB! */
    /* The compiler may optimize away subsequent NULL checks:
       if (p != NULL) { ... }  -- compiler thinks 'p was already
       dereferenced, so it must not be NULL' */
}

/* 3. Strict aliasing violation: UB */
void aliasing_ub(void) {
    float f = 3.14f;
    /* UB: accessing float memory as int (type punning via cast) */
    /* int i = *(int *)&f; */

    /* SAFE: use memcpy for type punning */
    uint32_t bits;
    __builtin_memcpy(&bits, &f, sizeof(bits));
    printf("Float bits: 0x%08X\n", bits);
}

/* 4. Shift by >= bit width: UB */
void shift_ub(void) {
    int x = 1;
    /* int y = x << 32; */  /* UB on 32-bit int! */
    /* int z = x << -1; */  /* UB: negative shift */
    /* SAFE: */
    int shift = 31;
    if (shift >= 0 && shift < (int)(sizeof(int) * 8)) {
        int y = x << shift; /* safe */
        printf("1 << %d = %d\n", shift, y);
    }
}

/* 5. Modifying string literal: UB */
void string_literal_ub(void) {
    /* char *s = "hello"; */
    /* s[0] = 'H'; */  /* UB: string literals are in read-only memory */

    /* SAFE: use array */
    char s[] = "hello"; /* copies to stack -- modifiable */
    s[0] = 'H';
    printf("%s\n", s); /* Hello */
}

int main(void) {
    signed_overflow_ub();
    null_deref_ub();
    aliasing_ub();
    shift_ub();
    string_literal_ub();
    return 0;
}

UINT_MAX + 1 = 0
Float bits: 0x4048F5C3
1 << 31 = -2147483648
Hello
(Float bits value is IEEE 754 representation of 3.14f;
 shift result is implementation-defined for signed)

Key Points

•UB means the standard imposes no requirements -- anything can happen
•Signed overflow, null dereference, uninitialized reads are the most common UB
•Compilers exploit UB for optimization -- they can remove 'dead' code paths that involve UB
•Unsigned arithmetic wraps and is well-defined; signed overflow is UB
•Use memcpy for type punning instead of pointer casts (strict aliasing)

Gotchas

•Code with UB may 'work' for years on one compiler/platform and suddenly break on an upgrade
•The compiler can use UB to eliminate NULL checks: if you dereference p before checking p!=NULL, the check is removed
•-fsanitize=undefined (UBSan) detects many forms of UB at runtime -- use it in testing
•int x = x; is legal C syntax but reading x on the right side is UB (uninitialized)

UB = standard says anything can happen. Common examples: signed overflow, null deref, uninitialized read, buffer overflow, strict aliasing violation, shift by >= bit width. Compilers exploit UB for optimization. Use -fsanitize=undefined to detect.

•Signed overflow, null deref, uninitialized reads are UB
•Unsigned wraps (defined); use -fsanitize=undefined to detect UB

int x = INT_MAX + 1;    /* UB: signed overflow */
*((int *)NULL);         /* UB: null dereference */
int y; if (y > 0) {}    /* UB: uninitialized read */
arr[10]; /* sizeof(arr)==5*sizeof(int) */ /* UB: out of bounds */
1 << 32; /* on 32-bit int */  /* UB: shift >= width */

/* SAFE: unsigned wraps (well-defined) */
unsigned u = UINT_MAX + 1; /* wraps to 0 -- OK */

UB code may appear to work but breaks silently on compiler upgrades or optimization levels

Question 6 / 8

What is the difference between undefined, implementation-defined, and unspecified behavior?

The C standard defines three categories of non-portable behavior:

1. Undefined Behavior (UB): No requirements. The program is erroneous. The compiler can do literally anything (crash, wrong results, time travel optimizations).

Examples: signed overflow, null dereference, buffer overflow, use-after-free.
Key property: The compiler can assume UB never happens and optimize accordingly.

2. Implementation-defined behavior: The behavior depends on the platform/compiler, but the compiler MUST document its choice. Portable code should not rely on it, but it is safe to use if you know your platform.

Examples:
- Size of int (16, 32, or 64 bits).
- Right-shift of negative integers (arithmetic or logical shift).
- Signedness of plain char (signed or unsigned).
- Byte order (endianness).
- Behavior of system() function.

