Questions about strcpy overflows

Question

I am using a simple main like this

#include <string.h>

int main(int argc, char **argv)
{
        char buf[256];
        strcpy(buf, argv[1]);
}

I understand that if compiled, this main will produce 'argc' with a value of one, and argv[1] would not exist as defined in this program. However, the memory address represented by argv[1], although not defined in this program, would not be modified by the program, as argv[1] is passed as a const char *. So my question is why strcpy cannot grab this char and write it into buf? Also, why is argc = 1?

You may want to study [Command line argument](http://www.tutorialspoint.com/cprogramming/c_command_line_arguments.htm) first. Hopefully you will get your answer by yourself. — Mohit Jain, May 14 '14 at 02:54
There is nothing `const` about `argv`. The standard supports modifying it as well as the strings it hosts (though it may seem odd). Regardless, `argv[N]` is only defined to expose a valid non-null address for all `N` in `[0..(argc-1)]`. The standard also mandates `argv[argc]` shall be a NULL pointer. (C §5.1.2.2.1, para2). In other words, your invoking `strcpy` with a NULL source address, which invokes *undefined behavior*. — WhozCraig, May 14 '14 at 02:56

score 2 · Accepted Answer · answered May 14 '14 at 03:04

Q:So my question is why strcpy cannot grab this {argv[1]} char and write it into buf?

You can. The only problems you might encounter is if argc is less than 2, or if argv[1] is larger than 255 bytes (plus the string termination character).

Q:Also, why is argc = 1?

On most systems, the lay-out of the argv[] array has the same layout. For example, assume that a program was executed from the command-line:

>./myprog cookie monster

argv[0]    Contains the path where the executing program resides in the filesystem.
           So the actual value is something like: '/home/mahonri/test/test'
           This value is provided by the operating system.

argv[1]    Will contain the string: 'cookie'
           This value is provided (optionally) by the user.

argv[2]    will contain the string: 'monster'
           This value is provided (optionally) by the user.

argc       will be '3', because there are three argv elements; 0, 1 and 2.

In the case of the question code, if argc is '1', then only argv[0] is initialized; and unpredictable things will happen if the code then attempts to access argv[1] or argv[2].

If `argc` is 1 then `argv[1]` _is_ also initialised, but to `NULL`. — sh1, May 14 '14 at 04:58

score 1 · Answer 2 · answered May 14 '14 at 03:17

The simple answer to your question "So my question is why strcpy cannot grab this char and write it into buf" is argv[1] is not treated as constant char *, as you mentioned, but it will be a NULL pointer, see C §5.1.2.2.1, para2. In your case undefined behaviour will occur.

As far as "why is argc = 1?" is concern, it depends on number of arguments you are passing. It is very basic to command line argument. Do a research .

Questions about strcpy overflows

2 Answers2