Null termination of char array

Question

Consider following case:

#include<stdio.h>
int main()
{
    char A[5];
    scanf("%s",A);
    printf("%s",A);
}

My question is if char A[5] contains only two characters. Say "ab", then A[0]='a', A[1]='b' and A[2]='\0'. But if the input is say, "abcde" then where is '\0' in that case. Will A[5] contain '\0'? If yes, why? sizeof(A) will always return 5 as answer. Then when the array is full, is there an extra byte reserved for '\0' which sizeof() doesn't count?

Answer 1

There isn't a character that is reserved, so you must be careful not to fill the entire array to the point it can't be null terminated. Char functions rely on the null terminator, and you will get disastrous results from them if you find yourself in the situation you describe.

Much C code that you'll see will use the 'n' derivatives of functions such as strncpy. From that man page you can read:

The strcpy() and strncpy() functions return s1. The stpcpy() and stpncpy() functions return a pointer to the terminating `\0' character of s1. If stpncpy() does not terminate s1 with a NUL character, it instead returns a pointer to s1[n] (which does not necessarily refer to a valid mem- ory location.)

strlen also relies on the null character to determine the length of a character buffer. If and when you're missing that character, you will get incorrect results.

Answer 2

If you type more than four characters then the extra characters and the null terminator will be written outside the end of the array, overwriting memory not belonging to the array. This is a buffer overflow.

C does not prevent you from clobbering memory you don't own. This results in undefined behavior. Your program could do anything—it could crash, it could silently trash other variables and cause confusing behavior, it could be harmless, or anything else. Notice that there's no guarantee that your program will either work reliably or crash reliably. You can't even depend on it crashing immediately.

This is a great example of why scanf("%s") is dangerous and should never be used. It doesn't know about the size of your array which means there is no way to use it safely. Instead, avoid scanf and use something safer, like fgets():

fgets() reads in at most one less than size characters from stream and stores them into the buffer pointed to by s. Reading stops after an EOF or a newline. If a newline is read, it is stored into the buffer. A terminating null byte ('\0') is stored after the last character in the buffer.

Example:

if (fgets(A, sizeof A, stdin) == NULL) {
    /* error reading input */
}

Annoyingly, fgets() will leave a trailing newline character ('\n') at the end of the array. So you may also want code to remove it.

size_t length = strlen(A);
if (A[length - 1] == '\n') {
    A[length - 1] = '\0';
}

Ugh. A simple (but broken) scanf("%s") has turned into a 7 line monstrosity. And that's the second lesson of the day: C is not good at I/O and string handling. It can be done, and it can be done safely, but C will kick and scream the whole time.