3. Unspecified behavior: The standard gives a set of valid choices, and the compiler can pick any one, but does NOT need to document it or be consistent. The program is still well-formed.

Examples:
- Order of evaluation of function arguments: f(a(), b()) -- which is called first?
- Order of evaluation of operands: x = a() + b() -- which is called first?
- Whether identical string literals share storage.
- Layout of struct padding (within alignment constraints).

In practice: UB must be avoided always. Implementation-defined behavior is acceptable when writing platform-specific code. Unspecified behavior should not be relied upon for correctness.

Pseudo Code

Undefined: Compiler can do anything. MUST avoid.
  signed overflow, null deref, double free

Implementation-defined: Compiler chooses and documents.
  sizeof(int), signedness of char, right-shift of negatives

Unspecified: Compiler chooses, does NOT document.
  Evaluation order of f(a(), b()), struct padding

Code

#include <stdio.h>
#include <limits.h>

/* --- Undefined Behavior (MUST AVOID) --- */
void ub_examples(void) {
    /* Signed overflow: UB */
    /* int x = INT_MAX + 1; */

    /* Null dereference: UB */
    /* int *p = NULL; int y = *p; */
}

/* --- Implementation-Defined (platform-specific but documented) --- */
void impl_defined_examples(void) {
    /* Size of int: implementation-defined */
    printf("sizeof(int) = %zu\n", sizeof(int)); /* 4 on most modern systems */

    /* Signedness of char: implementation-defined */
    char c = -1;
    printf("char is %s\n",
           (c < 0) ? "signed" : "unsigned");

    /* Right shift of negative: implementation-defined */
    int neg = -8;
    int shifted = neg >> 1;
    printf("-8 >> 1 = %d\n", shifted);
    /* Most compilers: arithmetic shift -> -4 */
    /* But COULD be logical shift -> large positive number */

    /* Bit representation of negative numbers */
    /* (almost always two's complement, but implementation-defined until C23) */
}

/* --- Unspecified Behavior (valid but unpredictable) --- */
int counter = 0;
int increment(void) { return ++counter; }

void unspecified_examples(void) {
    /* Order of argument evaluation: unspecified */
    counter = 0;
    printf("first=%d, second=%d\n", increment(), increment());
    /* Could print: first=1, second=2 OR first=2, second=1 */
    /* Both are valid! */

    /* Order of operand evaluation: unspecified */
    int a = 0;
    /* int b = a++ + a++; */  /* Actually UB (modifying a twice between
                                  sequence points), not just unspecified */

    /* String literal sharing: unspecified */
    const char *s1 = "hello";
    const char *s2 = "hello";
    printf("Same string literal address: %s\n",
           (s1 == s2) ? "yes" : "no");
    /* Compiler may or may not merge them */
}

int main(void) {
    impl_defined_examples();
    unspecified_examples();
    return 0;
}

sizeof(int) = 4
char is signed
-8 >> 1 = -4
first=1, second=2
Same string literal address: yes
(char signedness, right-shift behavior, evaluation order,
 and string literal merging are platform-dependent)

Key Points

•Undefined: no requirements, compiler assumes it never happens
•Implementation-defined: compiler chooses AND documents (sizeof(int), signedness of char)
•Unspecified: compiler chooses but need not document or be consistent (evaluation order)
•UB must be avoided; implementation-defined is OK for platform-specific code
•C23 mandates two's complement, removing some implementation-defined behavior

Gotchas

•i++ + i++ is UNDEFINED, not merely unspecified -- it modifies i twice without a sequence point
•Right-shifting a negative number is implementation-defined, not UB -- but it is non-portable
•Compilers document implementation-defined choices in their manuals (e.g., GCC: gcc.gnu.org/onlinedocs)
•The order of evaluation of function arguments (f(a(), b())) is unspecified -- do not depend on it

Undefined: anything can happen (signed overflow, null deref) -- must avoid. Implementation-defined: compiler documents its choice (sizeof(int), signedness of char). Unspecified: compiler picks from valid options, no docs required (evaluation order of function args).

