Programming Puzzles & Code Golf Stack Exchange is a question and answer site for programming puzzle enthusiasts and code golfers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Shortest code that returns Segmentation Fault (SIGSEGV) in any programming language.

share|improve this question

26 Answers 26

up vote 41 down vote accepted

C, 5 characters


It's variable declaration - int type is implied (feature copied from B language) and 0 is default value. When executed this tries to execute a number (numbers aren't executable), and causes SIGSEGV.

share|improve this answer
Default value may not be 0, and this may give a BUS error rather than a segmentation fault. – Macmade Aug 10 '13 at 8:25
@Macmade: Actually, it is 0. static variables start as 0, and main; is static, as I declared it outside function. – xfix Aug 16 '13 at 8:20
last time i played with this thing, i figured out that there's a different reason for the segfault. First of all by calling main you jump to the location of main, not the value, another thing is main is an int, it's located in .bss, usually functions are located in .text, when the kernel loads the elf program it creates an executable page for .text and non-executable for .bss, so by calling main, you jump to a non-executable page, and execution something on a such page is a protection fault. – mniip Dec 6 '13 at 17:55
Yep, segfaults in C are pretty much the default :P – Paul Draper May 24 '14 at 23:23
What's a DE fault? Does it have to do with disk errors? – CalculatorFeline Mar 25 at 17:15

Bash, 11      

kill -11 $$
share|improve this answer
+1 for thinking different. – FUZxxl Dec 26 '11 at 22:19
Signal 11 in 11 characters. Seems legit. – nyuszika7h Dec 31 '13 at 12:39

3 Characters in Assembly


writing only this will give Segmentation Fault.

share|improve this answer
As an MSDOS .com file, it runs and terminates without error. – J B Dec 26 '11 at 19:10
see this code – Amol Sharma Dec 26 '11 at 19:46
My point being: just specifying “assembly” isn't enough to make it segfault. – J B Dec 26 '11 at 19:56
'ret' by itself should be a valid program; I suspect that is an error in the emulator. – Sir_Lagsalot Jan 20 '12 at 16:19
@JB: On MS DOS, no program will ever produce a segmentation fault. That's because MS DOS runs in real mode where memory protection is nonexistent. – celtschk Feb 4 '12 at 17:25

C, 18

share|improve this answer

pdfTeX (51)


This is actually probably a bug, but it is not present in the original TeX, written by Knuth: compiling the code with tex filename.tex instead of pdftex filename.tex does not produce a segfault.

share|improve this answer

C - 11(19) 7(15) 6(14) 1 chars, AT&T x86 assembler - 8(24) chars

C version is:


The whole program (not quite ISO-compliant, let's assume it's K&R C) is 19 chars long:


Assembler variant:

orl $0,0

The whole program is 24 chars long (just for evaluation, since it's not actually assembler):

main(){asm("orl $0,0");}


A couple of C variants. The first one uses zero-initialization of global pointer variable:


The second one uses infinite recursion:


The last variant is the shortest one - 7(15) characters.


Invented one more variant which is shorter than any of above - 6(14) chars. It assumes that literal strings are put into a read-only segment.



And my last try - 1 character long:


Just compile it like that:

cc -o segv -DP="main(){main();}" segv.c
share|improve this answer
in C isn't main; only 5 charecters – Arya Dec 26 '11 at 10:50
@Arya: Huh? What do you mean? – Alexander Bakulin Dec 26 '11 at 11:01
only main;in file.c – Arya Dec 26 '11 at 12:18
:Linker doesn't check whether main is function or not .It just pass it to the loader and return sigsegv – Arya Dec 26 '11 at 12:24
Of course the last entry can be used for everything, you just have to supply the right compiler arguments. Which should make it the automatic winner of any code golf contest. :-) – celtschk Feb 4 '12 at 17:20

Python, 33 characters

>>> import ctypes;ctypes.string_at(0)
Segmentation fault


Python, 60 characters

>>> import sys;sys.setrecursionlimit(1<<30);f=lambda f:f(f);f(f)
Segmentation fault


This is the Python version I'm testing on:

Python 2.6.1 (r261:67515, Jun 24 2010, 21:47:49) 
[GCC 4.2.1 (Apple Inc. build 5646)] on darwin

In general the Python interpreter is hard to crash, but the above is selective abusiveness...

share|improve this answer

Perl ( < 5.14 ), 9 chars


In 5.14 the regex engine was made reentrant so that it could not be crashed in this way, but 5.12 and earlier will segfault if you try this.

share|improve this answer
I can reproduce this on Perl 5.14 (Debian) and 5.18 (Arch Linux). – nyuszika7h Jan 21 '14 at 21:51
Reproduced with Perl v5.20.2 (windows) – MihaiPopescu Mar 11 at 13:38

Perl, 10 / 12 chars

A slightly cheatish solution is to shave one char off Joey Adams' bash trick:

kill 11,$$

However, to get a real segfault in Perl, unpack p is the obvious solution:

unpack p,1x8

Technically, this isn't guaranteed to segfault, since the address 0x31313131 (or 0x3131313131313131 on 64-bit systems) just might point to valid address space by chance. But the odds are against it. Also, if perl is ever ported to platforms where pointers are longer than 64 bits, the x8 will need to be increased.

share|improve this answer

Haskell, 31

foreign import ccall main::IO()

This produces a segfault when compiled with GHC and run. No extension flags are needed, as the Foreign Function Interface is in the Haskell 2010 standard.

share|improve this answer

C# - 62


Edit: 23

unsafe{int i=*(int*)0;}

Must compile with /unsafe for this one to work. For some reason I don't understand, *(int*)0=0 just throws a NullReferenceException, while this version gives the proper access violation.

share|improve this answer
The int i=*(int*)0; returns a NullReferenceException for me. – Peter Olson Dec 30 '11 at 7:43
You can try to access a negative location, like *(int*)-1=0 and get an access violation. – Peter Olson Dec 30 '11 at 7:46
The particular exception is just what the clr wraps it in, and is insignificant. The os itself actually gives the seg fault in all these cases. – captncraig Jan 20 '12 at 17:41

Python 33

import os

Sending signal 11 (SIGSEGV) in python.

share|improve this answer
Also 33 characters: from os import* and kill(getpid(),11) – Timtech Jan 8 '14 at 15:45

Python 2, 13


Windows reports an error code of c00000fd (Stack Overflow) which I would assume is a subtype of segmentation fault.

