← Pointers Fundamentals

Select a question from the sidebar

15 questions in this topic

Question 1 / 15

What is a pointer and how do you declare and initialize one?

A pointer is a variable that stores the memory address of another variable.

Declaration: type *ptr; declares a pointer to a value of type.

Initialization: Use the address-of operator & to get the address of a variable: int *p = &x;.

Key concepts:

*ptr (dereference): access the value at the address stored in ptr.
&var (address-of): get the address of a variable.
An uninitialized pointer contains a garbage address -- using it is UB.
Always initialize pointers: to a valid address or to NULL.

Pseudo Code

int x = 42;
int *p = &x;     // p stores the address of x
*p = 100;        // changes x to 100 (dereference + assign)
printf("%d", x); // prints 100

&x -> address of x
*p -> value at address stored in p
p  -> the address itself

Code

#include <stdio.h>

int main(void) {
    int x = 42;
    int *p = &x;  /* p points to x */

    printf("x     = %d\n", x);      /* 42 */
    printf("&x    = %p\n", (void *)&x);  /* address of x */
    printf("p     = %p\n", (void *)p);   /* same address */
    printf("*p    = %d\n", *p);     /* 42 (value at p) */

    /* Modify x through pointer */
    *p = 100;
    printf("x after *p=100: %d\n", x); /* 100 */

    /* Pointer to different types */
    double d = 3.14;
    double *dp = &d;
    printf("*dp = %f\n", *dp); /* 3.14 */

    /* Initialize to NULL if no target yet */
    int *safe = NULL;
    if (safe != NULL) {
        printf("%d\n", *safe);
    } else {
        printf("safe is NULL\n");
    }

    return 0;
}

x     = 42
&x    = 0x7ffd5e8e3abc
p     = 0x7ffd5e8e3abc
*p    = 42
x after *p=100: 100
*dp = 3.140000
safe is NULL
(addresses are platform-dependent)

Key Points

•A pointer stores an address; * dereferences it to access the value
•& gets the address of a variable
•Always initialize pointers to a valid address or NULL
•The type of the pointer determines how *p interprets the memory
•Pointer to int can only safely point to int (strict aliasing rule)

Gotchas

•int *p, q; declares p as pointer and q as int, NOT two pointers
•Dereferencing an uninitialized or NULL pointer is undefined behavior
•Pointer type must match the pointed-to type (int* for int, double* for double)
•* in declaration means 'pointer to'; * in expression means 'dereference'

A pointer stores a memory address. int *p = &x makes p point to x. *p dereferences (accesses the value). &x gets the address. Always initialize pointers to a valid address or NULL.

•* = dereference; & = address-of
•Always initialize pointers

#include <stdio.h>
int main(void) {
    int x = 42;
    int *p = &x;
    printf("*p = %d\n", *p); /* 42 */
    *p = 100;
    printf("x  = %d\n", x);  /* 100 */
    return 0;
}

*p = 42
x  = 100

int *p, q; -- only p is a pointer, q is int

Question 2 / 15

What is the NULL pointer and how should you use it?

NULL is a macro that represents a null pointer constant -- a pointer that points to no valid memory. It is defined in <stddef.h>, <stdlib.h>, <stdio.h>, and other headers.

Key facts:

NULL is typically defined as ((void *)0) or just 0.
Dereferencing NULL is undefined behavior (usually causes a segfault).
NULL is used to indicate "no valid object" (e.g., malloc failure, end of linked list).
C11 introduced nullptr macro (not keyword) in some headers, but NULL is standard.

Best practices:

Always check for NULL before dereferencing: if (p != NULL) { *p = 10; }
Set freed pointers to NULL: free(p); p = NULL;
Functions that return pointers use NULL to indicate failure (e.g., malloc, fopen).

Pseudo Code

NULL = pointer to nothing (address 0)

1. Check before dereference: if (p != NULL) *p = val;
2. After free: p = NULL;
3. Function failure: return NULL;
4. Dereferencing NULL = undefined behavior (crash)

Code

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    /* Initialize to NULL */
    int *p = NULL;

    /* Check before use */
    if (p == NULL) {
        printf("p is NULL\n");
    }

    /* malloc returns NULL on failure */
    p = malloc(sizeof(int));
    if (p == NULL) {
        fprintf(stderr, "malloc failed\n");
        return 1;
    }
    *p = 42;
    printf("*p = %d\n", *p);

    /* Set to NULL after free */
    free(p);
    p = NULL;

    /* Double free is safe if pointer is NULL */
    free(p); /* free(NULL) is a no-op */

    /* fopen returns NULL on failure */
    FILE *fp = fopen("nonexistent.txt", "r");
    if (fp == NULL) {
        printf("File not found\n");
    }

    /* Idiomatic NULL check */
    int *q = NULL;
    if (!q) { /* same as q == NULL */
        printf("q is NULL\n");
    }

    return 0;
}

p is NULL
*p = 42
File not found
q is NULL

Key Points

•NULL means the pointer points to no valid object
•Always check for NULL before dereferencing
•malloc/fopen/etc. return NULL on failure
•Set freed pointers to NULL to prevent dangling pointer bugs
•free(NULL) is safe (a no-op)

Gotchas

•Dereferencing NULL is undefined behavior, not a guaranteed crash
•NULL is not guaranteed to be all-zero bits on all platforms (but almost always is)
•In variadic functions, pass (void *)NULL, not just NULL, for portability
•if (p) and if (p != NULL) are equivalent; both are idiomatic

NULL = pointer to nothing. Dereference = UB. Check before use: if (p != NULL). Set to NULL after free. free(NULL) is safe. malloc/fopen return NULL on failure.

•Always check for NULL before dereferencing
•Set freed pointers to NULL

#include <stdio.h>
#include <stdlib.h>
int main(void) {
    int *p = malloc(sizeof(int));
    if (!p) { return 1; } /* NULL check */
    *p = 42;
    printf("%d\n", *p);
    free(p);
    p = NULL; /* prevent dangling pointer */
    return 0;
}

Dereferencing NULL is UB, not a guaranteed crash

Question 3 / 15

How does pointer arithmetic work?

Pointer arithmetic operates in units of the pointed-to type's size, not bytes.

