Dangling pointer

Dangling pointers in programming are pointers whose objects have since been deleted or deallocated, without modifying the value of the pointer. In many languages (particularly the C programming language), deleting an object from memory does not alter any associated pointers. The pointer still points to the location in memory where the object or data was, even though the object or data has since been deleted and the memory may now be used for other purposes. A pointer in such a situation is called a dangling pointer.

Using a dangling pointer under the assumption that the object it points to is still valid can cause unpredictable behavior. This is because the program may not terminate as soon as the dangling pointer is used: the data referenced by the dangling pointer may not immediately be reused for other purposes. The use of dangling pointers can also result in the silent corruption of unrelated data. To avoid bugs of this kind, one common programming technique is to set pointers to the null pointer once the storage they point to has been released. When the null pointer is dereferenced the program will immediately terminate — there is no potential for data corruption or unpredictable behavior. This makes the underlying programming mistake easier to find and resolve.

The following example code (in C++) shows a dangling pointer:

#include <iostream>
#include <string>  

using namespace std; // the string object is in the "std" namespace  

int main(void) {
   // create a pointer to a string object containing "This is a string."
   string *stringPointer = new string("This is a string.");
   // display the address of the string and its value
   cout << stringPointer << ": " << *stringPointer << endl;
   // the string has now been deleted; however, stringPointer
   // still points to the string's former location in memory
   delete stringPointer;
   // display the address (unchanged) and the new value; this will
   // likely crash the program or cause unpredictable behaivor
   cout << stringPointer << ": " << *stringPointer << endl;                                                         
   return 0;
}

A dangling pointer (also known as a wild pointer) is a pointer, which does not point to a valid memory location. By validity of a location, we mean that a running process has certain restrictions on accessing memory locations that do not fall under its address space.

A pointer not handled properly can produce serious bugs or a badly behaving program. Dangling pointers get, or can be, created in several ways. The following list gives you an idea about dangling pointers: their sources of creation, methods of prevention and effects in C.

A straightforward example can be the following one:

       {
           char *cp = NULL;
           /* ... */
           {
               char c;
               cp = &c;
           } /* The memory location, which c was occupying, is released here */          
           /* cp here is now a dangling pointer */
       }

In the above, a better solution to avoid the dangling pointer is to make cp a null pointer after the inner block is exited.

The design philosophy of C make a compiler to believe that the programmer knows what he is doing. Though a code analysis tool, like lint, can help in finding potential programming mistakes, it is up to the programmer to ensure a good behaving program. As stated earlier, misapplied pointers can create a badly behaving program. Following paragraph points up an example.

A dangling pointer in a program, by definition, points to a memory location outside the process space. The location pointed to by the dangling pointer may or may not contain a valid object. If modified, the valid object's value will change unexpectedly, distorting the performance of the process owning the object. This condition is called memory corruption. This could lead the system's state into a vicious circle, crashing it ultimately.

A clear-cut technique to avoid dangling pointers is to initialize them to NULL, whenever they are declared and no more required.

A common programming misstep to create a dangling pointer is returning the address of a local variable.

       char * func ( void )
       {
           char ca[] = "Pointers and Arrays - II";
           /* ... */
           return ca;
       }

In the above, if it is required to return the address of ca, declare it with the static storage specifier.

A frequent source of creating dangling pointers is a jumbled combination of malloc() and free() library calls. A pointer becomes dangling, when the block of memory pointed it is freed.

       #include <stdlib.h>
       {
           char *cp = malloc ( A_CONST );
           /* ... */
           free ( cp );      /* cp now becomes a dangling pointer */
           cp = NULL;        /* cp is no longer dangling */
           /* ... */
       }

For more information on pointers in C, visit: Pointers and Arrays (C99)