•UB: no rules. Impl-defined: documented choice. Unspecified: valid but undocumented.
•Avoid UB; know your platform for impl-defined; don't depend on unspecified

/* Undefined: AVOID */
/* INT_MAX + 1; */

/* Implementation-defined: platform-specific */
printf("%zu\n", sizeof(int));  /* 4 or 2 -- documented */
int x = -8 >> 1;  /* arithmetic or logical -- documented */

/* Unspecified: valid but unpredictable */
printf("%d %d\n", f(), g()); /* which runs first? unspecified */

i++ + i++ is undefined behavior, not unspecified -- never do this

Question 7 / 8

What are the key CERT C secure coding guidelines and common rules?

CERT C Secure Coding Standard is a set of rules and recommendations published by Carnegie Mellon's Software Engineering Institute (SEI). It targets eliminating security vulnerabilities in C code.

Most important rules (commonly asked in interviews):

INT30-C: Ensure unsigned integer operations do not wrap. INT32-C: Ensure signed integer operations do not result in overflow.

STR31-C: Guarantee that storage for strings has sufficient space for the data and the null terminator.

MEM30-C: Do not access freed memory. MEM35-C: Allocate sufficient memory for an object. MEM33-C: Allocate and copy structures containing flexible array members dynamically.

ARR30-C: Do not form or use out-of-bounds pointers or array subscripts. ARR38-C: Guarantee that library functions do not form invalid pointers.

EXP30-C: Do not depend on the order of evaluation for side effects. EXP33-C: Do not read uninitialized memory.

FIO30-C: Exclude user input from format strings (prevents format string attacks).

ERR33-C: Detect and handle standard library errors (check return values).

ENV33-C: Do not call system() with user-controlled input.

MSC30-C: Do not use the rand() function for generating pseudorandom numbers (use OS-provided CSPRNG instead).

General principles:

Validate all input.
Check all return values.
Use safe functions (snprintf, not sprintf; fgets, not gets).
Initialize all variables.
Use static analysis tools (Coverity, cppcheck, clang-tidy).

Pseudo Code

Key rules by category:

Integers: Check for overflow before arithmetic
Strings: Always ensure space for null terminator
Memory: Never use freed memory; always check malloc return
Arrays: Never access out of bounds
Expressions: Don't rely on evaluation order
I/O: Never put user input in format strings
Errors: Always check return values
Random: Use OS CSPRNG, not rand()

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include <stdint.h>

/* INT32-C: Prevent signed integer overflow */
int safe_add(int a, int b) {
    if ((b > 0 && a > INT_MAX - b) ||
        (b < 0 && a < INT_MIN - b)) {
        fprintf(stderr, "Integer overflow detected!\n");
        return 0; /* or abort */
    }
    return a + b;
}

/* STR31-C: Ensure string buffer has space */
void safe_string_copy(char *dst, size_t dst_size, const char *src) {
    if (dst_size == 0) return;
    /* snprintf guarantees null termination and no overflow */
    snprintf(dst, dst_size, "%s", src);
}

/* MEM30-C: Do not access freed memory */
void safe_memory(void) {
    int *p = malloc(10 * sizeof(int));
    if (p == NULL) { /* ERR33-C: check return value */
        fprintf(stderr, "malloc failed\n");
        return;
    }
    p[0] = 42;
    free(p);
    p = NULL; /* prevent use-after-free */
}

/* FIO30-C: Never use user input as format string */
void safe_print(const char *user_input) {
    /* BAD: printf(user_input);  -- format string attack! */
    /* GOOD: */
    printf("%s", user_input);
}

/* ARR30-C: Bounds checking */
int safe_array_access(const int *arr, size_t arr_len, size_t index) {
    if (index >= arr_len) {
        fprintf(stderr, "Array index %zu out of bounds\n", index);
        return -1;
    }
    return arr[index];
}

/* EXP33-C: Initialize all variables */
void safe_init(void) {
    int x = 0; /* always initialize */
    int *p = NULL;
    char buf[256] = {0};
    (void)x; (void)p; (void)buf;
}

int main(void) {
    printf("safe_add(INT_MAX, 1): ");
    safe_add(INT_MAX, 1); /* detects overflow */

    char buf[10];
    safe_string_copy(buf, sizeof(buf), "Hello, World!");
    printf("Truncated: %s\n", buf); /* Hello, Wo */

    safe_memory();

    int arr[] = {10, 20, 30};
    printf("arr[1] = %d\n", safe_array_access(arr, 3, 1));
    safe_array_access(arr, 3, 5); /* error message */

    safe_print("user input is %s safe\n");

    return 0;
}

safe_add(INT_MAX, 1): Integer overflow detected!
Truncated: Hello, Wo
arr[1] = 20
Array index 5 out of bounds
user input is %s safe
(printf with %s format safely prints the literal string)

Key Points

•INT32-C: Check for signed overflow before performing arithmetic
•STR31-C: Always ensure buffer has space for string + null terminator
•MEM30-C: Never access freed memory; set pointers to NULL after free
•FIO30-C: Never use user input as a printf format string
•ERR33-C: Always check return values from library functions (malloc, fopen, etc.)

