String handling — char arrays, null terminator, strcpy, strcat, strlen, sprintf (dangers)

5.1.20 · Coding › C Programming

C string KYA hota hai?

char s[6] = "Hello";   //  H  e  l  l  o  \0   <- 6 bytes used

Figure — String handling — char arrays, null terminator, strcpy, strcat, strlen, sprintf (dangers)

strlen — scratch se samjho

Formula strlen, haath se banaya hua

size_t my_strlen(const char *s) {
    size_t n = 0;          // counter
    while (s[n] != '\0')   // terminator PE ruk jaao
        n++;               // is char ko count karo, agle pe jao
    return n;              // n = '\0' se pehle wale chars
}

!= '\0' kyun? Terminator hi signal hai rokne ka. n return kyun karte hain (n+1 nahi)? Length mein terminator nahi aata. String "Hi" ki length $2$ hai lekin yeh $3$ bytes occupy karta hai.

strcpy — terminator samet copy karo

Formula strcpy, haath se banaya hua

char *my_strcpy(char *dst, const char *src) {
    size_t i = 0;
    while ((dst[i] = src[i]) != '\0')  // byte copy karo, phir test karo
        i++;
    return dst;   // '\0' bhi copy ho gaya (last assignment mein)
}

Loop body copy kyun karta hai? dst[i] = src[i] ek expression hai jiska value copied char hai. Yeh '\0' bhi copy kyun karta hai? Jab src[i] '\0' hota hai, tab bhi hum dst[i] = '\0' execute karte hain test fail hone se pehle — toh terminator dst mein aa jaata hai, phir hum ruk jaate hain. Bina iske, dst ek unterminated array hoga = garbage.

strcat — append karo, lekin pehle end dhundho

Formula strcat, haath se banaya hua

char *my_strcat(char *dst, const char *src) {
    size_t i = 0, j = 0;
    while (dst[i] != '\0') i++;          // 1) dst ke terminator tak jao
    while ((dst[i++] = src[j++]) != '\0'); // 2) src (incl '\0') wahan copy karo
    return dst;
}

dst ka purana '\0' overwrite kyun karte hain? Yeh gayab hona chahiye taaki dono strings ek ban jayein. src ka naya '\0' joined string ka terminator ban jaata hai. Cost: strcat sirf spot dhundhne mein $O (len_{d s t})$ lagata hai — loop mein baar baar strcat karna quadratic "Shlemiel the painter" bug hai.

sprintf — formatted writing, aur kyun yeh dangerous hai

Common mistake sprintf ko buf ki size ka BILKUL idea nahi hota

Kyun sahi lagta hai: Yeh clean lagta hai: sprintf(buf, "%d-%s", id, name);. Khatre: aapne buf aur ek format pass kiya, lekin buf ki size kabhi nahi di. Agar formatted text buf se lamba hai, toh sprintf khushi khushi overflow kar deta hai — classic exploit vector. Ek akela %f 300+ chars produce kar sakta hai. Fix: HAMESHA bounded version use karo:

snprintf(buf, sizeof buf, "%d-%s", id, name);  // ≤ sizeof buf likhta hai, hamesha terminate karta hai

snprintf overflow karne ki jagah truncate karta hai aur guarantee karta hai ek '\0' (jab tak size > 0 hai).

Worked example

sizeof buf sirf arrays par kyun kaam karta hai

char buf[64];
snprintf(buf, sizeof buf, "x=%d", x);  // sizeof buf == 64  ✔

Yeh step kyun? Ek real array par sizeof uska byte count deta hai. Lekin agar buf ek char * parameter hai, toh sizeof buf pointer size (8) deta hai, buffer nahi — ek subtle bug. Function boundaries ke paas size explicitly pass karo.

Forecast-then-Verify

Flashcards

C string ka end kya mark karta hai?

Null terminator byte '\0' (value 0).

String "Hi" kitne bytes occupy karta hai?

3 — do chars aur ek '\0'.

strlen "Hello" ke liye kya return karta hai?

5 — yeh '\0' se PEHLE wale chars count karta hai, terminator nahi.

strlen O(n) kyun hai?

char* mein koi length store nahi hoti, isliye '\0' tak byte-by-byte scan karna padta hai.

strcpy kya copy karta hai jise beginners bhool jaate hain?

Yeh '\0' bhi copy karta hai, isliye dst ko len+1 bytes chahiye.

strcat ke liye dst mein strlen(dst)+strlen(src)+1 kyun hona chahiye?

Dono strings plus ek final '\0' fit karne ke liye.

strcat dst mein kaun sa ek byte overwrite karta hai?

dst ka purana '\0', taaki dono strings join ho jayein.

sprintf dangerous kyun hai?

Ise buf ki size kabhi pata nahi hoti aur agar output lamba ho toh overflow kar deta hai.

sprintf ka safe replacement kya hai?

snprintf(buf, sizeof buf, ...) — bounded hai aur hamesha terminate karta hai.

sizeof buf buffer size kyun nahi de paata?

Agar buf ek char* parameter hai, toh sizeof pointer size (8) deta hai, array nahi.

C mein agar aap array ke end ke baad likhte ho toh kya hota hai?

Undefined behaviour — koi bounds check nahi; crash ho sakta hai ya exploit ho sakta hai.

Recall Feynman: ek 12-saal ke bacche ko samjhao

Socho ek row of mailboxes hai, har ek mein ek letter hai, milke ek word banta hai. Koi sign nahi hai ki word kitna lamba hai. Toh hum last letter ke baad ek special "STOP" mailbox (ek khali wala) rakhte hain. Word padhne ke liye aap saamne se shuru karo aur chalte raho jab tak STOP na mile. Kisi word ko copy karna matlab hai har letter aur STOP box ko boxes ki nayi row mein copy karna. Khatre: agar aapki nayi row mein sirf 5 boxes hain lekin word + STOP ko 6 chahiye, toh aap apne neighbour ke box mein likh dete ho — aur C mein koi nahi rokta. Woh neighbour ka mailbox bug hi buffer overflow hai.

Connections

Pointers in C — ek string bas ek char * / decayed array hai.
Arrays vs Pointers — sizeof arrays aur parameters ke liye kyun alag hota hai.
Buffer Overflow & Memory Safety — security consequence.
Undefined Behaviour in C — C bounds ke bahar likhne kyun deta hai.
printf format specifiers — sprintf/snprintf %d %s %f share karte hain.
Time Complexity — strlen/strcat $O (n)$ hain; repeated strcat $O (n^{2})$ hai.