C Programming For Beginners

"C is the only language that gives you complete control and doesn't hide anything from you. That's why it's still the king of systems programming after 50 years."

"The key to C's longevity is that it's the only language that's both high-level enough to be productive and low-level enough to be honest about what the computer is doing."

hello: hello.o
    gcc hello.o -o hello
    
hello.o: hello.c
    gcc -c hello.c -o hello.o

add_executable(hello hello.c)
target_compile_options(hello PRIVATE -Wall)

rule cc
  command = gcc -c $in -o $out

build hello.o: cc hello.c

// Writing struct to file
struct data {
    uint32_t id;
    uint16_t len;
    char buf[100];
};

// Wrong: writes native order
fwrite(&d, sizeof(d), 1, file);

// Correct: convert each field
uint32_t net_id = htonl(d.id);
uint16_t net_len = htons(d.len);
fwrite(&net_id, 4, 1, file);
fwrite(&net_len, 2, 1, file);
fwrite(d.buf, 100, 1, file);

Processes on same machine: OK (same endianness)

Processes on different machines via network: must convert!

Cross-platform shared memory files need explicit endianness markers.

struct {
    uint16_t a:4;
    uint16_t b:4;
    uint16_t c:8;
} bits;

// Order of bit fields is implementation-defined!
// Don't use for portable data exchange.

struct bad_packed {
    char c;      // 1 byte
    // 3 bytes padding (to align int)
    int i;       // 4 bytes
    short s;     // 2 bytes
    // 2 bytes padding (to align next struct)
};

// sizeof(struct bad_packed) = 12 bytes
// Only 7 bytes of data, 5 bytes wasted!

[c][pad][pad][pad][i][i][i][i][s][s][pad][pad]

struct good_packed {
    int i;       // 4 bytes
    short s;     // 2 bytes
    char c;      // 1 byte
    // 1 byte padding (to align next struct)
};

// sizeof(struct good_packed) = 8 bytes
// Only 1 byte wasted!

[i][i][i][i][s][s][c][pad]

// Instead of multiply...
int x = y * 8;

// Compiler generates shift
int x = y << 3;  // Same result, faster

// Multiply by 10
int x = y * 10;
// Optimized to:
int x = (y << 3) + (y << 1);

// Instead of divide...
int x = y / 8;

// Compiler uses shift
int x = y >> 3;  // But only for unsigned!

// For signed, more complex:
// x/10 optimized to multiply by magic
// constant and shift

// Expensive operations replaced
// with cheaper ones

x = y % 8;     // Becomes x = y & 7
x = y * 2 + 1; // Becomes x = (y << 1) | 1
x = y / 2;     // Becomes x = y >> 1 (unsigned)

// Set bit n (0-based)
x |= (1 << n);

// Example: set bit 3
x |= (1 << 3);

// Set multiple bits
x |= (bitmask);

// Clear bit n
x &= ~(1 << n);

// Example: clear bit 3
x &= ~(1 << 3);

// Clear multiple bits
x &= ~(bitmask);

// Toggle bit n (XOR)
x ^= (1 << n);

// Example: toggle bit 3
x ^= (1 << 3);

// Toggle multiple bits
x ^= (bitmask);

// Check if bit n is set
if (x & (1 << n))

// Check if bit n is clear
if (!(x & (1 << n)))

// Extract bit value
int bit = (x >> n) & 1;

// Extract n bits at position p
(x >> p) & ((1 << n) - 1)

// Example: extract 4 bits from bit 8
uint8_t field = (x >> 8) & 0xF;

// Insert n-bit value v at position p
x = (x & ~(((1 << n) - 1) << p)) | (v << p);

// Clear target bits first, then OR new value

// Extract specific bits
uint32_t x = 0xABCD1234;

// Extract low byte
uint8_t low_byte = x & 0xFF;  // 0x34

// Extract high byte
uint8_t high_byte = (x >> 24) & 0xFF;  // 0xAB

// Extract byte 2
uint8_t byte2 = (x >> 16) & 0xFF;  // 0xCD

// Extract nibble (4 bits)
uint8_t nibble = (x >> 4) & 0xF;  // Low nibble of byte0

