Why does this work? Using cin to read to a char array smaller than given input

Question

I'm reading C++ Primer Plus (6th Edition) and I've come across some sample code in chapter 4 which I have a question about:

Listing 4.2 strings.cpp

// strings.cpp -- storing strings in an array
#include <iostream>
#include <cstring> // for the strlen() function
int main()
{
    using namespace std;
    const int Size = 15;
    char name1[Size]; // empty array
    char name2[Size] = "C++owboy"; // initialized array
    // NOTE: some implementations may require the static keyword
    // to initialize the array name2
    cout << "Howdy! I'm " << name2;
    cout << "! What's your name?\n";
    cin >> name1;
    cout << "Well, " << name1 << ", your name has ";
    cout << strlen(name1) << " letters and is stored\n";
    cout << "in an array of " << sizeof(name1) << " bytes.\n";
    cout << "Your initial is " << name1[0] << ".\n";
    name2[3] = '\0'; // set to null character
    cout << "Here are the first 3 characters of my name: ";
    cout << name2 << endl;
    return 0;
}

The code itself doesn't cause any confusion, but I've been running it through and I'm confused by a certain scenario.

name1 is initialised as an array of chars 15 elements in length - am I right in thinking this should hold a string 14 characters in length? The end char should be reserved for the string terminator, right?

If I enter my name as HowCanIPossiblyFitThisEntireStringIn?, I get the following output:

Howdy! I'm C++owboy! What's your name?

HowCanIPossiblyFitThisEntireStringIn?

Well, HowCanIPossiblyFitThisEntireStringIn?, your name has 37 letters and is stored

in an array of 15 bytes.

Your initial is H.

Here are the first 3 characters of my name: C++

How is the entire name I enter being stored? If I step through the code, after cin reads into name1, Visual Studio tells me it contains elements 0 - 14, with the last one being the char 'y' ("HowCanIPossibly...). I would assume from this that any extra data entered had been truncated and lost, but this is obviously not the case as the following cout successfully writes the entire name out to the console.

For curiosity's sake, could anyone enlighten me as to what's happening here? For the record, I'm using Visual Studio 2012 Express.

Joseph Mansfield · Accepted Answer · 2013-03-26 16:58:39Z

8

You are writing past the bounds of the array. The C++ standard doesn't say this should be an error; it says it is undefined behaviour. This means anything can happen, including seemingly working correctly. Simply put, your code does not have well-defined behaviour and so you shouldn't trust it to work.

We can imagine why it's probably working though. The first 15 characters will fit nicely into the array:

|H|o|w|C|a|n|I|P|o|s|s|i|b|l|y|F|i|t|T|h|i|s|E|n|t|i|r|e|S|t|r|i|n|g|I|n|?|...
^                             ^
|    These characters fit     |
         in the array

The rest of the characters are being written to the following memory locations. Now, remember that the null character, which is used to terminate C-style strings, is defined to have a representation that is all 0 bits. Now if the location following the location that contains the ? has all 0 bits in it, the string will appear to be null-terminated.

But the fact is, this is undefined. It just happens to work. Unfortunately, this is the scariest type of bug because it can seemingly work for a long time until one day you start getting calls from your very, very angry client.

edited Mar 26, 2013 at 16:58

answered Mar 26, 2013 at 16:52

Joseph Mansfield

111k22 gold badges249 silver badges329 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

scones Over a year ago

+1 This is first time i see undefined behaviour to be working though. :)

Bo Persson Over a year ago

@scones - It is actually looks like it is working, which is the worst kind. It will crash and burn as soon as an important customer shows up.

Barmar Over a year ago

@scones In typical implementations, writing past the end of an array simply overwrites the next variable in the stack frame. Unless that variable is a pointer, or you do it to the last variable and overwrite the stack frame header, it's not likely to cause an exception.

scones Over a year ago

@Barmar If i understand this correctly, this would lead to a buffer overflow and could be exploited.

Nathan Ernst Over a year ago

I'm surprised operator>> isn't overloaded for arrays. I mean, how hard would it be to implement template<typename T, size_t N> istream_type& operator>>(istream_type& is, T (&array)[N])? Implementation would be fairly simple and easy. Read T's until there's no more, and set failbit if there's more. Oh, how I hate undefined/unspecified behavior.

|

Open AI - Opting Out · Accepted Answer · 2013-03-26 17:45:35Z

2

You could use istream::get with the buffer and the size of the buffer:

cin.get(name1, Size);

As others have noted, it's far easier to use std::string:

std::string name1;
cin >> name;

answered Mar 26, 2013 at 17:45

Open AI - Opting Out

24.3k7 gold badges65 silver badges102 bronze badges

Collectives™ on Stack Overflow

Why does this work? Using cin to read to a char array smaller than given input

2 Answers 2

9 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

9 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related