Operations:

p + n advances p by n * sizeof(*p) bytes.
p - n moves p back by n * sizeof(*p) bytes.
p++ / p-- move to the next/previous element.
p2 - p1 gives the number of ELEMENTS between two pointers (not bytes).

Rules:

You can only do arithmetic with pointers to elements of the same array (or one past the end).
Pointer arithmetic on void* is NOT allowed in standard C.
Subtraction only works between pointers to the same array.
The result of pointer subtraction has type ptrdiff_t (from <stddef.h>).

Pseudo Code

int arr[5] = {10, 20, 30, 40, 50};
int *p = arr;  // p points to arr[0]

p + 1  -> points to arr[1] (advanced by sizeof(int) bytes)
p + 3  -> points to arr[3]
p++    -> p now points to arr[1]
p2 - p1 -> number of elements between them

All arithmetic is in units of sizeof(*p), not bytes

Code

#include <stdio.h>
#include <stddef.h>

int main(void) {
    int arr[] = {10, 20, 30, 40, 50};
    int *p = arr;  /* p points to arr[0] */

    /* p + n advances by n elements */
    printf("*(p+0) = %d\n", *(p + 0)); /* 10 */
    printf("*(p+2) = %d\n", *(p + 2)); /* 30 */
    printf("*(p+4) = %d\n", *(p + 4)); /* 50 */

    /* Increment */
    p++;  /* now points to arr[1] */
    printf("After p++: *p = %d\n", *p); /* 20 */

    /* Pointer difference = element count */
    int *start = &arr[0];
    int *end = &arr[4];
    ptrdiff_t diff = end - start;
    printf("Elements between: %td\n", diff); /* 4 */

    /* Byte difference */
    printf("Byte difference: %td\n",
           (char *)end - (char *)start); /* 16 (4 * sizeof(int)) */

    /* Traversing array with pointer */
    printf("Array: ");
    for (int *q = arr; q < arr + 5; q++) {
        printf("%d ", *q);
    }
    printf("\n"); /* 10 20 30 40 50 */

    return 0;
}

*(p+0) = 10
*(p+2) = 30
*(p+4) = 50
After p++: *p = 20
Elements between: 4
Byte difference: 16
Array: 10 20 30 40 50

Key Points

•p + n moves by n * sizeof(*p) bytes, not n bytes
•p++ moves to the next element (not the next byte)
•p2 - p1 gives element count, not byte count
•Only valid within the same array (or one past the end)
•Result of pointer subtraction is ptrdiff_t

Gotchas

•p + 1 on an int* advances by 4 bytes (sizeof(int)), not 1 byte
•Pointer arithmetic past one-past-the-end or before the array is UB
•Subtracting pointers to different arrays is undefined behavior
•Pointer arithmetic on void* is a GCC extension, not standard C

Pointer arithmetic works in units of the element size. p+1 advances by sizeof(*p) bytes. p2-p1 gives element count. Only valid within the same array.

•Arithmetic in units of element size
•Subtraction gives element count, not bytes

#include <stdio.h>
int main(void) {
    int arr[] = {10, 20, 30, 40};
    int *p = arr;
    printf("%d %d %d\n", *p, *(p+1), *(p+3)); /* 10 20 40 */
    printf("diff = %td\n", &arr[3] - &arr[0]); /* 3 */
    return 0;
}

10 20 40
diff = 3

p+1 on int* advances by sizeof(int) bytes, not 1

Question 4 / 15

What is the relationship between arrays and pointers?

Arrays and pointers are closely related but NOT the same thing.

Array-pointer equivalence in expressions:

arr[i] is defined as *(arr + i) by the C standard.
This means arr[i] and i[arr] are equivalent (both are *(arr + i)).
An array name decays to a pointer to its first element in most contexts.

Key differences:

An array is a block of memory. A pointer is a variable that holds an address.
sizeof(arr) gives the total array size; sizeof(ptr) gives the pointer size.
&arr gives a pointer to the whole array; &ptr gives the address of the pointer variable.
An array name cannot be reassigned; a pointer can.

Pseudo Code

arr[i] == *(arr + i) == *(i + arr) == i[arr]  (all equivalent)

Array vs Pointer:
  array: fixed memory block, sizeof = total bytes, not assignable
  pointer: variable holding address, sizeof = 4/8, assignable

Array decays to pointer in most contexts except sizeof, &, and string init

Code

#include <stdio.h>

int main(void) {
    int arr[5] = {10, 20, 30, 40, 50};
    int *ptr = arr;  /* arr decays to &arr[0] */

    /* All equivalent ways to access element at index 2 */
    printf("arr[2]     = %d\n", arr[2]);       /* 30 */
    printf("*(arr+2)   = %d\n", *(arr + 2));   /* 30 */
    printf("ptr[2]     = %d\n", ptr[2]);       /* 30 */
    printf("*(ptr+2)   = %d\n", *(ptr + 2));   /* 30 */
    printf("2[arr]     = %d\n", 2[arr]);       /* 30 (legal!) */

    /* Key differences */
    printf("sizeof(arr) = %zu\n", sizeof(arr)); /* 20 (5*4) */
    printf("sizeof(ptr) = %zu\n", sizeof(ptr)); /* 8 (pointer) */

    /* ptr can be reassigned; arr cannot */
    int other[] = {100, 200};
    ptr = other;  /* OK */
    /* arr = other;  // ERROR: array not assignable */

    /* ptr++ is valid; arr++ is not */
    ptr++;
    printf("*ptr = %d\n", *ptr); /* 200 */
    /* arr++;  // ERROR */

    return 0;
}

arr[2]     = 30
*(arr+2)   = 30
ptr[2]     = 30
*(ptr+2)   = 30
2[arr]     = 30
sizeof(arr) = 20
sizeof(ptr) = 8
*ptr = 200
(sizeof(ptr) is platform-dependent: 4 on 32-bit, 8 on 64-bit)

Key Points

•arr[i] is defined as *(arr + i) -- subscript is syntactic sugar
•Array name decays to pointer in most contexts
•sizeof(arr) != sizeof(ptr) -- they are different things
•Arrays cannot be reassigned or incremented; pointers can
•i[arr] is legal and equivalent to arr[i] (curiosity)

Gotchas

•Arrays and pointers are NOT the same: arrays are memory blocks, pointers are address variables
•arr++ is illegal because arr is not a modifiable lvalue
•2[arr] works because arr[2] = *(arr+2) = *(2+arr) = 2[arr]
•After decay, the array loses size information -- always pass size separately

arr[i] is *(arr + i). Array names decay to pointers but are NOT pointers. sizeof(arr) gives total array size; sizeof(ptr) gives pointer size. Arrays cannot be reassigned.