// Extract bit field
uint32_t field = (x >> 5) & 0x3F;  // 6 bits starting at bit 5

// Modify specific bits while preserving others
uint32_t x = 0xABCD1234;

// Clear bits 8-15 (set to 0)
x &= ~(0xFF << 8);  // 0xAB??1234 becomes 0xAB001234

// Set bits 8-15 to 0x42
x = (x & ~(0xFF << 8)) | (0x42 << 8);
// Result: 0xAB421234

// Toggle bits 4-7
x ^= (0xF << 4);

// Insert value v into 4-bit field at position p
void insert_field(uint32_t *x, int p, uint8_t v) {
    uint32_t mask = 0xF << p;
    *x = (*x & ~mask) | ((v & 0xF) << p);
}

// Set specific bits in register
#define GPIO_MODER_OUTPUT (1 << 10)  // Bit 10 for pin 5 mode

// Read-modify-write pattern
uint32_t temp = GPIO_MODER;      // Read current value
temp |= GPIO_MODER_OUTPUT;       // Modify desired bits
GPIO_MODER = temp;               // Write back

// One-liner (but still read-modify-write)
GPIO_MODER |= GPIO_MODER_OUTPUT;

// Set multiple bits
GPIO_MODER |= (0x3 << 10) | (0x3 << 12);

// Clear specific bits
#define GPIO_MODER_MASK (0x3 << 10)  // Two-bit field

GPIO_MODER &= ~GPIO_MODER_MASK;  // Clear bits 10-11

// Clear and set in one operation
GPIO_MODER = (GPIO_MODER & ~GPIO_MODER_MASK) | (0x1 << 10);

// Hardware with set/clear registers (safer!)
#define GPIO_BSRR_SET   (1 << 5)   // Set bit 5
#define GPIO_BSRR_RESET (1 << 21)  // Reset bit 5 (bit 16+5)

GPIO_BSRR = GPIO_BSRR_SET;   // Atomic set - no read needed!
GPIO_BSRR = GPIO_BSRR_RESET; // Atomic clear

// Toggle pin (XOR)
#define GPIO_ODR_PIN5 (1 << 5)

GPIO_ODR ^= GPIO_ODR_PIN5;  // Toggle pin 5

// But careful: XOR reads register first
// For toggling, often OK

// Some hardware has toggle register
#define GPIO_OTGL (*(volatile uint32_t*)(GPIO_BASE + 0x20))
GPIO_OTGL = GPIO_ODR_PIN5;  // Atomic toggle

// Read input pin
#define GPIO_IDR_PIN5 (1 << 5)

if (GPIO_IDR & GPIO_IDR_PIN5) {
    // Pin 5 is high
}

// Wait for bit to be set
while (!(GPIO_IDR & GPIO_IDR_PIN5)) {
    // Spin (or add timeout!)
}

// Read multi-bit field
uint32_t mode = (GPIO_MODER >> 10) & 0x3;

// Find position of lowest set bit
int ctz_naive(uint32_t x) {
    if (x == 0) return 32;
    int pos = 0;
    while ((x & 1) == 0) {
        x >>= 1;
        pos++;
    }
    return pos;
}

// De Bruijn sequence method (constant time)
int ctz_debruijn(uint32_t x) {
    static const int table[32] = {
        0, 1, 28, 2, 29, 14, 24, 3, 30, 22, 20, 15, 25, 17, 4, 8,
        31, 27, 13, 23, 21, 19, 16, 7, 26, 12, 18, 6, 11, 5, 10, 9
    };
    return table[((x & -x) * 0x077CB531U) >> 27];
}

// Builtin (fastest)
int pos = __builtin_ctz(x);  // GCC/Clang

// ffs returns 1 + position of lowest set bit
// Returns 0 if x == 0

int ffs_naive(uint32_t x) {
    if (x == 0) return 0;
    return ctz_naive(x) + 1;
}

