string::c_str query

Question

Where does the pointer returned by calling string::c_str() point to ? In the following code snippet, I thought I will give get a segmentation fault but it gives me the correct output. If the pointer returned by string::c_str() points to an internal location inside the string object, then when the function returns and the object destructor gets invoked, I should get an invalid memory access.

#include <iostream>
#include <string>
using namespace std;

const char* func()
{
    string str("test");
    return str.c_str();
}

int main()
{
    const char* p = func();
    cout << p << endl;
    return 0;
}

Output: test
Compiler: g++ 4.3.3
Platform: ubuntu 2.6.28-19

Answer 1

Where does the pointer returned by calling string::c_str() point to?

It points to some place in memory where a null-terminated string containing the contents of the std::string is located.

The pointer is only valid until the std::string is modified or destroyed. It is also potentially invalidated if you call c_str() or data() again.

Basically, your safest bet is to assume the pointer obtained from c_str() is invalidated the next time you do something to the std::string object.

I should get an invalid memory access.

No, you get undefined behavior. You might get a memory access error of some kind (like a segmentation fault), but your program also might appear to continue running correctly. It might appear to work one time you run your program but fail the next.

Answer 2

What would you expect this to print out?

#include <iostream>
#include <string>

int main()
{
  int* test = new int[20];
  test[15] = 5;
  std::cout << test[15] << "\n";
  delete[] test;
  std::cout << test[15] << "\n";
  return 0;
}

In release mode on VS 2010, I get this result:

5
5

Deallocated memory doesn't necessarily throw an exception when you try to access it. The value doesn't necessarily get re-written, either. (Interestingly enough, if I change the compile to debug mode, the compiler overwrites the value with -572662307).

What happens when you try to access it is undefined by the standard. That means the compiler can do whatever it feels like doing, or choose to do nothing. (Or crash your program, or blow up the universe...)