•arr[i] == *(arr + i)
•sizeof differs for arrays vs pointers

#include <stdio.h>
int main(void) {
    int arr[3] = {10, 20, 30};
    int *p = arr;
    printf("%d %d\n", arr[1], *(p+1)); /* 20 20 */
    printf("%zu vs %zu\n", sizeof(arr), sizeof(p)); /* 12 vs 8 */
    return 0;
}

20 20
12 vs 8
(sizeof(p) is platform-dependent: 4 on 32-bit, 8 on 64-bit)

Arrays decay to pointers, but they are fundamentally different

Question 5 / 15

What is a pointer to pointer (double pointer)?

A pointer to pointer (double pointer) stores the address of another pointer. Declared as int **pp.

Why use it:

Modify a pointer in a function: Since C is pass-by-value, to change what a pointer points to, pass a pointer to that pointer.
Dynamic 2D arrays: Array of pointers to dynamically allocated rows.
argv: char **argv in main() is a pointer to an array of char pointers.

Dereferencing:

*pp gives the inner pointer (the address it stores).
**pp gives the final value (dereference twice).

Pseudo Code

int x = 42;
int *p = &x;     // pointer to int
int **pp = &p;   // pointer to pointer to int

**pp == *p == x == 42  (all the same value)
*pp == p == &x         (all the same address)
pp == &p               (address of the pointer p)

Code

#include <stdio.h>
#include <stdlib.h>

/* Modify a pointer through double pointer */
void allocate(int **pp) {
    *pp = malloc(sizeof(int));
    if (*pp) **pp = 99;
}

int main(void) {
    int x = 42;
    int *p = &x;
    int **pp = &p;

    printf("x    = %d\n", x);     /* 42 */
    printf("*p   = %d\n", *p);    /* 42 */
    printf("**pp = %d\n", **pp);  /* 42 */

    /* Modify x through double pointer */
    **pp = 100;
    printf("x after **pp=100: %d\n", x); /* 100 */

    /* Modify pointer through function */
    int *dynamic = NULL;
    allocate(&dynamic);  /* pass address of pointer */
    if (dynamic) {
        printf("*dynamic = %d\n", *dynamic); /* 99 */
        free(dynamic);
    }

    /* char** for array of strings */
    const char *words[] = {"hello", "world"};
    const char **wp = words;
    printf("%s %s\n", wp[0], wp[1]); /* hello world */

    return 0;
}

x    = 42
*p   = 42
**pp = 42
x after **pp=100: 100
*dynamic = 99
hello world

Key Points

•int **pp is a pointer to a pointer to int
•**pp dereferences twice to get the final value
•Used to modify a pointer via function call (pass &ptr)
•argv in main is char** (pointer to array of char pointers)
•Dynamic 2D arrays use arrays of pointers (int **matrix)

Gotchas

•int **pp is NOT the same as a 2D array (int arr[3][4])
•Forgetting the & when passing to a function that expects int** is a type error
•Triple pointers (int ***) are almost always a sign of bad design
•Each level of indirection adds complexity -- keep it to 2 levels max

int **pp = pointer to pointer. **pp = final value. Used to modify pointers in functions and for dynamic 2D arrays. argv is char **.

•Pass &ptr to modify a pointer in a function
•**pp dereferences twice

#include <stdio.h>
#include <stdlib.h>
void alloc(int **pp) { *pp = malloc(sizeof(int)); **pp = 42; }
int main(void) {
    int *p = NULL;
    alloc(&p);
    printf("%d\n", *p); /* 42 */
    free(p);
    return 0;
}

int ** is NOT the same as a 2D array

Question 6 / 15

What are void pointers and how are they used for generic programming?

void * is C's mechanism for type-generic code. It can point to any data type.

Key rules:

Any data pointer can be implicitly converted to void * and back (in C, no cast needed).
Cannot dereference void * directly -- must cast to a typed pointer first.
Cannot do pointer arithmetic on void * (standard C).
sizeof(void) is undefined (GCC defines it as 1 as an extension).

Standard library uses:

malloc returns void *.
qsort and bsearch accept void * for type-generic sorting/searching.
memcpy, memset accept void * for raw memory operations.

Pseudo Code

void *ptr;          // can point to any type
ptr = &int_var;     // implicit conversion to void*
int *ip = ptr;      // implicit conversion from void* (C only)
*(int *)ptr = 42;   // must cast to dereference

Cannot: *ptr, ptr+1 (no type info)
Can: assign to/from any pointer type

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Generic swap function */
void generic_swap(void *a, void *b, size_t size) {
    void *temp = malloc(size);
    if (!temp) return;
    memcpy(temp, a, size);
    memcpy(a, b, size);
    memcpy(b, temp, size);
    free(temp);
}

/* Generic print function */
void print_value(const void *data, char type) {
    switch (type) {
        case 'i': printf("%d", *(const int *)data); break;
        case 'd': printf("%f", *(const double *)data); break;
        case 's': printf("%s", (const char *)data); break;
    }
    printf("\n");
}

int main(void) {
    /* Generic swap works with any type */
    int a = 10, b = 20;
    generic_swap(&a, &b, sizeof(int));
    printf("a=%d b=%d\n", a, b); /* a=20 b=10 */

    double x = 1.5, y = 2.5;
    generic_swap(&x, &y, sizeof(double));
    printf("x=%f y=%f\n", x, y); /* x=2.5 y=1.5 */

    /* Generic print */
    int n = 42;
    double pi = 3.14;
    print_value(&n, 'i');    /* 42 */
    print_value(&pi, 'd');   /* 3.140000 */
    print_value("hello", 's'); /* hello */

    return 0;
}

a=20 b=10
x=2.500000 y=1.500000
42
3.140000
hello

Key Points

•void * can point to any type -- C's way of doing generics
•Must cast to a typed pointer before dereferencing
•malloc returns void * -- no cast needed in C
•memcpy/qsort use void * for type-generic operations
•The programmer is responsible for type correctness

Gotchas

•Casting void * to the wrong type and dereferencing is UB
•Do not cast malloc's return in C -- it can hide missing <stdlib.h>
•Standard C does not allow arithmetic on void * -- use char * for byte offsets
•void * cannot point to functions (function pointers are separate)

void * can point to any type. Must cast to dereference. No pointer arithmetic in standard C. Used by malloc, qsort, memcpy. No cast needed for void * conversions in C.