// Builtin
int pos = __builtin_ffs(x);  // GCC/Clang

// Example:
// x = 40 (101000)
// ctz = 3 (bits 0-2 are zero)
// ffs = 4 (first set bit is bit 3)

uint32_t reverse_naive(uint32_t x) {
    uint32_t result = 0;
    for (int i = 0; i < 32; i++) {
        result = (result << 1) | (x & 1);
        x >>= 1;
    }
    return result;
}
// 32 iterations

static const uint8_t rev[256] = {
    0x00, 0x80, 0x40, 0xC0, ... };

uint32_t reverse_lut(uint32_t x) {
    return rev[x & 0xFF] << 24 |
           rev[(x >> 8) & 0xFF] << 16 |
           rev[(x >> 16) & 0xFF] << 8 |
           rev[(x >> 24) & 0xFF];
}
// Fast, constant time

uint32_t reverse_fast(uint32_t x) {
    x = ((x >> 1) & 0x55555555) | 
        ((x & 0x55555555) << 1);
    x = ((x >> 2) & 0x33333333) | 
        ((x & 0x33333333) << 2);
    x = ((x >> 4) & 0x0F0F0F0F) | 
        ((x & 0x0F0F0F0F) << 4);
    x = ((x >> 8) & 0x00FF00FF) | 
        ((x & 0x00FF00FF) << 8);
    x = (x >> 16) | (x << 16);
    return x;
}
// No loops, pure bit magic!

// Simple rule: backward branches (loops) taken, forward not taken

while (condition) {  // Backward branch → predict taken
    // loop body
}

if (rare_condition) {  // Forward branch → predict not taken
    // error handler
}

// Modern CPUs: static only used when no history available

// Remember last outcome
State: Last Taken (1) or Last Not Taken (0)

// Pattern:
Taken → 1
Not Taken → 0

// Problem with loops:
for (int i = 0; i < 100; i++) {  // 99 taken, 1 not
    // Predict: taken, taken, taken... MISpredict at end!
}

// Only 90% accuracy for loops

// Four states: Strongly Taken, Weakly Taken, 
//              Weakly Not Taken, Strongly Not Taken

State Machine:
Strong T ← Weak T ← Weak NT → Strong NT
         →        ←        ←

// Takes two mispredicts to change prediction
// Much better for loops!

// Accuracy: >99% for many patterns

// Some branches correlate with previous branches
if (x > 0) { ... }
if (y > 0) { ... }  // Often same outcome as first

// Modern predictors use:
- Global history register
- Pattern history tables
- Tournament predictors (choose best predictor)

// Intel's Haswell: 2-level adaptive predictor
// Accuracy: 99.5%+

// Before
for (int i = 0; i < 1000; i++) {
    sum += arr[i];
}

// After manual unrolling (4x)
for (int i = 0; i < 1000; i += 4) {
    sum += arr[i];
    sum += arr[i+1];
    sum += arr[i+2];
    sum += arr[i+3];
}

// Compiler does this with -O3 automatically
// Trade-off: code size vs speed

// Bad - recomputes each iteration
for (int i = 0; i < n; i++) {
    arr[i] = arr[i] * (a + b);  // a+b constant!
}

// Good - move invariant out
int factor = a + b;
for (int i = 0; i < n; i++) {
    arr[i] = arr[i] * factor;
}

// Compiler does this automatically at -O1

// Before
for (int i = 0; i < n; i++) {
    arr[i] = i * 5;  // multiply each time
}

// After optimization
int val = 0;
for (int i = 0; i < n; i++) {
    arr[i] = val;    // just assignment
    val += 5;        // addition instead of multiply
}

// Compiler does this automatically

// Two separate loops (bad cache usage)
for (int i = 0; i < n; i++) arr1[i] = a[i] * 2;
for (int i = 0; i < n; i++) arr2[i] = a[i] + 5;

// Fused loop (better locality)
for (int i = 0; i < n; i++) {
    arr1[i] = a[i] * 2;
    arr2[i] = a[i] + 5;
}

// Better cache utilization

// C code
if (x == 0) do0();
else if (x == 10) do10();
else if (x == 20) do20();
else if (x == 30) do30();
else default();

// Assembly (simplified)
    cmp eax, 0
    je .L0
    cmp eax, 10
    je .L10
    cmp eax, 20
    je .L20
    cmp eax, 30
    je .L30
    jmp .Ldefault

// 4 comparisons worst case!

