Exercises — Pointer to pointer

• x holds the integer 42.
• p holds &x = 0x100 (the address of x).
• pp holds &p = 0x200 (the address of p).

Why. A variable's box stores its value. For a pointer, that value happens to be an address. pp is a pointer to a pointer, so the value in its box is the address of another pointer (p). Since p lives at 0x200, pp holds 0x200.

Answer: (b) char **c. Why. Count the asterisks. One * = pointer to char. Two * = pointer to (pointer to char) = pointer to a pointer. (d) has three *, one level too many. (a) is a single pointer, (c) is an array.

• pp = 0x200 — the address it holds (address of p).
• *pp = p = 0x100 — follow one arrow: land on p, read its value (&x).
• **pp = x = 42 — follow two arrows: through p to x, read 42.

Why. Each * "peels a layer" — follow the address to the thing it points at. Two * peels twice, landing on the integer.

Why. & wraps (adds a level, gives an address): &pp is the address of pp. From the snapshot pp lives at 0x300, so &pp = 0x300, and its type gains a star → int ***. * peels (removes a level): *pp is int * (0x100), **pp is int (42). Star peels, ampersand wraps.

• x = 7 (changed).
• p = 0x100 (unchanged — still points to x).
• pp = 0x200 (unchanged — still points to p).

Why. The left side **pp peels two layers, so it names the integer x. We wrote to that innermost box only. The pointers along the way were used to navigate, not overwritten.

• After line 1: *p names x, so x = 20. p still 0x100.
• After line 2: **pp also names x, so x = 30. p still 0x100.
• After line 3: *pp names p (one peel), so p = NULL (0x0). x unchanged at 30.

Why. Lines 1 and 2 reach x by different roads but the same destination — both write the integer. Line 3 uses one star, landing on the pointer p and overwriting it. The chain pp → p → x is now broken at p.

Undefined behaviour (UB) — almost certainly a crash. Why. **pp = *(*pp) = *(p). But p is now NULL. Dereferencing NULL reads memory that isn't yours → segmentation fault (typical). The first peel (*pp = p = NULL) is fine; the second peel dereferences that NULL. Each link in a ** chain must point somewhere valid.

pp has type int **, i.e. it points to objects of type int *. See Pointer arithmetic: pp + 1 advances by sizeof(int *) = 8 bytes, giving 0x200 + 8 = 0x208. Why. Pointer arithmetic steps in units of the pointed-to type's size, not bytes. pp points to int * objects (8 bytes each), so +1 moves 8 bytes forward — to where the next pointer would sit if p were part of an array of pointers.

Edge-case caveat (important). The C standard only defines pointer arithmetic within a single array object, plus one slot past its end (the "one-past-the-end" address, which you may form but must not dereference). Here p is a lone variable, not an array element, so forming pp + 1 and especially dereferencing it is formally undefined behaviour (UB) — even though the address computation 0x208 is what a typical machine would produce. The arithmetic is only legitimate when pp genuinely points into an array of int * (e.g. char **argv, or a malloc'd block of pointers).

#include <stdio.h>    // printf, NULL
#include <stdlib.h>   // malloc, NULL
 
void alloc_int(int **ptr) {
    *ptr = malloc(sizeof(int));   // blank A: *ptr IS the caller's q
    if (*ptr == NULL) return;     // malloc can fail → bail out, leave q == NULL
    **ptr = 100;                  // blank B: safe now, write into the new memory
}

Output on success: 100. Why the includes? malloc is declared in <stdlib.h>; printf in <stdio.h>. The macro NULL is defined in <stddef.h> and is also pulled in by <stdio.h> and <stdlib.h> — so including either of those is enough for NULL here. Reproduce the example without these #include lines and the compiler will complain about undeclared malloc/printf or an unknown NULL. Why the double star? See Pass by value vs pass by reference: C copies arguments, so to change the caller's pointer q we pass its address (&q, type int **). Inside, *ptr names q itself → assigning the malloc result to *ptr updates q. Why the NULL check? See Dynamic memory allocation (malloc): malloc returns NULL when memory cannot be allocated. If we skip the check and memory ran out, *ptr is NULL, so **ptr = 100 dereferences NULL → undefined behaviour (UB) / crash. Robust pointer code always checks the malloc result before the second peel writes through it.