Thanks to Alex A. and Mego, it is confirmed to cause segmentation faults on Mac and Linux systems as well. Python is the language of choice for portably crashing your programs.

share|improve this answer
Segmentation fault: 11 on Mac – Alex A. Nov 2 '15 at 1:29
Segmentation fault (core dumped) on Linux – Mego Nov 2 '15 at 1:30

19 characters in C


It corrupts return address value of main function, so it gets a SIGSEGV on return of main.

share|improve this answer
It depends on the stack frame layout, so in some architecture it can possibly not fail. – Alexander Bakulin Dec 27 '11 at 19:41

PicoLisp - 4 characters

$ pil
: ('0)
Segmentation fault

This is intended behaviour. As described on their website:

If some programming languages claim to be the "Swiss Army Knife of Programming", then PicoLisp may well be called the "Scalpel of Programming": Sharp, accurate, small and lightweight, but also dangerous in the hand of the inexperienced.

share|improve this answer

dc - 7 chars


causes a stack overflow

share|improve this answer

brainfuck (2)


Yes, this is implementation-dependent. SIGSEGV is the likely result from a good compiler.

share|improve this answer
How is a compiler that segfaults on that "good"? That < should either have no effect or wrap around. – nyuszika7h Jul 4 '14 at 17:38
Immediately producing a runtime error on bounds violation is best because it lets the programmer find and fix the bug as fast as possible. Letting the buggy program run for a while and corrupt memory haphazardly before crashing just makes the problem harder to diagnose. Preventing the crash entirely, as you suggest, is worst; the programmer may get the program "working" and then be publicly humiliated when it crashes on standard compilers and interpreters. – Daniel Cristofani Oct 12 '14 at 23:17
Conversely, catching bounds violations before runtime is not possible in general, nor especially useful in the cases where it is possible. Producing a more descriptive runtime error would be okay, but having the operating system catch it as a segfault is great because it doesn't have any speed cost. (In case it's not clear, the compiler itself doesn't segfault--it produces executables that segfault as soon as they try to access memory out of bounds.) – Daniel Cristofani Oct 12 '14 at 23:35
Can you provide an implementation that produces this behavior and was created before this challenge was posted? If not, this answer is invalid. – Mego Apr 25 at 20:10

Forth - 3 characters

0 @

(@ is a fetch)

share|improve this answer
Shortest one so far that will work on modern systems. – Demetri Mar 6 '15 at 6:06
Which Forth? Gforth just says "Invalid memory address" – cat Mar 5 at 1:25


Obj.magic 0 0

This uses the function Obj.magic, which unsafely coerces any two types. In this case, it coerces 0 (stored as the immediate value 1, due to the tag bit used by the GC) to a function type (stored as a pointer). Thus, it tries to dereference the address 1, and that will of course segfault.

share|improve this answer
it coerces 0 (stored as the immediate value 1) - why is 0 stored as 1? – Skyler Nov 3 '15 at 14:15
@Skyler see edit – Demetri Nov 4 '15 at 19:02

Cython, 14

This often comes in handy for debugging purposes.

share|improve this answer

J (6)

memf 1

memf means free memory, 1 is interpreted as a pointer.

share|improve this answer

LOLCODE, 4 bytes


Does not work online, only in the C interpreter.

share|improve this answer

F90 - 25 chars


Compiled with Intel compiler 12.0 which actually refuses to compile without the intermediate n as it detects the bound error. Does this count as a segfault?:

ifort -C sigsegv.F90 
forrtl: severe (408): fort: (2): Subscript #1 of the array A has value 2 which is greater than the upper bound of 1
share|improve this answer

Unix PDP-11 assembly, 18 bytes binary, 7 bytes source

(this is becoming a theme with me, maybe because it's the only language I sort of know that no-one else here does.)


Increments the single byte addressed by the initial value of r0 [which happens to be 05162 according to the simh debugger] as of program start.

0000000 000407 000002 000000 000000 000000 000000 000000 000000
0000020 005210 000000

And, as always, the extraneous bytes at the end can be removed with strip.

I made a few attempts to get the source shorter, but always ended up getting either a syntax error or SIGBUS.

share|improve this answer

F90 - 39 characters



gfortran segv.f90 -o segv 



Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

Backtrace for this error:
#0  0x7FF85FCAE777
#1  0x7FF85FCAED7E
#2  0x7FF85F906D3F
#3  0x40068F in MAIN__ at segv.f90:?
Erreur de segmentation (core dumped)


gfortran --version
GNU Fortran (Ubuntu 4.8.4-2ubuntu1~14.04.1) 4.8.4
share|improve this answer
Nice first post. – Eᴀsᴛᴇʀʟʏ Iʀᴋ Mar 25 at 18:03


set a a;while {[incr i]<999999999} {set a [list $a]};puts $a

Not short, but crashes with a segfault.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.