// C code
switch(x) {
    case 0: do0(); break;
    case 1: do1(); break;
    case 2: do2(); break;
    case 3: do3(); break;
    default: def();
}

// Assembly
    cmp eax, 3        ; Check bounds
    ja .Ldefault
    jmp [.Ltable + eax*8]

.Ltable:
    .quad .L0
    .quad .L1
    .quad .L2
    .quad .L3

// 1 comparison, 1 jump — O(1) always!

// Deliberate fall-through
switch(level) {
    case 3:
        enable_feature_c();
        // fall through
    case 2:
        enable_feature_b();
        // fall through
    case 1:
        enable_feature_a();
        break;
}

// Comment intentional fall-through!

// Multiple labels, same code
switch(c) {
    case 'a': case 'A':
    case 'e': case 'E':
    case 'i': case 'I':
    case 'o': case 'O':
    case 'u': case 'U':
        is_vowel = 1;
        break;
    default:
        is_vowel = 0;
}

// GCC extension: case ranges
switch(ascii) {
    case '0' ... '9':
        is_digit = 1;
        break;
    case 'a' ... 'z':
    case 'A' ... 'Z':
        is_alpha = 1;
        break;
    default:
        is_other = 1;
}

// Not standard C, but widely supported

int found = 0;
for (int i = 0; i < 100 && !found; i++) {
    for (int j = 0; j < 100 && !found; j++) {
        for (int k = 0; k < 100 && !found; k++) {
            if (matrix[i][j][k] == target) {
                found = 1;
                // but where's the target?
            }
        }
    }
}

// Ugly flags, conditions everywhere

for (int i = 0; i < 100; i++) {
    for (int j = 0; j < 100; j++) {
        for (int k = 0; k < 100; k++) {
            if (matrix[i][j][k] == target) {
                goto found;
            }
        }
    }
}
printf("Not found\n");
return -1;

found:
printf("Found at %d,%d,%d\n", i, j, k);
return 0;

// Clean, efficient, obvious intent

// Unpredictable (random data)
for (int i = 0; i < N; i++) {
    if (data[i] > threshold) {
        sum += data[i];
    }
}

// Predictable after sorting
qsort(data, N, sizeof(int), cmp);
for (int i = 0; i < N; i++) {
    if (data[i] > threshold) {
        // First all falses, then all trues
        // Single branch pattern!
        sum += data[i];
    }
}

// 4x faster on random data!

// Conditional branch
int min(int a, int b) {
    return a < b ? a : b;  // Branch!
}

// Branchless version
int min_branchless(int a, int b) {
    return b ^ ((a ^ b) & -(a < b));
    // Uses conditional move (CMOV) on x86
    // No branch, no mispredict!
}

// Modern compilers often do this automatically
// Use -O3 and let compiler work

// Tell compiler about branch probability
#define likely(x)   __builtin_expect(!!(x), 1)
#define unlikely(x) __builtin_expect(!!(x), 0)

if (unlikely(error_condition)) {
    // Rare error path
    handle_error();
}

if (likely(success_path)) {
    // Common case - compiler optimizes layout
    process_data();
}

// Affects code layout, not CPU prediction directly

// Step 1: Compile with profiling
gcc -fprofile-generate -O3 program.c -o program

// Step 2: Run with representative data
./program  # generates .gcda files

// Step 3: Recompile with profile use
gcc -fprofile-use -O3 program.c -o program_opt