• argc → 3 (program name + two args).
• argv[0] → "./prog" (the program name).
• *(argv + 1) → "cat" (the string pointer at index 1).
• **(argv + 2) → 'd' (first char of "dog").

Why. See Command line arguments (argv): argv is char ** — a pointer to an array of char * strings. argv + 2 steps to the third slot (by sizeof(char *)); one * gives the string pointer "dog"; a second * peels to its first character 'd'. (Note this arithmetic is well-defined: argv genuinely points into an array of char *.)

void swap_ptrs(int **a, int **b) {
    int *tmp = *a;   // save p1's target
    *a = *b;         // p1 now points where p2 did
    *b = tmp;        // p2 now points where p1 did
}

After the call: p1 points to v (so *p1 == 2), p2 points to u (so *p2 == 1). Why. We want to change the pointers themselves, so we pass their addresses (int **). Inside, *a is the caller's p1; assigning to *a retargets p1. u and v are never moved — only which arrow points where changes.

Invalid — type mismatch. In most expressions arr decays to int * (a temporary pointer to the first element). But here arr is the operand of unary &, and array-to-pointer decay does not happen in the operand of & — one of the few exceptions to the decay rule. So &arr keeps the array type intact and has type int (*)[3] (pointer to array of 3 ints), not int **. Why it can't be int **. See 2-D arrays vs pointer to pointer. A real int ** must point to an actual int * object that lives somewhere in memory. An array's name is not a stored pointer — it's an address computed on the fly — so there is no pointer object to take a two-level address of. The correct two-level setup needs an intermediate pointer variable: int *ip = arr; int **pp = &ip; (now ip is a genuine int * that lives in memory, and &ip is a real int **).

• A (char *rows_a[2]): rows_a[1][0] = *(*(rows_a + 1) + 0). Two dereferences: first follow the pointer stored in slot 1 (to the string "yo"), then read its first char 'y'. This is the genuine double-indirection model — like char **.
• B (char rows_b[2][3]): rows_b[1][0] = one address computation base + 1*3 + 0, then a single read. No stored pointers exist; the address is computed by multiplying, not by following an arrow.

Both yield 'y', but A follows a pointer while B computes an offset. That is the core 2-D array vs pointer to pointer distinction. See 2-D arrays vs pointer to pointer.

Why. In A, rows_a is an array of two char * values; those pointers really sit in memory. To reach a character you must read a stored pointer first (peel one), then read a char through it (peel two) — genuine double indirection. In B, rows_b is 2*3 = 6 chars laid out contiguously with no pointers anywhere; [1][0] is turned by the compiler into the single offset 1*3 + 0 = 3 from the base, so exactly one memory read happens. The [i][j] syntax looks identical, but A costs two follows while B costs one computed index — that is why the two types are not interchangeable.

• Line 1: *pp names p, so p = NULL. x still 42.
• Line 2: **pp = *(*pp) = *(NULL) → UB (undefined behaviour) / crash (writing through a NULL pointer). x is never reached.

Final: x remains 42 (if it survived); the program has undefined behaviour at line 2. Why. Line 1 broke the chain at p. Line 2 must peel through p to reach x, but p is now NULL, so the second peel dereferences NULL. Order matters: a valid-looking **pp becomes deadly once an inner link is nulled.

• Got L1–L2 clean → you can read and dereference chains.
• Got L3 → you understand which level a write hits and broken chains.
• Got L4 → you can write ** code (functions, argv, swaps).
• Got L5 → you grasp UB ordering and the array-vs-** layout gap. Mastery.