•void * = generic pointer; cast to dereference
•No cast needed for void * in C

#include <stdio.h>
#include <string.h>
void swap(void *a, void *b, size_t sz) {
    char tmp[64];
    memcpy(tmp, a, sz);
    memcpy(a, b, sz);
    memcpy(b, tmp, sz);
}
int main(void) {
    int a = 1, b = 2;
    swap(&a, &b, sizeof(int));
    printf("%d %d\n", a, b); /* 2 1 */
    return 0;
}

2 1

Wrong cast type = undefined behavior

Question 7 / 15

How do pointer comparisons work?

Equality comparison (==, !=): Can compare any two pointers of compatible type, or any pointer with NULL.

Relational comparison (<, >, <=, >=): Only well-defined between pointers to elements of the same array (or one past the end). Comparing pointers to unrelated objects is undefined behavior.

Why relational comparison is restricted: Pointers may come from different memory segments (stack, heap, static), and the relative ordering between segments is meaningless.

Common uses:

p == NULL -- null check.
p < end -- loop through array with pointers.
p1 == p2 -- check if two pointers point to the same object.

Pseudo Code

Allowed:
  p == NULL, p != NULL         (any pointer vs null)
  p1 == p2, p1 != p2          (compatible pointer types)
  p1 < p2, p1 > p2            (ONLY within same array)

Undefined:
  p1 < p2 when pointing to different objects/arrays

Code

#include <stdio.h>

int main(void) {
    int arr[5] = {10, 20, 30, 40, 50};
    int *start = &arr[0];
    int *end = &arr[5]; /* one past the end -- valid for comparison */
    int *mid = &arr[2];

    /* Equality */
    printf("start == arr? %d\n", start == arr); /* 1 */

    /* Relational: within same array */
    printf("start < end? %d\n", start < end); /* 1 */
    printf("mid < end?   %d\n", mid < end);   /* 1 */

    /* Pointer traversal with comparison */
    for (int *p = start; p < end; p++) {
        printf("%d ", *p);
    }
    printf("\n"); /* 10 20 30 40 50 */

    /* NULL comparison */
    int *null_ptr = NULL;
    if (null_ptr == NULL) {
        printf("Pointer is NULL\n");
    }

    /* Comparing pointers to same object */
    int x = 42;
    int *p1 = &x;
    int *p2 = &x;
    printf("p1 == p2? %d\n", p1 == p2); /* 1 */

    return 0;
}

start == arr? 1
start < end? 1
mid < end?   1
10 20 30 40 50
Pointer is NULL
p1 == p2? 1

Key Points

•== and != work for any compatible pointer types
•< > <= >= only defined within the same array
•One-past-the-end pointer is valid for comparison but not dereference
•Comparing pointers to unrelated objects is UB
•NULL comparison is always valid

Gotchas

•Comparing pointers from different malloc calls with < is UB (even if it seems to work)
•Comparing a function pointer and a data pointer is undefined
•One-past-the-end: &arr[N] is valid for comparison but dereferencing it is UB
•Pointer equality does not imply the values are equal (strict aliasing)

==/!= work for any compatible pointers and NULL. </> only within the same array. Comparing pointers to unrelated objects is UB. One-past-the-end is valid for comparison.

•Relational comparison only within same array
•One-past-end valid for comparison, not dereference

#include <stdio.h>
int main(void) {
    int arr[3] = {1, 2, 3};
    int *end = arr + 3; /* one past the end */
    for (int *p = arr; p < end; p++) printf("%d ", *p);
    printf("\n"); /* 1 2 3 */
    return 0;
}

1 2 3

< between unrelated pointers is UB

Question 8 / 15

What are wild pointers and dangling pointers?

Wild pointer: An uninitialized pointer that contains a random (garbage) address. Using it is UB.

Dangling pointer: A pointer that used to point to valid memory, but that memory has been freed or the variable has gone out of scope. Using it is UB.

Common causes of dangling pointers:

Using a pointer after free().
Returning a pointer to a local variable.
Using a pointer to a block-scope variable after the block ends.
Using a pointer after realloc() moves the memory.

Prevention:

Initialize all pointers (to a valid address or NULL).
Set pointers to NULL after free.
Never return pointers to local variables.
Be careful with realloc -- it can invalidate old pointers.

Pseudo Code

Wild pointer:
  int *p;          // uninitialized -- points to random address
  *p = 42;         // UB!

Dangling pointer:
  int *p = malloc(sizeof(int));
  free(p);         // p now dangles
  *p = 42;         // UB!

  int *f() {
    int local = 42;
    return &local;  // dangling -- local dies when f returns
  }

Code

#include <stdio.h>
#include <stdlib.h>

/* BAD: returns pointer to local variable */
/* int *bad_function(void) {
    int local = 42;
    return &local;  // DANGLING: local destroyed on return
} */

/* GOOD: return heap-allocated memory */
int *good_function(void) {
    int *p = malloc(sizeof(int));
    if (p) *p = 42;
    return p;  /* caller must free */
}

int main(void) {
    /* Wild pointer: uninitialized */
    /* int *wild;
       *wild = 10;  // UB! wild points to garbage address */

    /* Dangling pointer: use after free */
    int *p = malloc(sizeof(int));
    *p = 42;
    free(p);
    /* *p = 100;  // UB! p is dangling */
    p = NULL;  /* GOOD: prevent accidental use */

    /* Safe function */
    int *safe = good_function();
    if (safe) {
        printf("%d\n", *safe); /* 42 */
        free(safe);
        safe = NULL;
    }

    /* Dangling from scope */
    int *scope_ptr;
    {
        int local = 99;
        scope_ptr = &local;
    }
    /* scope_ptr is now dangling -- local is out of scope */
    /* printf("%d", *scope_ptr);  // UB! */

    return 0;
}

Key Points

•Wild pointer: uninitialized, points to random address
•Dangling pointer: points to freed or out-of-scope memory
•Both cause undefined behavior when dereferenced
•Set pointers to NULL after free to prevent dangling use
•Never return a pointer to a local variable

Gotchas

•Use-after-free bugs may work intermittently and only crash in production
•realloc can move memory, making old pointers dangling
•A dangling pointer still has the old address value -- comparisons may seem valid but are UB
•Static analysis tools (clang-tidy, cppcheck) can detect many dangling pointer bugs

Wild = uninitialized (garbage address). Dangling = points to freed/out-of-scope memory. Both cause UB. Fix: initialize all pointers, set to NULL after free, never return address of local.

