CS50x: Introduction to Computer Science Memory Syllabus

Why must you always check whether malloc returned NULL before using the pointer?

If the system is out of memory, malloc returns NULL. Dereferencing that NULL pointer causes a segmentation fault, so the program should detect NULL and handle the failure (e.g., return an error) instead.

What does realloc(ptr, newSize) do?

It resizes a previously allocated heap block to newSize bytes. It may move the block to a new location — copying the old data over automatically — and returns a pointer to the (possibly new) block, or NULL on failure.

How do you correctly allocate space on the heap for an array of $n$ integers, and why use sizeof?

int *arr = malloc(n * sizeof(int)); Using sizeof(int) makes the code portable, since the size of int can differ across systems, and the total bytes needed is $n \times \text{sizeof(int)}$.

What is the difference between malloc and calloc?

malloc(size) allocates uninitialized memory (garbage values); calloc(n, size) allocates memory for $n$ elements of the given size and zero-initializes every byte.

What is a call stack?

The runtime structure that tracks active function calls: each time a function is called, a stack frame holding its parameters and local variables is pushed on top; when the function returns, its frame is popped off.

In call-stack terminology, what is the 'active' frame, and what state are the frames below it in?

The frame on top of the stack — the currently executing function — is active. All frames beneath it are paused, waiting for the functions above them to return before resuming.

What happens to a function's local variables when that function returns?

Its stack frame is popped and that memory is reclaimed for reuse by future calls. The local variables cease to exist, and any pointers to them become invalid (dangling).

Why is it a bug to return a pointer to a local (stack) variable from a function, and what is the standard fix?

The local variable lives in the function's stack frame, which is destroyed on return, leaving a dangling pointer to reclaimed memory. Fix: allocate the data on the heap with malloc so it outlives the function.

How does recursion interact with the call stack, and what does each recursive call contribute?

Each recursive call pushes a new, separate stack frame with its own copies of the parameters and locals. Frames pop in reverse order as base cases return; unbounded recursion exhausts the stack (stack overflow).

What is a buffer overflow?

Writing (or reading) past the end of a buffer — a region of memory such as an array — thereby touching adjacent memory. It can corrupt data, crash the program, or be exploited by attackers to hijack control flow.

Why are functions like strcpy or scanf with %s into a fixed-size array considered dangerous?

They copy input without checking the destination's size, so input longer than the buffer overflows it and overwrites neighboring memory. Safer alternatives bound the length (e.g., fgets, or a width like %9s for a 10-char buffer).

Distinguish a buffer overflow from a stack overflow.

Buffer overflow: writing beyond the bounds of a specific array/buffer (on stack or heap). Stack overflow: the entire call stack outgrowing its allotted region, typically from deep recursion. Both 'overflow' memory boundaries but at different scales.

What does the typedef keyword do in C? Give the general syntax.

It creates an alias (a new name) for an existing type: typedef old_type new_name; For example, typedef unsigned char BYTE; lets you write BYTE instead of unsigned char.

What is a struct in C and how do you combine it with typedef to define a custom type like a person with a name and number?

A struct groups related variables (members) into one type. Example: typedef struct { string name; string number; } person; — after which person p; declares one, with members p.name and p.number.

How do you access a member of a struct through a pointer, and what is the equivalent longhand form?

With the arrow operator: p->member. It is exactly equivalent to (*p).member — dereference the pointer first, then access the member with the dot operator.

How is CS50's string type actually defined, and what does that reveal about strings in C?

typedef char *string; — a string is really just a char *, a pointer to the first character of a null-terminated ($\backslash 0$-terminated) sequence of characters in memory.

What does fopen do, and what do the modes "r", "w", and "a" mean?

fopen(filename, mode) opens a file and returns a FILE * used for all subsequent operations (NULL on failure). "r" = read; "w" = write (truncates/creates the file); "a" = append (writes are added at the end).

Why must you call fclose on every file you fopen, and why check fopen's return value first?

fclose flushes buffered data to disk and releases the FILE resource — forgetting it can lose data and leak resources. fopen returns NULL if the file can't be opened, and using a NULL FILE * crashes the program.

What are the four arguments of fread, in order?

fread(buffer, size, quantity, file): (1) a pointer to where the data goes, (2) the size in bytes of each element, (3) how many elements to read, (4) the FILE * to read from. It returns the number of elements actually read.

What do fprintf and fwrite do, and how do they differ?

Both write to a file via a FILE *. fprintf writes formatted text (like printf but to a file); fwrite(buffer, size, quantity, file) writes raw binary bytes from memory, with no formatting.

How can a program detect a file's format from its first bytes, using JPEG as an example?

By checking its signature ('magic number'): the first bytes of a JPEG are $\text{0xff}$, $\text{0xd8}$, $\text{0xff}$, and the fourth byte is $\text{0xe0}$ through $\text{0xef}$. File formats begin with characteristic patterns that identify them.

How is a single pixel represented in a 24-bit BMP image?

As three bytes — $8$ bits each — for the blue, green, and red channels, stored in BGR order. Each channel value ranges from $0$ to $255$, giving $2^{24} \approx 16.7$ million possible colors.

In hexadecimal color notation, what color is 0x0000FF interpreted as RGB, and why?

Pure blue: the red byte is $\text{0x00} = 0$, the green byte is $\text{0x00} = 0$, and the blue byte is $\text{0xFF} = 255$ (maximum intensity).

When copying or filtering a BMP file, why must a program handle the file's headers before the pixel data?

A BMP begins with metadata headers (BITMAPFILEHEADER and BITMAPINFOHEADER) describing the file type, size, width, and height. The program must read/copy these first, then process the pixel bytes that follow — otherwise the output file is malformed.

What is Valgrind and when do you use it?

A command-line tool that runs your program and analyzes its memory usage, detecting memory leaks and invalid memory accesses (e.g., out-of-bounds reads/writes) that might not cause visible crashes. Run it as: valgrind ./program.

In a Valgrind report, what does an 'Invalid write of size 4' message indicate?

The program wrote $4$ bytes (e.g., one int) to memory it doesn't own — typically writing one element past the end of a heap-allocated int array (an off-by-one / heap buffer overflow).

In Valgrind's leak summary, what does memory that is 'definitely lost' mean?

Heap memory that was allocated but never freed, and to which no pointer remains at program exit — a genuine memory leak the programmer should fix by adding the missing free.

What is a memory leak?

Heap memory that a program allocates (via malloc, etc.) but never frees. The memory stays reserved and unusable; in long-running programs, accumulating leaks can exhaust available memory and degrade or crash the system.

What is the fundamental discipline for preventing memory leaks in C?

Every allocation must be paired with exactly one deallocation: each malloc/calloc/realloc'd block must eventually be passed to free exactly once, before the last pointer to it is lost or goes out of scope.

Contrast a memory leak, a dangling pointer (use-after-free), and a double free.

Leak: allocated memory is never freed (wasted memory). Dangling pointer: memory is freed but then still accessed — undefined behavior, often a segfault. Double free: the same block is freed twice, corrupting the allocator's state. Leaks waste memory; the other two are invalid operations on freed memory.