Why does strcpy omit the first character in source string when using destination string of size 1?

Question

In C the strcpy function is used to copy a source into a destination string.

But when I use a destination char array of size 1 the strcpy correctly copies the source into the destination. But it also changes the source char array. I want to understand how this works in C.

I have done some research on how to correctly use strcpy in a program but all of them uses destination size more than 1. I did the program using destination size equal to 1. That's where the problem is.

char a[] = "String ABC";
char b[1];

strcpy(b, a);
int i;
// printf("%c\n", *(&(a[0])-1));

printf("%s\n",a);
printf("%s\n",b);

I expect the output to be

String ABC
String ABC

but the output I get is

tring ABC
String ABC

Answer 1

C performs no bounds checking and will let you overrun the bounds of a buffer. The actual behaviour is undefined, but in your case it is likely that the memory arrangement is thus:

 b a
|-|S|t|r|i|n|g|A|B|C|\0|

After the strcpy()

 b a
|S|t|r|i|n|g|A|B|C|\0|\0|

So b contains 'S' and no nul terminator (because there is no room), so when you print it, it runs into a which has "tringABC".

Other results are possible depending on how the compiler orders and aligns adjacent variables, and how the implementation works with overlapping strcpy() source and destination which is also undefined.

Answer 2

The problem is that you are copying to 1 byte string a longer string resulting in undefined behaviour.

If you run this program:

#include<stdio.h>
#include<string.h>

int main(int argc, char *argv[])
{
    char a[] = "String ABC";
    char b[1];
    printf("%p\n", &a);
    printf("%p\n", &b);

    strcpy(b, a);
    int i;
    printf("%c\n", *(&(a[0])-1));
    printf("%c\n", a[0]);
    printf("%s\n",a);
    printf("%s\n",b);
    printf("%p\n", &a);
    printf("%p\n", &b);
}

you see b and a have contiguous addresses and b is stored in a memory address before a. Most likely strcpy copies the string to b but since b is not allocated to store such a long string, it overwrites the next contiguous memory cell which seems to be a.

Let me indicate with || a memory cell storing a char. Suppose -b- is the cell storing one char long string. Before copy you have

|-b-|---a memory allocation--|
|-b-|S|t|r|i|n|g| |A|B|C|D|\n|

Now a is copied into b: the second cell is the one of a which now contain t

  |--a memory allocation-|
|S|t|r|i|n|g| |A|B|C|D|\n|

This is what I suppose it is happening. But remember that copying a longer string into a shorter one will result in undefined behaviour.

Answer 3

You cannot copy a into b, because there is not enough space in b. The strcpy function will simply write past the end of the array, which is undefined behavior. This means the program can behave in any unpredictable way (which sometimes, if you are unlucky, means it works as you expected).

In other words: when you use strcpy, you must ensure the destination buffer is big enough, including the null terminator. In this particular example, it means that b has to be, at least, 11 elements long (10 for the string, 1 for the null terminator).

Answer 4

As @Acorn mentioned in his answer, the behavior you are seeing is undefined behavior, which means that the compiler is free to generate arbitrary code.

However, if you want to investigate what's happening here (purely for curiosity), it can help to print out the addresses of the arrays.

#include <stdio.h>
#include <string.h>

int main(){
    char a[] = "String ABC";
    char b[1];

    strcpy(b, a);
    int i;
    // printf("%c\n", *(&(a[0])-1));

    printf("%s\n",a);
    printf("%s\n",b);

    printf("%p\n",a);
    printf("%p\n",b);
}

On my machine, the output is the following.

ring ABC
String ABC
0x7ffc36f1b29d
0x7ffc36f1b29c

As you can see, the two array pointers differ by only one. When you copy the source into destination, you've overwritten the first N-1 characters of the source array with the last N-1 characters of the source, where N is the number of characters in the source, including the null terminator.

Answer 5

Funny, my compiler behaves differently: When compiling it issues a warning:

% gcc strcpy.c -O3
In file included from /usr/include/string.h:494:0,
                 from strcpy.c:1:
In function ‘strcpy’,
    inlined from ‘main’ at strcpy.c:8:5:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:90:10: warning:
         ‘__builtin___memcpy_chk’ writing 11 bytes into a region of size 1 overflows the
         destination [-Wstringop-overflow=]
   return __builtin___strcpy_chk (__dest, __src, __bos (__dest));
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

And when I run the program, it aborts:

% ./a.out                       
*** buffer overflow detected ***: ./a.out terminated