•Wild = uninitialized; dangling = freed/out-of-scope
•Set to NULL after free

#include <stdio.h>
#include <stdlib.h>
int main(void) {
    int *p = malloc(sizeof(int));
    if (p) { *p = 42; printf("%d\n", *p); }
    free(p);
    p = NULL; /* prevent dangling use */
    /* *p would segfault now (NULL deref) instead of silent corruption */
    return 0;
}

Dangling pointer bugs may work by accident, then crash in production

Question 9 / 15

What is the size of a pointer and does it depend on the platform?

The size of a pointer depends on the platform's address bus width, not on the type it points to.

Common sizes:

32-bit systems: all pointers are 4 bytes.
64-bit systems: all pointers are 8 bytes.

All data pointers have the same size on a given platform: sizeof(int *) == sizeof(char *) == sizeof(double *) == sizeof(void *).

Exception: Function pointers may have a different size than data pointers on some architectures (e.g., Harvard architecture embedded systems).

Why it matters:

Do not assume pointer size. Use sizeof(ptr) or sizeof(void *) to check.
Use %p (with cast to void *) to print pointers.
Use uintptr_t from <stdint.h> to store a pointer as an integer.
Never cast a pointer to int on 64-bit systems (data loss).

Pseudo Code

32-bit system: sizeof(int*) = sizeof(char*) = sizeof(void*) = 4
64-bit system: sizeof(int*) = sizeof(char*) = sizeof(void*) = 8

All data pointers same size on a given platform
Function pointers may differ (rare)
Use uintptr_t to store pointer as integer

Code

#include <stdio.h>
#include <stdint.h>

int dummy_func(void) { return 0; }

int main(void) {
    printf("sizeof(char *)    = %zu\n", sizeof(char *));
    printf("sizeof(int *)     = %zu\n", sizeof(int *));
    printf("sizeof(double *)  = %zu\n", sizeof(double *));
    printf("sizeof(void *)    = %zu\n", sizeof(void *));
    printf("sizeof(int (*)(void)) = %zu\n", sizeof(int (*)(void)));

    /* On 64-bit: all print 8 */
    /* On 32-bit: all print 4 */

    /* Pointer to integer conversion */
    int x = 42;
    uintptr_t addr = (uintptr_t)&x;
    printf("address as integer: 0x%lx\n", (unsigned long)addr);

    /* Recover pointer from integer */
    int *p = (int *)addr;
    printf("*p = %d\n", *p); /* 42 */

    /* Print pointer */
    printf("&x = %p\n", (void *)&x);

    return 0;
}

sizeof(char *)    = 8
sizeof(int *)     = 8
sizeof(double *)  = 8
sizeof(void *)    = 8
sizeof(int (*)(void)) = 8
address as integer: 0x7ffd5e8e3abc
*p = 42
&x = 0x7ffd5e8e3abc
(all sizes are 4 on 32-bit systems; addresses are platform-dependent)

Key Points

•Pointer size depends on platform: 4 bytes (32-bit) or 8 bytes (64-bit)
•All data pointers are the same size on a given platform
•sizeof(int *) == sizeof(void *) == sizeof(char *)
•Use uintptr_t for pointer-to-integer conversion
•Never cast pointer to int on 64-bit (truncation)

Gotchas

•Casting pointer to int on 64-bit truncates the address (data loss!)
•Use uintptr_t (from <stdint.h>) for safe pointer-to-integer round-trips
•Function pointers can be different size than data pointers on some architectures
•Windows 64-bit (LLP64): long is 4 bytes but pointers are 8 bytes

Pointer size depends on platform: 4 bytes (32-bit) or 8 bytes (64-bit). All data pointers are the same size. Use uintptr_t for pointer-to-integer conversion. Never cast to int on 64-bit.

•4 bytes on 32-bit; 8 bytes on 64-bit
•Use uintptr_t for pointer-to-integer

#include <stdio.h>
#include <stdint.h>
int main(void) {
    printf("ptr size = %zu bytes\n", sizeof(void *)); /* 4 or 8 */
    int x = 42;
    uintptr_t addr = (uintptr_t)&x;
    printf("0x%lx\n", (unsigned long)addr);
    return 0;
}

ptr size = 8 bytes
0x7ffd5e8e3abc
(size is 4 on 32-bit; address is platform-dependent)

Casting pointer to int on 64-bit truncates the address

Question 10 / 15

How does const work with pointers (const int* vs int* const)?

There are three ways to use const with pointers:

1. Pointer to const data: const int *p (or int const *p)

Cannot modify the data through p: *p = 10; is an error.
CAN change what p points to: p = &y; is OK.
"I promise not to modify the data through this pointer."

2. Const pointer: int *const p

CAN modify the data through p: *p = 10; is OK.
Cannot change what p points to: p = &y; is an error.
"This pointer always points to the same location."

3. Const pointer to const data: const int *const p

Cannot modify the data: *p = 10; is an error.
Cannot change the pointer: p = &y; is an error.
"Read-only pointer to read-only data."

Reading rule: Read the declaration from right to left. const int *p = "p is a pointer to int that is const" = pointer to const int.

