What's the shortest, well-formed C++ code that exhibits undefined behavior?
\$\begingroup\$
\$\endgroup\$
5
-
1\$\begingroup\$ What do you mean "runnable"? If it has UB, there's no guarantee it can be run. \$\endgroup\$– R. Martinho FernandesCommented Aug 22, 2012 at 14:59
-
\$\begingroup\$ @R.MartinhoFernandes well, I mean that it starts. \$\endgroup\$– Luchian GrigoreCommented Aug 22, 2012 at 15:00
-
\$\begingroup\$ @LuchianGrigore that is very dependent on the compiler (version). \$\endgroup\$– rubenvbCommented Aug 22, 2012 at 15:04
-
1\$\begingroup\$ Define "exhibits". Does it need to show something? Or is it enough that the internal memory state is undefined at some point during the program? \$\endgroup\$– Mr ListerCommented Aug 22, 2012 at 17:28
-
\$\begingroup\$ defined "well-formed". \$\endgroup\$– Sapphire_BrickCommented Aug 9, 2020 at 17:53
Add a comment
|
6 Answers
\$\begingroup\$
\$\endgroup\$
9
int main(){main;}
3.6.1 Main function [basic.start.main]
3 - [...] The function main shall not be used within a program.
Edit: this is diagnosable, so not UB.
int main(){for(;;);}
1.10 Multi-threaded executions and data races [intro.multithread]
24 - The implementation may assume that any thread will eventually do one of the following: — terminate, — make a call to a library I/O function, — access or modify a volatile object, or — perform a synchronization operation or an atomic operation.
int main(){int i=i;}
4.1 Lvalue-to-rvalue conversion [conv.lval]
1 - [...] If the object to which the glvalue refers is [...] uninitialized, a program that necessitates this conversion has undefined behavior.
//^L.
Here ^L is the form feed character, which is part of the basic character set. 4 characters (a newline is not required per 2.2:2). Undefined behaviour is per
2.8 Comments [lex.comment]
1 - If there is a form-feed or a vertical-tab character in [a
//-style] comment, only white-space characters shall appear between it and the new-line that terminates the comment; no diagnostic is required.
-
\$\begingroup\$ the second one's not undefined. It can optimize out the for loop without issue. That is not undefined behavior. \$\endgroup\$– rubenvbCommented Aug 22, 2012 at 15:19
-
3\$\begingroup\$ @rubenvb stackoverflow.com/questions/3592557/… - anytime the standard says "the compiler may assume P," it is implied that a program which has the property not-P has undefined semantics. \$\endgroup\$– ecatmurCommented Aug 22, 2012 at 15:28
-
\$\begingroup\$ yet the compiler may also assume no side effects when eliding copy constructors. \$\endgroup\$– rubenvbCommented Aug 22, 2012 at 15:33
-
\$\begingroup\$ @rubenvb because that particular case is explicitly mentioned. \$\endgroup\$ Commented Aug 22, 2012 at 15:36
-
1\$\begingroup\$ @BogdanAlexandru your embedded project has undefined behaviour. That means that it might work as you expect now, but when you upgrade your compiler it will behave differently. \$\endgroup\$– ecatmurCommented Oct 12, 2012 at 8:17
\$\begingroup\$
\$\endgroup\$
5
\u\
0000
This has eight characters, and has undefined behaviour, according to §2.2/1.
Each instance of a backslash character (
\) immediately followed by a new-line character is deleted, splicing physical source lines to form logical source lines. Only the last backslash on any physical source line shall be eligible for being part of such a splice. If, as a result, a character sequence that matches the syntax of a universal-character-name is produced, the behavior is undefined.
answered Aug 22, 2012 at 15:17
-
\$\begingroup\$ this isn't & "program". A program has a
main. \$\endgroup\$– rubenvbCommented Aug 22, 2012 at 15:18 -
\$\begingroup\$ @rubenvb Try it on Hell++. It has undefined behaviour, so can be a program without a
main. It's hard to enforce rules when you ask for a program that doesn't have any rules to follow (that's what UB means!). \$\endgroup\$ Commented Aug 22, 2012 at 15:19 -
3\$\begingroup\$ Based on the wording of the question, I think this qualifies -- it asks only for the shortest "code" that displays UB. Based on the "runnable" in the comment, I think the intent, however, was the shortest program, which would rule out your code, because according to §3.6.1/1: "A program shall contain a global function called main, which is the designated start of the program." As such, without
main, what you have is ill-formed. \$\endgroup\$ Commented Aug 22, 2012 at 16:13 -
1\$\begingroup\$ @JerryCoffin He is using a freestanding environment where main is not required. You conveniently left out the rest of §3.6.1/1 which says "It is implementation-defined whether a program in a freestanding environment is required to define a main function.". This is a valid program ("valid" as in it's a "program" according to your argument). \$\endgroup\$– DavidCommented Jan 9, 2015 at 10:04
-
\$\begingroup\$ Dang, just came here to bring that one. +1 \$\endgroup\$– ColumboCommented Apr 24, 2015 at 22:27
\$\begingroup\$
\$\endgroup\$
2
#include. /*Imagine a new-line right after the dot*/
§16.2/4:
A preprocessing directive of the form
#includepp-tokens new-line(that does not match one of the two previous forms) is permitted. [..] If the directive resulting after all replacements does not match one of the two previous forms, the behavior is undefined.
-
\$\begingroup\$ Won't it parse the same if you remove the space before the dot? \$\endgroup\$– feersumCommented Jun 5, 2015 at 21:27
-
\$\begingroup\$ @feersum Yep. That doesn't alter the idea, which is why I avoided it to enhance readability, but I guess it serves the point of the question to illustrate that the space can be omitted. Thanks! \$\endgroup\$– ColumboCommented Jun 5, 2015 at 21:54
\$\begingroup\$
\$\endgroup\$
1
int main(){int i=1>>-1;}
Explanation:
C++98 and C++11 §5.8/1 both state that
The behavior is undefined if the right operand is negative, or greater than or equal to the length in bits of the promoted left operand.
-
3\$\begingroup\$ on a 32-bit system, isnt the length in bits of
inttypically 32? changing the RHS of the shift to-1is the same number of chars and won't depend on integer sizes \$\endgroup\$– ardnewCommented Aug 22, 2012 at 19:42
\$\begingroup\$
\$\endgroup\$
4
If one is to believe wikipedia, here's a few:
Modifying strings is said to cause undefined behavior. It's always worked for me.
int main(int c,char*v){v[0]='.';}
A non-void function with no return causes undefined return values.
int a(){}
int main(){return a();}
Division (of int?) by zero is supposedly undefined. All I know is that it crashes.
int main(int c){c/0;}
-
\$\begingroup\$ These are not legal code snippets. Main must be defined as
int main(){}at the very least. \$\endgroup\$– rubenvbCommented Aug 22, 2012 at 15:14 -
\$\begingroup\$ Damn, I was sure the question was about C. Sorry about that. \$\endgroup\$– shionaCommented Aug 22, 2012 at 18:13
-
1\$\begingroup\$ @shiona the second parameter should be
char **notchar *. You're merely modifying part of a pointer value. In fact,argvis guaranteed to be safely modifiable. \$\endgroup\$– obatakuCommented Sep 9, 2012 at 15:12 -
\$\begingroup\$ The standard allows string literals to be read-only, so many implementations do that. It's correct for
char *argv[]to not have anyconstqualifiers. You could crash by writing into a string literal withint main(){char *v="";*v=1;}\$\endgroup\$ Commented May 15, 2016 at 3:53
\$\begingroup\$
\$\endgroup\$
int main() { int* a; return a[0]; }