// Compiler learns actual branch probabilities!
// Can be 20-30% faster

// Long dependency chain (slow)
int sum = 0;
for (int i = 0; i < 1000; i++) {
    sum = sum + data[i];  // Each add depends on previous
    // Can't parallelize!
}

// CPU can only do one add per cycle
// 1000 cycles minimum

// Better: unroll to break dependencies
int sum1 = 0, sum2 = 0, sum3 = 0, sum4 = 0;
for (int i = 0; i < 1000; i += 4) {
    sum1 += data[i];
    sum2 += data[i+1];
    sum3 += data[i+2];
    sum4 += data[i+3];
}
sum = sum1 + sum2 + sum3 + sum4;
// 4 independent chains - 4x faster!

// Independent operations
float a = x * y;
float b = z * w;  // Independent of a
float c = a + b;  // Waits for both

// CPU can execute first two multiplies in parallel
// Modern CPUs: 2-6 independent operations per cycle!

// Restrict pointers help:
void add(float *restrict a, float *restrict b,
         float *restrict c, int n) {
    for (int i = 0; i < n; i++) {
        c[i] = a[i] + b[i];  // Independent iterations
    }
    // Compiler can vectorize!

First 6 arguments in registers, rest on stack. Stack aligned to 16 bytes.

Caller allocates "shadow space" (32 bytes) on stack. First 4 args in registers.

function:
    push rbp          ; Save old RBP
    mov rbp, rsp      ; Set frame pointer
    sub rsp, 16       ; Allocate locals
    
    ; Access locals via [rbp-8]
    ; Access args via [rbp+16]
    
    leave             ; mov rsp, rbp; pop rbp
    ret

// Pros: Debugging easy, stack traces work
// Cons: Extra instructions, one less register

function:
    sub rsp, 24       ; Allocate stack space
    
    ; Access locals via [rsp+8]
    ; Access args via [rsp+32]
    
    add rsp, 24       ; Deallocate
    ret

// Pros: Faster, RBP available as general register
// Cons: Harder to debug, stack unwinding needs metadata

int fib_rec(int n) {
    if (n <= 1) return n;
    return fib_rec(n-1) + fib_rec(n-2);
}

// Call tree for n=5:
//            fib(5)
//           /      \
//       fib(4)     fib(3)
//       /    \     /    \
//    fib(3) fib(2) ...   ...

// Number of calls: O(2ⁿ)
// n=40: ~330 million calls!
// Stack depth: O(n)

int fib_iter(int n) {
    if (n <= 1) return n;
    int a = 0, b = 1;
    for (int i = 2; i <= n; i++) {
        int temp = a + b;
        a = b;
        b = temp;
    }
    return b;
}

// Time: O(n), Space: O(1)
// n=40: 39 iterations
// 10 million times faster for n=40!

// Tail-recursive version:
int fib_tail(int n, int a, int b) {
    if (n == 0) return a;
    if (n == 1) return b;
    return fib_tail(n-1, b, a+b);
}

// In header file
static inline int max(int a, int b) {
    return a > b ? a : b;
}

// Each .c file gets its own copy
// No external linkage
// Safe, simple, works everywhere

// Assembly: inlined at each use, or
// if not inlined, local static copy created

// In header
inline int max(int a, int b) {
    return a > b ? a : b;
}

// In ONE .c file
extern int max(int a, int b);

// Provides external definition
// More complex, rarely needed
// Use static inline instead!

#include 

int compare_int(const void *a, const void *b) {
    int ia = *(const int*)a;
    int ib = *(const int*)b;
    return (ia > ib) - (ia < ib);  // -1, 0, or 1
}

int compare_str(const void *a, const void *b) {
    char *sa = *(char**)a;
    char *sb = *(char**)b;
    return strcmp(sa, sb);
}

int main() {
    int nums[] = {5, 2, 8, 1, 9};
    qsort(nums, 5, sizeof(int), compare_int);
    
    char *strs[] = {"dog", "cat", "bird"};
    qsort(strs, 3, sizeof(char*), compare_str);
    
    return 0;
}

// qsort works with ANY data type
// Function pointer = strategy pattern in C

typedef void (*event_handler)(int event, void *data);

struct event_system {
    event_handler handlers[10];
    void *handler_data[10];
    int count;
};

void register_handler(struct event_system *es,
                      event_handler h, void *data) {
    es->handlers[es->count] = h;
    es->handler_data[es->count] = data;
    es->count++;
}

void fire_event(struct event_system *es, int event) {
    for (int i = 0; i < es->count; i++) {
        es->handlers[i](event, es->handler_data[i]);
    }
}

