What programming errors is this page highlighting?

Question

http://dspace.dial.pipex.com/town/green/gfd34/art/bloopers.html

The first one seems simple;

return strcpy(malloc(strlen(s)), s);

malloc could return null, and strcpy could try to copy data to memory address 0. Or s could be a pointer to a string (rather than an array), and malloc would only allocate enough space for a pointer, and would try and copy a string into it. (I think).

What about the second one though?

What a shame that he didn't cast ch to unsigned char when he wrote ch = toupper(ch);

Why should you cast ch to unsigned char if you write ch = toUpper(ch);?

Answer 1

The toupper() function expects its input to be an integer in the range of unsigned char (0 - 255), while in some cases a char variable can be in the range of a signed char (-128 - 127).

Answer 2

The toupper function expects the argument to be repressentable as an unsigned char or the value EOF. A signed char above 127 would be treated as if it were a negative number if you did not cast it to unsigned char since the argument is an int.

Answer 3

The toupper function (with a lower case U) takes either the value of an unsigned char or EOF. If char is signed, passing a char to toupper() without converting it to an unsigned char first can pass other values with undefined behaviour. The implementation of toupper often look like this:

int toupper(int c)
{
   return touppermap[c+1];
}

so the problem here is real. (This implementation assumes EOF is -1, which you can't formally do but nothing prevent the implementation to be knowledgeable about its own characteristics).

Answer 4

The first one seems simple; malloc could return null, and strcpy could try to copy data to memory address 0. Or s could be a pointer to a string (rather than an array), and malloc would only allocate enough space for a pointer, and would try and copy a string into it. (I think).

Simple enough, right? You missed the most obvious thing wrong with this: you are not allocating enough space. strcpy() copies the string plus the terminating null byte, so the destination buffer must be size at least 1 bigger than the length of the string.