Memory and Addresses: Every Box Has a Number

Maria has typed scanf("%d", &n) for eight modules, and she still asks the question Module 3 left open. Why does scanf need that ampersand, when printf never does? Module 3 said it hands over an address, but nobody has shown her one. This lesson prints real ones, from two runs of the Playground, and then answers her in one sentence.

Memory is a row of numbered bytes

A byte is 8 bits, the unit sizeof counts in (Module 2 lesson 5). A running program's memory is a very long row of bytes. Each byte has a number, its position in the row, called its address.

A variable takes as many bytes as its type needs, side by side. Its address is the address of its first byte. Module 2 lesson 1 printed three addresses from one run and promised nothing about them. This lesson measures them.

So every variable has three facts: its value, its size, and its address.

The address-of operator gives a variable's address

An ampersand in front of a variable's name gives its address. The & is the address-of operator, and &a reads "the address of a". It works on anything that names a box: a variable, or one box such as &marks[2].

printf("%p\n", (void *)&name);

Hexadecimal is Module 1 lesson 4's base 16: after 9 come a to f, worth 10 to 15. The 0x marks it, as in Module 3 lesson 1.

Here is a program that prints seven addresses: three variables, then the four boxes of an array.

#include <stdio.h>

int main(void)
{
    int a = 1;
    int b = 2;
    double d = 3.0;
    int marks[4] = {70, 80, 90, 60};

    printf("&a = %p\n", (void *)&a);
    printf("&b = %p\n", (void *)&b);
    printf("&d = %p\n", (void *)&d);
    for (int i = 0; i < 4; i++) {
        printf("&marks[%d] = %p\n", i, (void *)&marks[i]);
    }
    printf("%d %d %.1f %d\n", a, b, d, marks[0]);
    return 0;
}

Trace it first. This table's addresses are made up, small and in decimal, so that you can read them. The real ones are hexadecimal and change every run.

The last line prints 1 2 3.0 70 on every run. Only the seven addresses move.

So &x is a number: the address of the first byte of x.

Two runs on the Playground: new numbers, same distances

Here are two runs of that program on the Playground, with nothing changed between them. The last column is each address's distance from &a, in bytes.

To read a distance, compare the last digits. bc0 to bc4 is 4. bc8 to bd0 is 8, because after c8 come c9, ca to cf, then d0. And c is 12, so bd8 to bdc is 4.

Every address changed; every distance stayed. The cause is ASLR, address space layout randomisation. On each run, the system starts the program's memory at a random spot. So a printed address is true only for the run that printed it.

The distances hold two kinds of fact. The step of 4 inside marks is a rule of C, because an array's boxes are contiguous (Module 9 lesson 01). The order of a, b and d is only GCC's choice. Module 2 lesson 1's run put its three ints in falling order, and that was allowed too.

So compare addresses inside one run, never across two.

An array steps by sizeof one box

Module 9 lesson 01 promised that Module 11 would print where box i starts. The runs above did: the boxes of marks sit 4 bytes apart. The step is sizeof marks[0], the size of one box.

The step depends on the type. One Playground run of a program printing box 0 and box 1 of four small arrays gave this.

That run's sizeof line said 4, 1, 8 and 8, the same as the steps. It also gave the size of an address itself: 8 bytes, whatever it leads to.

So box i starts i times sizeof one box after box 0, and that is how the machine finds marks[i].

The memory picture: code, the static area and the stack

Module 7 lesson 5 promised a proper drawing of memory. Here it is, for a program on the Playground's Linux, with the lowest addresses at the bottom.

The code is your program's instructions. The static area holds globals and static locals for the whole run (Module 7 lesson 5). The stack holds one frame per running call, with its parameters and locals.

Module 8 drew the newest frame on top of the pile. In addresses it sits lower, because the stack grows downwards (Module 8 lesson 02). The heap, memory asked for while the program runs, is Module 14.

Every address in this lesson starts with 0x7ff, because a, b, d and marks are locals of main, and Linux puts the stack there. At -O2 GCC keeps many locals in registers (Module 7 lesson 5). A printed address, though, must lead to a real box.

So a local lives in its call's frame on the stack, and a global or static in the static area.

A pointer is a variable that holds an address

An address is a number, so a variable can hold one. A variable that holds an address is a pointer. If it holds &score, it points at score.

Addresses have types. For int score, &score has the type int *, read "pointer to int". That is a pointer type. So GCC's 'int *' in Module 9 and the char * of string.h in Module 10 were addresses all along.

Lesson 02 declares pointers and reads through them. The shape, for now: int *where = &score; makes a pointer where that holds the address of score.

So &score is an address of type int *, and a pointer keeps one.

Why scanf needs the ampersand

Now Maria's question. A call copies each argument's value (Module 7 lesson 3), and writing into a copy changes nothing. scanf must write into your variable, so it needs to know where the variable lives. &age tells it.