Pseudo Code

const int *p;        // pointer to const int (data is read-only)
int *const p;        // const pointer to int (pointer is fixed)
const int *const p;  // const pointer to const int (both fixed)

Read right to left:
  const int *p  -> p is a (*) to int that is const
  int *const p  -> p is a const (*) to int

Code

#include <stdio.h>

int main(void) {
    int x = 10, y = 20;

    /* 1. Pointer to const data */
    const int *pc = &x;
    /* *pc = 99;  // ERROR: cannot modify through pc */
    pc = &y;     /* OK: can change what pc points to */
    printf("*pc = %d\n", *pc); /* 20 */

    /* 2. Const pointer */
    int *const cp = &x;
    *cp = 99;    /* OK: can modify the data */
    /* cp = &y;  // ERROR: cannot change the pointer */
    printf("*cp = %d\n", *cp); /* 99 */

    /* 3. Const pointer to const data */
    const int *const cpc = &x;
    /* *cpc = 50;  // ERROR: cannot modify data */
    /* cpc = &y;   // ERROR: cannot change pointer */
    printf("*cpc = %d\n", *cpc); /* 99 */

    /* Practical: function parameter promises read-only */
    /* void print(const int *arr, int n) -- will not modify arr */

    return 0;
}

*pc = 20
*cp = 99
*cpc = 99

Key Points

•const int *p: data is read-only (pointer can be changed)
•int *const p: pointer is fixed (data can be modified)
•const int *const p: both are read-only
•Read right to left to understand const placement
•Use const int * in function params to promise read-only access

Gotchas

•const int *p and int const *p are identical (both = pointer to const int)
•Casting away const and modifying is undefined behavior
•int *p = (int *)const_ptr; -- compiles but modification through p is UB
•Arrays passed as const int *arr prevent modification inside the function

const int *p = data read-only, pointer changeable. int *const p = pointer fixed, data modifiable. const int *const p = both read-only. Read right to left.

•const before * = data read-only
•const after * = pointer fixed

#include <stdio.h>
int main(void) {
    int x = 10, y = 20;
    const int *pc = &x;  /* data read-only */
    pc = &y;             /* OK */
    /* *pc = 5;           ERROR */
    int *const cp = &x;  /* pointer fixed */
    *cp = 5;             /* OK */
    /* cp = &y;           ERROR */
    printf("%d %d\n", *pc, *cp); /* 20 5 */
    return 0;
}

20 5

const int *p and int const *p are the same

Question 11 / 15

How do you pass arrays to functions using pointers?

When you pass an array to a function, it decays to a pointer to its first element. The function receives just the address -- it does NOT know the array size.

Consequence: You must always pass the size as a separate parameter.

These are all equivalent:

void f(int arr[]);
void f(int arr[100]);  // 100 is ignored
void f(int *arr);

All three are just void f(int *arr). The compiler treats array parameters as pointers.

For 2D arrays: The column dimension must be specified:

void f(int arr[][COLS], int rows);  // COLS must be known at compile time

Pseudo Code

void f(int arr[], int n);    // arr is just int*
void f(int *arr, int n);     // same thing
void f(int arr[100], int n); // 100 is ignored, still just int*

2D: void f(int arr[][COLS], int rows); // COLS required

Always pass size as separate parameter

Code

#include <stdio.h>

/* All three are identical: arr is int* */
void print_array(const int *arr, int n) {
    for (int i = 0; i < n; i++) {
        printf("%d ", arr[i]);
    }
    printf("\n");
}

/* Modifying array through pointer */
void double_elements(int *arr, int n) {
    for (int i = 0; i < n; i++) {
        arr[i] *= 2;
    }
}

/* 2D array: column dimension must be specified */
void print_matrix(int rows, int cols, int m[rows][cols]) {
    for (int i = 0; i < rows; i++) {
        for (int j = 0; j < cols; j++) {
            printf("%3d", m[i][j]);
        }
        printf("\n");
    }
}

int main(void) {
    int arr[] = {1, 2, 3, 4, 5};
    int n = sizeof(arr) / sizeof(arr[0]);

    print_array(arr, n); /* 1 2 3 4 5 */

    double_elements(arr, n);
    print_array(arr, n); /* 2 4 6 8 10 */

    int mat[2][3] = {{1,2,3},{4,5,6}};
    print_matrix(2, 3, mat);

    return 0;
}

Key Points

•Arrays decay to pointers when passed to functions
•Always pass the size as a separate parameter
•int arr[], int arr[100], and int *arr are all the same in parameters
•Function can modify the original array through the pointer
•For 2D arrays, the column count must be specified

Gotchas

•sizeof(arr) inside the function gives pointer size, not array size
•void f(int arr[100]) does NOT enforce that the array has 100 elements
•Forgetting to pass the size is a common source of buffer overflows
•2D arrays and pointer-to-pointer require different function signatures

Arrays decay to pointers in function parameters. int arr[], int arr[100], and int *arr are all the same. Always pass size separately. sizeof gives pointer size inside the function.

•Array decays to pointer in function parameter
•Always pass size separately

#include <stdio.h>
void sum(const int *arr, int n) {
    int total = 0;
    for (int i = 0; i < n; i++) total += arr[i];
    printf("%d\n", total);
}
int main(void) {
    int a[] = {1, 2, 3, 4, 5};
    sum(a, 5); /* 15 */
    return 0;
}

sizeof(arr) in function = pointer size

Question 12 / 15

What are the dangers of returning pointers from functions?

Returning a pointer from a function is common but has pitfalls:

SAFE to return:

Pointer to heap memory (malloc'd) -- caller must free.
Pointer to static/global variables -- they persist.
Pointer to string literals -- they persist for the program lifetime.
Pointer passed in as a parameter (it was valid before the call).

DANGEROUS (UB):

Pointer to a local variable -- the variable is destroyed when the function returns, creating a dangling pointer.
Pointer to a local array -- same problem.

The key rule: Never return the address of a local (automatic) variable.