Gotchas

•printf(user_input) is a critical vulnerability -- attacker can read/write arbitrary memory with %n
•Checking for overflow AFTER the operation is too late -- signed overflow is UB, the check may be optimized away
•rand() is not cryptographically secure -- use /dev/urandom or getrandom() for security-sensitive random numbers
•Static analysis tools (cppcheck, Coverity, clang-tidy) can automatically check many CERT C rules

CERT C rules: check for integer overflow before arithmetic (INT32-C), ensure string buffer space (STR31-C), never access freed memory (MEM30-C), never use user input as format string (FIO30-C), always check return values (ERR33-C).

•Check overflow before arithmetic; use snprintf; check all returns
•Never pass user input as printf format string

/* INT32-C: check before overflow */
if (a > INT_MAX - b) { /* overflow! */ }

/* STR31-C: safe copy */
snprintf(dst, sizeof(dst), "%s", src);

/* FIO30-C: NEVER do printf(user_input) */
printf("%s", user_input); /* safe */

/* ERR33-C: check returns */
int *p = malloc(100);
if (p == NULL) { /* handle error */ }

printf(user_input) lets attackers read/write memory via %n format specifier

Question 8 / 8

How do you write portable C code that avoids platform-specific assumptions?

Writing portable C means your code compiles and runs correctly on different compilers, CPUs, and operating systems. Key areas to address:

1. Integer sizes: Never assume int is 32 bits. Use <stdint.h> types: int32_t, uint16_t, size_t.

2. Endianness: Never assume little-endian. Serialize multi-byte values by extracting bytes with shifts, not pointer casts.

3. Alignment: Never cast char * to int * and dereference -- the alignment may be wrong. Use memcpy for safe type punning.

4. Struct padding: Don't assume struct layout matches wire format. Use packed structs or serialize field-by-field.

5. Signedness of char: char may be signed or unsigned. Use unsigned char for byte manipulation.

6. Pointer size: Don't assume sizeof(void *) == sizeof(int). Use uintptr_t for pointer-to-integer conversions.

7. Path separators: / vs \ on Windows. Use preprocessor checks or libraries.

8. Standard headers: Stick to standard C headers (<stdio.h>, <stdlib.h>, <string.h>). Avoid POSIX or platform-specific headers unless behind #ifdef.

9. Format specifiers: Use %zu for size_t, %" PRId32 " for int32_t (from <inttypes.h>).

10. Bit fields: Bit field layout (order, signedness) is implementation-defined. Don't use them in portable code.

Pseudo Code

Portability checklist:
1. Use stdint.h types (int32_t, not int)
2. Serialize with byte shifts, not pointer casts
3. Use memcpy for type punning, not casts
4. Use sizeof, not hardcoded sizes
5. unsigned char for byte data
6. size_t for sizes and indices
7. PRId32/PRIu64 for format specifiers
8. #ifdef for platform-specific code
9. No bit fields in portable structs
10. No assumptions about struct padding

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <inttypes.h>
#include <limits.h>

/* Rule 1: Use fixed-width integers */
void portable_integers(void) {
    int32_t x = 42;       /* exactly 32 bits */
    uint64_t big = 1ULL << 40;
    size_t len = 100;     /* correct type for sizes */

    /* Rule 9: Correct format specifiers */
    printf("x = %" PRId32 "\n", x);
    printf("big = %" PRIu64 "\n", big);
    printf("len = %zu\n", len);
}

/* Rule 2: Portable serialization (endianness-safe) */
void write_uint32_be(uint8_t *buf, uint32_t val) {
    buf[0] = (val >> 24) & 0xFF;
    buf[1] = (val >> 16) & 0xFF;
    buf[2] = (val >> 8)  & 0xFF;
    buf[3] = val & 0xFF;
}

uint32_t read_uint32_be(const uint8_t *buf) {
    return ((uint32_t)buf[0] << 24) |
           ((uint32_t)buf[1] << 16) |
           ((uint32_t)buf[2] << 8)  |
           (uint32_t)buf[3];
}

