What is undefined behavior in C?

Undefined behavior (UB) in C is code for which the language standard places no requirements. When a program executes it, the compiler may produce a crash, a wrong result or a program that seems to work, and it may change between compiler versions or optimization levels. Common causes are signed integer overflow, dereferencing a null or dangling pointer and reading outside an array.

Why it matters

The compiler assumes that your program never triggers UB, and it optimizes under that assumption. If a check can only be true after an overflow, the compiler is allowed to remove the check. A bug can therefore stay hidden at -O0 and show up at -O2, as described on gcc -O2 optimization levels. A crash such as a segmentation fault is one possible result of UB, and it is the lucky one, because it is visible.

Common sources

Catch it with the sanitizer

GCC and Clang can add run-time checks with -fsanitize=undefined. The next program adds one to INT_MAX when run with no arguments, which is signed overflow.

cat > ub.c <<'CODE'
#include <limits.h>
#include <stdio.h>
int main(int argc, char **argv) {
    (void)argv;
    int x = INT_MAX;
    x = x + argc;
    printf("%d\n", x);
    return 0;
}
CODE
gcc -fsanitize=undefined -o ub ub.c && ./ub

ub.c:6:7: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
-2147483648

The sanitizer prints a line of the form file:line:column: runtime error: ... with the operation and the types involved, then lets the program continue unless you add -fno-sanitize-recover. It reports only the code that runs, so it needs tests that reach the faulty path. Warnings from -Wall -Wextra (gcc -Wall -Wextra) catch the cases the compiler can prove at build time.

How to avoid it

• Check a value before an arithmetic operation that could overflow, or use unsigned types where wrapping is intended.
• Initialize every variable and check the result of every allocation, as covered in malloc vs calloc.
• Keep array indices inside the bounds, and pass lengths with pointers.
• Run tests with the sanitizer on in CI, in a separate build from the one you ship.
• Do not rely on "it works on my machine": UB is a property of the code, not of one run.

FAQ