Dangling pointer in case of integer pointer vs char pointers

Question

I am trying to understand how dangling pointers work in c++.

int* get_int_ptr()
{
    int i=10;
    int* ptr;
    ptr = &i;
    return ptr;
}

char* get_char_ptr()
{
    char str[10];
    strcpy(str,"Hello!");
    return(str); 
}

int main()
{
    cout << *get_int_ptr() << endl;
    cout << get_char_ptr() << endl;
    return 0;
}

The output of this code is -

Warnings:

prog.cpp: In function 'char* get_char_ptr()':
prog.cpp:16:9: warning: address of local variable 'str' returned [-Wreturn-local-addr]
char str[10];
    ^

Output:

10

Can someone explain why is the value of i is printed in the main() function even when returned pointer points to i which has gone out of scope.

And why is the value of str not printed.

Is int* and char* are treated separately in terms of function scope.

Also, does using smart_pointers here will help in any form?

Answer 1

As you know, returning a pointer to a local variable is not guaranteed to work. So neither your get_int_ptr nor your get_char_ptr function can be expected to work.

(Foreshadowing the answer: "not guaranteed to work" is not quite the same as "guaranteed not to work".)

You experimented with your get_int_ptr function. To your surprise, the calling program "correctly" printed 10.

Here's an analogy. What you've done is just like this little story:

I was working on my car. I removed the front wheel to repair the brakes. When I put the front wheel back on, I forgot to install the lug nuts, so the wheel wasn't really attached. Then I drove to the store to buy some milk. But the wheel did not fall off. Why not?

And the answer is, you were very, very lucky.

Then you experimented with your get_char_ptr function. And it failed. This wouldn't be surprising, unless you imagined that the success of the get_int_ptr experiment somehow proved that dangling pointers are okay to use after all. Continuing the analogy:

The next day, with the lug nuts still missing, I drove cross-country to visit my aging grandmother. Halfway there, while traveling at 60 mph on the highway, the front wheel suddenly flew off, and I crashed into the ditch, demolishing my car. Why did this happen?

Needless to say, it happened because the lug nuts were missing! There was nothing holding the front wheel on, and your apparent "success" the previous day, driving to the store in that broken condition, proved nothing.

I agree it's intriguing that one of your functions "worked" and the other one didn't. But it was basically random happenstance. No, there's no difference between int* and char* pointers in this regard: they're both about equally likely not to work if dangling.

Sometimes it's possible to explain why random happenstance happens the way it does. Here, though, I can't. I've tried your program under my compiler, and I'm seeing exactly the same result. get_int_ptr's local variable i tends to survive, but get_char_ptr's local array str tends to get cleared out. I would expect that bits of str might survive, but evidently not. But, again, it doesn't really matter that we can't explain the behavior, because it's undefined.