/* Rule 3: Safe type punning with memcpy */
uint32_t float_to_bits(float f) {
    uint32_t bits;
    memcpy(&bits, &f, sizeof(bits)); /* safe, portable */
    return bits;
    /* BAD: return *(uint32_t *)&f; -- aliasing violation, alignment */
}

/* Rule 5: Use unsigned char for bytes */
void process_bytes(const unsigned char *data, size_t len) {
    for (size_t i = 0; i < len; i++) {
        /* unsigned char: 0-255, no sign issues */
        printf("%02X ", data[i]);
    }
    printf("\n");
}

/* Rule 8: Platform-specific code behind #ifdef */
void platform_sleep(unsigned int ms) {
#ifdef _WIN32
    /* Sleep(ms); */  /* Windows */
#elif defined(__unix__) || defined(__APPLE__)
    /* usleep(ms * 1000); */ /* POSIX */
#else
    /* Busy wait or error */
    (void)ms;
#endif
}

/* Rule 4: Don't assume struct layout for serialization */
struct message {
    uint8_t  type;
    uint32_t length;
    uint16_t flags;
};

size_t serialize_message(uint8_t *buf, const struct message *msg) {
    size_t offset = 0;
    buf[offset++] = msg->type;
    write_uint32_be(buf + offset, msg->length); offset += 4;
    buf[offset++] = (msg->flags >> 8) & 0xFF;
    buf[offset++] = msg->flags & 0xFF;
    return offset; /* total bytes written */
    /* Do NOT: memcpy(buf, msg, sizeof(*msg)) -- padding/endianness! */
}

int main(void) {
    portable_integers();

    /* Endianness-safe serialization */
    uint8_t buf[4];
    write_uint32_be(buf, 0x12345678);
    uint32_t val = read_uint32_be(buf);
    printf("Round-trip: 0x%08" PRIX32 "\n", val); /* 0x12345678 */

    /* Safe type punning */
    float f = 3.14f;
    printf("Float bits: 0x%08" PRIX32 "\n", float_to_bits(f));

    /* Byte processing */
    unsigned char data[] = {0xDE, 0xAD, 0xBE, 0xEF};
    process_bytes(data, sizeof(data));

    return 0;
}

x = 42
big = 1099511627776
len = 100
Round-trip: 0x12345678
Float bits: 0x4048F5C3
DE AD BE EF

Key Points

•Use stdint.h (int32_t, uint64_t) instead of int/long for fixed sizes
•Serialize with byte shifts for endianness safety -- never cast pointers
•Use memcpy for type punning -- pointer casts violate strict aliasing
•Use unsigned char for byte data -- plain char signedness is platform-dependent
•Use PRId32/PRIu64 format macros from inttypes.h for portable printf

Gotchas

•sizeof(int) varies: 2 bytes on some embedded, 4 on most 32/64-bit, historically even 8
•memcpy(buf, &struct, sizeof(struct)) is NOT portable for serialization -- padding and endianness differ
•Bit fields have implementation-defined ordering and signedness -- avoid for cross-platform data
•CHAR_BIT is not always 8 -- some DSPs use 16-bit or 32-bit chars (though rare)

Use stdint.h types, serialize with shifts not casts, memcpy for type punning, unsigned char for bytes, PRId32/PRIu64 for format specifiers, #ifdef for platform code. Never assume int size, endianness, or struct layout.

•stdint.h for fixed sizes; memcpy for type punning; shifts for serialization
•Never assume sizeof(int), endianness, or struct padding

#include <stdint.h>
#include <inttypes.h>
#include <string.h>

int32_t x = 42;                           /* not int */
printf("%" PRId32 "\n", x);               /* portable format */

uint32_t bits;
memcpy(&bits, &float_val, sizeof(bits));  /* safe type pun */

uint8_t buf[4];
buf[0] = (val >> 24) & 0xFF;              /* portable serialize */

sizeof(int) varies by platform -- always use explicit fixed-width types

Built by onllm.dev

Home GitHub Support awesomePrep