Pseudo Code

SAFE:
  return malloc(n);         // heap memory persists
  return &static_var;       // static persists
  return "literal";         // string literal persists
  return input_ptr;         // was valid before call

DANGEROUS:
  int local = 42;
  return &local;            // DANGLING! local destroyed on return

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* GOOD: return heap-allocated memory */
int *create_array(int n) {
    int *arr = malloc(n * sizeof(int));
    if (arr) {
        for (int i = 0; i < n; i++) arr[i] = i * 10;
    }
    return arr;  /* caller must free */
}

/* GOOD: return pointer to static */
const char *get_greeting(void) {
    static char buf[50] = "Hello, World!";
    return buf;  /* buf persists */
}

/* GOOD: return string literal */
const char *get_name(void) {
    return "Alice";  /* string literal persists */
}

/* BAD: return pointer to local */
/* int *bad_function(void) {
    int local = 42;
    return &local;  // DANGLING: local destroyed here
} */

int main(void) {
    int *arr = create_array(5);
    if (arr) {
        for (int i = 0; i < 5; i++) printf("%d ", arr[i]);
        printf("\n"); /* 0 10 20 30 40 */
        free(arr);
    }

    printf("%s\n", get_greeting()); /* Hello, World! */
    printf("%s\n", get_name());     /* Alice */

    return 0;
}

0 10 20 30 40
Hello, World!
Alice

Key Points

•Never return a pointer to a local variable
•Safe: return heap (malloc), static, literal, or input pointer
•Heap-allocated returns: caller is responsible for free()
•Static returns: be aware they share the same buffer across calls
•Use const for returned string literals

Gotchas

•Returning &local creates a dangling pointer -- may work by accident, fail in release builds
•Static buffers returned from functions are shared: multiple calls overwrite the same buffer
•Forgetting to free returned heap memory causes leaks
•The compiler may warn about returning address of local (-Wreturn-local-addr)

Never return a pointer to a local variable (dangling). Safe: heap (malloc), static, literal, or input pointers. Caller must free heap allocations. Static returns share one buffer across calls.

•Never return address of local variable
•Heap allocations persist; caller must free

#include <stdio.h>
#include <stdlib.h>
int *make_int(int val) {
    int *p = malloc(sizeof(int)); /* heap: safe */
    if (p) *p = val;
    return p;
}
int main(void) {
    int *p = make_int(42);
    if (p) { printf("%d\n", *p); free(p); }
    return 0;
}

Returning &local may appear to work but is UB

Question 13 / 15

How does pointer casting work and when is it safe?

Pointer casting converts a pointer from one type to another. Some casts are safe; others invoke undefined behavior.

Safe casts:

Any pointer to/from void * -- always valid in C.
Any pointer to/from char * / unsigned char * -- examining raw bytes is always allowed.
Pointer to struct to pointer to its first member (if properly aligned).

Unsafe casts (strict aliasing violations):

Casting int * to float * and dereferencing violates the strict aliasing rule.
The compiler assumes pointers of different types do not alias the same memory.
Violation is undefined behavior -- the optimizer can produce wrong code.

The strict aliasing rule (C99 6.5/7): An object shall have its stored value accessed only through an lvalue of a compatible type, a char type, or a qualified version. Everything else is UB.

Pseudo Code

Safe:
  void *v = &x; int *p = v;           // void* conversion
  char *bytes = (char *)&x;           // examining raw bytes
  struct S *sp = ...; int *ip = (int *)sp;  // first member

Unsafe (strict aliasing violation):
  int x = 42;
  float *fp = (float *)&x;
  float f = *fp;   // UB! int aliased as float

Code

#include <stdio.h>
#include <string.h>

int main(void) {
    /* SAFE: void* conversion */
    int x = 42;
    void *vp = &x;
    int *ip = vp;  /* implicit in C */
    printf("%d\n", *ip); /* 42 */

    /* SAFE: examining bytes through char* */
    unsigned char *bytes = (unsigned char *)&x;
    printf("bytes of %d: ", x);
    for (size_t i = 0; i < sizeof(int); i++) {
        printf("%02X ", bytes[i]);
    }
    printf("\n");

    /* SAFE: type punning through memcpy (not pointer cast) */
    float f;
    unsigned int bits = 0x42280000; /* IEEE 754 for 42.0 */
    memcpy(&f, &bits, sizeof(f));
    printf("f = %f\n", f); /* 42.000000 */

    /* UNSAFE: direct pointer cast (strict aliasing violation) */
    /* float *fp = (float *)&x;
       float bad = *fp;  // UB! */

    /* SAFE alternative: use a union (C99 allows it) */
    union {
        int i;
        float f;
    } pun;
    pun.i = 0x42280000;
    printf("pun.f = %f\n", pun.f); /* 42.000000 */

    return 0;
}

42
bytes of 42: 2A 00 00 00
f = 42.000000
pun.f = 42.000000
(byte order is platform-dependent; shown for little-endian)

Key Points

•void * and char * casts are always safe
•Strict aliasing: accessing memory through incompatible pointer types is UB
•Use memcpy for type punning, not pointer casts
•Union-based type punning is allowed in C99
•Compiler uses strict aliasing for optimization (assumes no aliasing)

Gotchas

•int x; float f = *(float *)&x; is UB (strict aliasing violation)
•-fno-strict-aliasing disables the optimization (GCC/Clang) but is not portable
•memcpy is the only fully portable way to do type punning
•Violating strict aliasing can cause the optimizer to produce incorrect code

void* and char* casts are always safe. Casting between unrelated pointer types (int* to float*) and dereferencing violates strict aliasing (UB). Use memcpy for type punning.

•void* and char* casts are safe
•Use memcpy for type punning

#include <stdio.h>
#include <string.h>
int main(void) {
    int x = 42;
    unsigned char *b = (unsigned char *)&x; /* safe: char* */
    printf("%02X\n", b[0]);
    /* float *f = (float *)&x; *f; -- UB! strict aliasing */
    float f;
    memcpy(&f, &x, sizeof(f)); /* safe type punning */
    return 0;
}

2a
(byte value is platform-dependent; shown for little-endian)

Casting int* to float* and dereferencing is UB

Question 14 / 15

What are the most common pointer mistakes in C?

Top pointer mistakes:

Dereferencing NULL: Forgetting to check malloc return or function return values.
Use after free: Using a pointer after calling free() on it.
Memory leaks: Forgetting to free() allocated memory.
Dangling pointer: Returning address of a local variable.
Buffer overflow: Writing past the end of an allocated buffer.
Uninitialized pointer: Using a pointer without initializing it.
Wrong type cast: Casting to the wrong pointer type.
Off-by-one: Allocating n bytes but needing n+1 (e.g., forgetting null terminator).
Double free: Calling free() twice on the same pointer.
Sizeof pointer vs sizeof data: malloc(sizeof(ptr)) instead of malloc(sizeof(*ptr)).