// Usage
void on_button_click(int event, void *data) {
    printf("Button %s clicked\n", (char*)data);
}

struct event_system es = {0};
register_handler(&es, on_button_click, "OK");
fire_event(&es, 1);

// Stop when variable changes
int global_counter = 0;

void increment() {
    global_counter++;  // Who calls this?
}

// In GDB:
(gdb) watch global_counter
Hardware watchpoint 1: global_counter
(gdb) continue
Continuing.
Hardware watchpoint 1: global_counter
Old value = 0
New value = 1
increment () at program.c:10

// Shows exact call stack when modified!

// Break only in certain conditions
void process(int id, char *data) {
    // Bug only when id == 42
}

// In GDB:
(gdb) break process if id == 42
Breakpoint 1 at 0x4004f7: file program.c, line 5.
(gdb) run
Continuing.

Breakpoint 1, process (id=42, data=0x7fff...)
#0  process (id=42, data=0x7fff...) at program.c:5
#1  0x0000000000400523 in main () at program.c:20

// Stops exactly when bug triggers!

// String literal (stored in .rodata, read-only)
char *str1 = "Hello";
// Memory: 'H' 'e' 'l' 'l' 'o' '\0' (6 bytes)
// str1 points to read-only memory

// Character array (stored on stack/data, writable)
char str2[] = "Hello";
// Memory: 'H' 'e' 'l' 'l' 'o' '\0' (6 bytes)
// str2 is a modifiable copy

// Difference:
str2[0] = 'h';  // OK - modifies copy
str1[0] = 'h';  // Undefined behavior! (segfault on many systems)

// String literals are often shared by compiler
char *a = "Hello";
char *b = "Hello";
// a and b may point to SAME memory!

char str[] = "Hi!";

Memory (byte-by-byte):
Address: 0x1000: 'H'  (72)
         0x1001: 'i'  (105)
         0x1002: '!'  (33)
         0x1003: '\0' (0)   ← Null terminator!

// No separate length field — strlen() counts until '\0'
size_t len = strlen(str);  // Returns 3

// But sizeof includes null terminator
size_t sz = sizeof(str);   // Returns 4

// String literal in .rodata:
static const char msg[] = "Hello";
// Stored in read-only data segment

char *cptr = (char*)0x1000;
cptr + 1;  // 0x1001 (adds 1 byte)

short *sptr = (short*)0x1000;
sptr + 1;  // 0x1002 (adds 2 bytes)

int *iptr = (int*)0x1000;
iptr + 1;  // 0x1004 (adds 4 bytes)

double *dptr = (double*)0x1000;
dptr + 1;  // 0x1008 (adds 8 bytes)

struct large {
    char data[1024];
} *structptr = (struct large*)0x1000;
structptr + 1;  // 0x1400 (adds 1024 bytes)

// Always scaled by sizeof(type)

void *vptr = (void*)0x1000;
// vptr + 1;  // ERROR! void has no size

// Must cast before arithmetic
char *cptr = (char*)vptr;
cptr + 1;  // Now works

// Common idiom: byte-wise memory operations
void my_memcpy(void *dest, const void *src, size_t n) {
    char *d = dest;
    const char *s = src;
    for (size_t i = 0; i < n; i++) {
        *d++ = *s++;  // Pointer arithmetic on char*
    }
}

