Why can I return `int` after a function but not `char *`?

Question

I'm a newbie to C. I had extended the question from the previous question: Strange behavior when returning "string" with C (Thanks for all who answered or commented that question, by the way.)

Pretty straight forward:

Why can this work:

#include <stdio.h>

int func() {
    int i = 5;
    return i;
}

int main() {
    printf("%d",func());
}

But not this:

#include <stdio.h>

char * func() {
    char c[] = "Hey there!";
    return c;
}

int main() {
    printf("%s",func());
}

From the previous question, logically the int i should not exist too because the function has returned, but why can it still be returned while char c[] cannot?

(It seems to be duplicated from "Pointers and memory scope" but I would like to know more about what is the difference between returning an int and a char *.)

Answer 1

Problem is not returning char *, it is returning something that is allocated on stack.

If you allocate memory for your string rather than pointing to function stack, there will be no problem. Something like this:

char * func() {
    char c[] = "Hey there!";
    return strdup(c);
}

int main() {
    char* str = func();
    printf("%s", str);
    free(str);
}

It is important to mention that in both cases, you are copying a value and in both cases copied value is correct, but the meaning of copied value differs.

In first case, your are copying an int value and after your return from function, you are using that int value which will be valid. But in 2nd case, even though you have a valid pointer value, it refers to an invalid address of memory which is stack of called function.

Based on suggestions in comment, I decided to add another better practice in memory allocating for this code:

#define NULL (void*)0

int func(char *buf, int len) {
    char c[] = "Hey there!";
    int size = strlen(c) + 1;

    if (len >= size) {
        strcpy(buf, c);
    }

    return size;
}

int main() {
    int size = func(NULL, 0);
    char *buf = calloc(size, sizeof(*buf));
    func(buf, size);
    printf("%s", buf);
    free(buf);
    return 0;
}

Similar approach is used in a lot of windows API functions. This approach is better, because owner of pointer is more obvious (main in here).

Answer 2

In the first example the return value is copied. In your second example you're returning a pointer, which will point to a memory location which no longer exists.

Answer 3

In the first case, you return the int value 5 from the function. You can then print that value.

In the second case however, you return a value of type char *. That value points to an array that is local to the function func. After that function returns the array goes out of scope, so the pointer points to invalid memory.

The difference between these two cases is a value that you use directly, versus a pointer value that no longer points to valid memory. Had you returned a pointer to memory allocated by malloc, then the pointer would point to valid memory.

Answer 4

You are trying to return pointer to local array, which is very bad. If you want to return a pointer to array, allocate it dynamically using malloc inside your func();

Then you must call free() on caller side to free up memory you allocated when you no longer need it

Answer 5

In the first example, you return an int, and the second you return a pointer to a char. They both return in exactly the same manner, it is just a matter of understanding the stack and how values are returned.

Even though i was declared in the function and is allocated on the stack, when the function returns it returns the value of i (which is basically copied, so when i falls off the stack the value of i is still returned.)

This is the exact same thing that happens to the char * in the second example. It will still be a pointer to a char, and it returns the 'copied' value of c. However, since it was allocated on the stack, the address it points to is effectively invalid. The pointer value itself has not changed, but what it points to has.

You would have to dynamically allocate this to avoid this situation.

Answer 6

The return value of function is returned by copy. In the first example, you get a copy of the integer variable from the function. In the second you get a copy of the char pointer, not a copy of the string.

The pointer references the string data that has automatic storage, so is no longer valid after the function returns. The space becomes available for use by other code and many be modified - any attempt to access it has undefined behaviour.

The point is, it is a pointer that is returned, not a string; in C a strings (and more generally arrays) are not a first-class data types.

Depending on your needs there are a number of valid ways of returning the string data; for example the following is valid:

char* func() 
{
    static char c[] = "Hey there!";
    return c;
}

because here although the local variable goes out of scope the static data is not destroyed or de-allocated, and any reference to it remains valid.

Another alternative is to embed the string in a struct which is a first-class data type:

typedef struct
{
    char content[256] ;
} sString ;

sString func() 
{
    sString c = {"Hey there!"};
    return c;
}

Or more conventionally to copy the data to a caller buffer:

char* func( char* buffer ) 
{
    char c[] = "Hey there!";

    strcpy( buffer, c ) ;

    return buffer ;
}

I have omitted code to mitigate the possibility of buffer overrun above for clarity in this last example, such code is advised.