Pseudo Code

1. NULL deref: if (!ptr) { handle error; }
2. Use after free: free(p); p = NULL;
3. Memory leak: always free what you malloc
4. Dangling: never return &local
5. Buffer overflow: check bounds
6. Uninitialized: always init to NULL or valid address
7. Wrong cast: match pointer types
8. Off-by-one: malloc(strlen(s) + 1) for strings
9. Double free: set to NULL after free
10. sizeof: malloc(sizeof(*ptr)) not sizeof(ptr)

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {
    /* BUG 1: sizeof pointer vs sizeof data */
    int *bad = malloc(sizeof(bad));   /* WRONG: 8 bytes (pointer) */
    int *good = malloc(sizeof(*good)); /* RIGHT: 4 bytes (int) */

    /* BUG 2: Off-by-one for strings */
    const char *src = "hello";
    /* char *s = malloc(strlen(src));  // WRONG: missing +1 for null */
    char *s = malloc(strlen(src) + 1);  /* RIGHT */
    if (s) {
        strcpy(s, src);
        printf("%s\n", s);
        free(s);
    }

    /* BUG 3: Forgetting NULL check */
    int *p = malloc(1000000000 * sizeof(int));
    if (p == NULL) {
        fprintf(stderr, "malloc failed!\n");
        /* Don't use p! */
    } else {
        p[0] = 42;
        free(p);
    }

    /* GOOD pattern: malloc with sizeof(*ptr) */
    int *arr = malloc(10 * sizeof(*arr)); /* works even if type changes */
    if (arr) {
        for (int i = 0; i < 10; i++) arr[i] = i;
        free(arr);
        arr = NULL; /* prevent double free */
    }

    free(good);
    free(bad);

    return 0;
}

hello
malloc failed!

Key Points

•Use sizeof(*ptr) not sizeof(ptr) in malloc
•malloc(strlen(s) + 1) for string copies (include null terminator)
•Always check malloc return for NULL
•Set pointer to NULL after free to prevent double-free and use-after-free
•Use valgrind and Address Sanitizer to find memory bugs

Gotchas

•malloc(sizeof(ptr)) allocates pointer size (8), not the data size
•strlen(s) does not include the null terminator -- always +1
•Double free causes undefined behavior -- can corrupt the heap
•Use-after-free bugs may appear to work and only crash under load

Top mistakes: NULL deref, use-after-free, leaks, dangling pointers, buffer overflow, sizeof(ptr) vs sizeof(*ptr), missing +1 for null terminator. Use valgrind and -fsanitize=address.

•sizeof(*ptr) in malloc, not sizeof(ptr)
•strlen + 1 for string allocation

#include <stdlib.h>
#include <string.h>
#include <stdio.h>
int main(void) {
    /* GOOD patterns */
    int *p = malloc(10 * sizeof(*p)); /* sizeof(*p), not sizeof(p) */
    char *s = malloc(strlen("hello") + 1); /* +1 for null */
    if (p && s) {
        strcpy(s, "hello");
        printf("%s\n", s);
    }
    free(p); p = NULL;
    free(s); s = NULL;
    return 0;
}

hello

malloc(sizeof(ptr)) allocates 8 bytes, not the data size

Question 15 / 15

How do you use pointers to traverse and manipulate strings?

Strings in C are just char arrays, and pointers are the natural way to traverse them. Many idiomatic C patterns use pointer arithmetic for string manipulation.

Common pointer patterns:

Traversal: while (*p) { ... p++; } -- iterate until null terminator.
Copy: while (*dst++ = *src++); -- copy including null terminator.
Length: increment pointer until null, subtract start address.
Search: advance pointer until match or null.

These patterns are more idiomatic and often faster than index-based loops.

Pseudo Code

Traversal: while (*p) { process(*p); p++; }
Copy:      while (*dst++ = *src++) ; // compact idiom
Length:    char *s = str; while (*s) s++; return s - str;
Search:    while (*p && *p != ch) p++;

Code

#include <stdio.h>

/* Pointer-based strlen */
size_t my_strlen(const char *s) {
    const char *start = s;
    while (*s) s++;
    return (size_t)(s - start);
}

/* Pointer-based strcpy */
char *my_strcpy(char *dst, const char *src) {
    char *orig = dst;
    while ((*dst++ = *src++)) ; /* copies including null */
    return orig;
}

/* Count occurrences using pointer */
int count_char(const char *s, char c) {
    int count = 0;
    while (*s) {
        if (*s == c) count++;
        s++;
    }
    return count;
}

/* Find character using pointer */
const char *my_strchr(const char *s, char c) {
    while (*s) {
        if (*s == c) return s;
        s++;
    }
    return (c == '\0') ? s : NULL;
}

int main(void) {
    const char *msg = "hello world";

    printf("length: %zu\n", my_strlen(msg)); /* 11 */

    char buf[20];
    my_strcpy(buf, msg);
    printf("copy: %s\n", buf); /* hello world */

    printf("'l' count: %d\n", count_char(msg, 'l')); /* 3 */

    const char *found = my_strchr(msg, 'w');
    if (found) {
        printf("found at offset %td: %s\n",
               found - msg, found); /* 6: world */
    }

    /* Idiomatic pointer traversal */
    printf("chars: ");
    for (const char *p = msg; *p; p++) {
        printf("%c ", *p);
    }
    printf("\n");

    return 0;
}

length: 11
copy: hello world
'l' count: 3
found at offset 6: world
chars: h e l l o   w o r l d

Key Points

•while (*p) is the idiomatic way to traverse a string
•while (*dst++ = *src++) is the classic copy idiom
•Pointer subtraction gives string length or offset
•Pointer-based string functions are idiomatic C
•Always check for null terminator to avoid reading past the string

Gotchas

•while (*dst++ = *src++) has the = inside the condition (assignment, not comparison)
•Forgetting to handle the null terminator in custom string functions causes UB
•Pointer-based string functions assume valid null-terminated input
•Post-increment in *p++ dereferences first, then increments the pointer

while (*p) traverses a string until null. while (*dst++ = *src++) copies including null. Pointer subtraction gives length. These are idiomatic C string patterns.

•while (*p) is the standard traversal idiom
•*p++ dereferences then increments

#include <stdio.h>
size_t my_strlen(const char *s) {
    const char *p = s;
    while (*p) p++;
    return (size_t)(p - s);
}
int main(void) {
    printf("%zu\n", my_strlen("hello")); /* 5 */
    return 0;
}

while (*d++ = *s++) assigns AND checks in one expression

Built by onllm.dev

Home GitHub Support awesomePrep