// Cast to char* for byte-level access

// Attacker's goal: redirect execution to their code

// 1. Find offset to return address
// Using pattern input: "AAAABBBBCCCCDDDD..."
// Crash at 0x44444444 → offset 12 bytes

// 2. Craft payload:
// [shellcode][padding][address of shellcode]

// Example (32-bit):
char exploit[32];
char shellcode[] = "\x31\xc0\x50\x68...";  // execve("/bin/sh")

// Fill buffer
memcpy(exploit, shellcode, sizeof(shellcode)-1);
memset(exploit + sizeof(shellcode)-1, 0x90, 
       12 - sizeof(shellcode));  // NOP sled

// Overwrite return address with buffer address
*(uint32_t*)(exploit + 12) = buffer_address;

// When function returns, it jumps to shellcode!

// NOP (0x90) instructions do nothing
// Attacker doesn't need exact address

Memory layout:
[ NOP NOP NOP ... NOP ][ SHELLCODE ][ ... ]
  ↑
  Any address in NOP sled slides to shellcode

Stack after overflow:
+----------------+
| NOP NOP NOP... |  ← Any address here lands in NOP sled
+----------------+
| SHELLCODE      |  ← Actual exploit code
+----------------+
| Return address |  ← Overwritten with approximate address
+----------------+

// Return address points anywhere in NOP sled
// Execution slides to shellcode automatically

#include 

char dest[10];
int n = snprintf(dest, sizeof(dest), 
                 "Hello %s", "world");

// Returns number of characters that WOULD have been written
// (excluding null terminator) if enough space

if (n >= sizeof(dest)) {
    // Truncation occurred
    fprintf(stderr, "Buffer too small! Needed %d\n", n+1);
}

// dest is always null-terminated
// Safe even if buffer too small

// Multiple parts:
snprintf(dest, sizeof(dest), "%s%s%s", 
         part1, part2, part3);

#ifdef __linux__
#define _GNU_SOURCE
#include   // -lbsd
#endif

char dest[10];
size_t len = strlcpy(dest, "Hello world", sizeof(dest));

if (len >= sizeof(dest)) {
    // Truncated
    printf("Needed %zu bytes\n", len + 1);
}

// Always null-terminates
// Returns length of source

// Safe concatenation:
strlcat(dest, " suffix", sizeof(dest));

// strlcat never writes more than size bytes
// Always null-terminates result

// Good: always pass buffer size
int safe_copy(char *dest, size_t dest_size,
              const char *src) {
    if (!dest || !src || dest_size == 0)
        return -1;
    
    size_t src_len = strnlen(src, dest_size);
    if (src_len >= dest_size) {
        // Not enough space
        return -1;
    }
    
    memcpy(dest, src, src_len + 1);
    return 0;
}

// Usage:
char buf[10];
if (safe_copy(buf, sizeof(buf), user_input) < 0) {
    // Handle error
}

// Safer: bundle pointer with size
typedef struct {
    char *data;
    size_t size;
    size_t used;  // current length
} safe_buffer_t;

int safe_buffer_append(safe_buffer_t *buf,
                       const char *src) {
    size_t src_len = strlen(src);
    
    if (buf->used + src_len + 1 > buf->size) {
        return -1;  // Would overflow
    }
    
    memcpy(buf->data + buf->used, src, src_len + 1);
    buf->used += src_len;
    return 0;
}

// Always know your bounds!

// Simplified sbrk-based malloc
#include 

void *simple_malloc(size_t size) {
    void *current_break = sbrk(0);      // Get current break
    void *new_break = sbrk(size);        // Increase heap
    
    if (new_break == (void*)-1) {
        return NULL;  // Out of memory
    }
    
    return current_break;  // Return old break address
}

// Problem: No free() implementation!
// Can't reuse memory — once allocated, never freed

// Real malloc maintains free lists to reuse memory
// sbrk only called when more memory needed

