Question

Why does this return no warnings? What is supposed to be wrong with the code?

char *str = malloc(strlen("hello" + 1));
strcpy(str, "hello");

Thanks!

Answer 1

This

char *str = malloc(strlen("hello" + 1));
strcpy(str, "hello");

is nearly equivalent to:

char *temp = "hello";
char *temp2 = temp + 1;

char *str = malloc(strlen(temp2));
strcpy(str, "hello");

so temp + 1 is pointer math (it returns a pointer to ello, and strcpy doesn’t check if enough memory is present at destination (“standard” memory corruption caused by faulty code in C)

The end result is that strlen returns 4, strcpy uses 6 bytes of memory and a random piece of heap is trashed.