#include <stdio.h>

void set_to_31(int n);

int main(void)
{
    int age = 0;

    set_to_31(age);
    printf("after set_to_31: age = %d\n", age);
    scanf("%d", &age);
    printf("after scanf:     age = %d\n", age);
    return 0;
}

void set_to_31(int n)
{
    n = 31;
    printf("inside set_to_31: n = %d\n", n);
}

Trace it for the input 27, with a made-up address for age.

inside set_to_31: n = 31
after set_to_31: age = 0
after scanf:     age = 27

That output is for the input 27. set_to_31 changed its own copy. scanf got the address of age and wrote 27 into the box there. That answers Module 7 lesson 3's teaser too: scanf has always changed your variables through their addresses. Lesson 04 shows you how to write such a function.

Module 3 lesson 4 named one exception: scanf("%19s", word) has no ampersand. Module 9 lesson 05 said a function handed an array gets where its boxes are. That value now has its name: the address of box 0. This program prints it three ways.

#include <stdio.h>

#define BOXES 3

void show_where(int a[], int n);

int main(void)
{
    int marks[BOXES] = {40, 55, 72};

    printf("main:       marks     = %p\n", (void *)marks);
    printf("main:       &marks[0] = %p\n", (void *)&marks[0]);
    show_where(marks, BOXES);
    return 0;
}

void show_where(int a[], int n)
{
    printf("show_where: a         = %p, n = %d\n", (void *)a, n);
}

Trace it with made-up addresses. The frame of show_where sits lower than main's.

One run on Compiler Explorer printed the same address on all three lines. Your number will differ, and your three lines will still match. The parameter a holds the address of marks[0], which is how Module 9's functions reached main's boxes.

So the ampersand rule never broke: & asks where a box lives, and an array's name already says it. Module 3's scanf("%d", roll) passed the number inside roll, and scanf treated it as an address.

#include <stdio.h>

#define BOXES 4

int main(void)
{
    int score = 87;
    double price = 7.5;
    char grade = 'B';
    int marks[BOXES] = {70, 80, 90, 60};

    printf("what      bytes\n");
    printf("score     %5zu\n", sizeof score);
    printf("price     %5zu\n", sizeof price);
    printf("grade     %5zu\n", sizeof grade);
    printf("marks     %5zu\n", sizeof marks);
    printf("&score    %5zu\n", sizeof &score);
    return 0;
}

what      bytes
score         4
price         8
grade         1
marks        16
&score        8

#include <stdio.h>

#define MARKS 4
#define PRICES 3

int main(void)
{
    int marks[MARKS] = {70, 80, 90, 60};
    double prices[PRICES] = {1.5, 2.5, 3.5};

    for (int i = 0; i < MARKS; i++) {
        printf("marks[%d]  starts %2zu bytes after marks[0]\n", i, i * sizeof marks[0]);
    }
    for (int i = 0; i < PRICES; i++) {
        printf("prices[%d] starts %2zu bytes after prices[0]\n", i, i * sizeof prices[0]);
    }
    return 0;
}

marks[0]  starts  0 bytes after marks[0]
marks[1]  starts  4 bytes after marks[0]
marks[2]  starts  8 bytes after marks[0]
marks[3]  starts 12 bytes after marks[0]
prices[0] starts  0 bytes after prices[0]
prices[1] starts  8 bytes after prices[0]
prices[2] starts 16 bytes after prices[0]

#include <stdio.h>

#define MAX_N 50

int main(void)
{
    char name[20] = {0};
    int n = 0;
    int marks[MAX_N] = {0};
    int total = 0;

    scanf("%19s", name);
    scanf("%d", &n);
    for (int i = 0; i < n; i++) {
        scanf("%d", &marks[i]);
        total += marks[i];
    }

    printf("%s: %d marks, total %d\n", name, n, total);
    printf("first %d, last %d\n", marks[0], marks[n - 1]);
    return 0;
}

Amara: 5 marks, total 356
first 70, last 48

int score = 87;

printf("%d\n", &score);

printf("%p\n", &score);

printf("%p\n", (void *)&60);
printf("%p\n", (void *)&(score + 1));

char name[20] = {0};

scanf("%19s", &name);

#include <stdio.h>

#define BOXES 5

int main(void)
{
    int seats = 40;
    double price = 7.5;
    char row = 'C';
    int stock[BOXES] = {12, 0, 7, 3, 25};

    /* Print the address of seats, price and row, one per line.
       Then print the address of every box of stock, and
       sizeof stock[0]. Which step do you read between the boxes? */

    return 0;
}

#include <stdio.h>

int main(void)
{
    char letters[2] = {'a', 'b'};
    short years[2] = {2025, 2026};
    int seats[2] = {40, 42};
    long long views[2] = {1000000000000, 2000000000000};
    double prices[2] = {7.5, 9.25};

    /* For each array, print on one line: the type, sizeof one box,
       and the addresses of box 0 and box 1. Before you run it,
       write the step you expect for each type in a comment. */

    return 0;
}

Next, Bob writes int *p; and then *p = 5;, and asks where his 5 went. Lesson 02 declares a pointer properly and follows it to its box.