#include 

void *mmap_malloc(size_t size) {
    // Round up to page size (usually 4096 bytes)
    size_t pages = (size + 4095) / 4096;
    size_t rounded = pages * 4096;
    
    void *ptr = mmap(NULL, rounded, 
                     PROT_READ | PROT_WRITE,
                     MAP_PRIVATE | MAP_ANONYMOUS,
                     -1, 0);
    
    if (ptr == MAP_FAILED) {
        return NULL;
    }
    
    return ptr;
}

void mmap_free(void *ptr, size_t size) {
    size_t pages = (size + 4095) / 4096;
    munmap(ptr, pages * 4096);
}

// glibc uses mmap for allocations > 128KB
// Benefits: can be freed independently, returns to OS
// Overhead: system call, page-aligned

// Simplified malloc implementation
void *malloc(size_t size) {
    // Align size to 8 bytes (or 16 for some archs)
    size = (size + 7) & ~7;
    
    // Add metadata size
    size_t total_needed = size + sizeof(struct block);
    
    // Search free list for suitable block
    struct block *current = free_list;
    while (current) {
        if (current->free && current->size >= total_needed) {
            // Found a block!
            
            // Split if block is much larger than needed
            if (current->size >= total_needed + MIN_BLOCK_SIZE) {
                split_block(current, total_needed);
            }
            
            current->free = 0;
            // Return pointer to user data (after metadata)
            return (void*)(current + 1);
        }
        current = current->next;
    }
    
    // No suitable block found - extend heap
    struct block *new_block = extend_heap(total_needed);
    if (!new_block) return NULL;
    
    new_block->free = 0;
    return (void*)(new_block + 1);
}

// Simplified free implementation
void free(void *ptr) {
    if (!ptr) return;
    
    // Get block metadata (before user data)
    struct block *block = (struct block*)ptr - 1;
    
    block->free = 1;
    
    // Coalesce with next block if free
    struct block *next = get_next_block(block);
    if (next && next->free) {
        block->size += next->size;
        remove_from_free_list(next);
    }
    
    // Coalesce with previous block if free
    struct block *prev = get_prev_block(block);
    if (prev && prev->free) {
        prev->size += block->size;
        remove_from_free_list(block);
        block = prev;  // Block now merged with prev
    }
    
    // Add to free list (unless already there from coalescing)
    if (!block->in_free_list) {
        add_to_free_list(block);
    }
    
    // Optionally: return memory to OS if at end of heap
    if (is_last_block(block)) {
        shrink_heap(block);
    }
}

// Pre-allocate fixed-size objects
typedef struct {
    char data[64];
    int in_use;
} object_t;

object_t pool[1000];

object_t* pool_alloc() {
    for (int i = 0; i < 1000; i++) {
        if (!pool[i].in_use) {
            pool[i].in_use = 1;
            return &pool[i];
        }
    }
    return NULL;
}

void pool_free(object_t *obj) {
    obj->in_use = 0;
}

// Benefits:
// - No fragmentation (fixed size)
// - Very fast O(1)
// - Perfect for networking, drivers

// Linux kernel's slab allocator
// Groups objects of same size

struct kmem_cache *cache;
cache = kmem_cache_create("my_cache",
                          sizeof(my_struct),
                          0, 0, NULL);

my_struct *obj = kmem_cache_alloc(cache, GFP_KERNEL);
kmem_cache_free(cache, obj);

// For user-space: libumem, tcmalloc

// Benefits:
// - No fragmentation within slab
// - Objects packed tightly
// - CPU cache friendly

// Allocate in large chunks, then manually manage
typedef struct {
    char *memory;
    size_t used;
    size_t capacity;
} arena_t;

void *arena_alloc(arena_t *a, size_t size) {
    if (a->used + size > a->capacity)
        return NULL;
    void *ptr = a->memory + a->used;
    a->used += size;
    return ptr;
}

// Reset whole arena at once
void arena_reset(arena_t *a) {
    a->used = 0;
}

// No fragmentation within arena
// Perfect for per-frame/per-request allocations

// Run static analyzer
$ clang --analyze program.c

program.c:10:5: warning: Potential leak of memory
    return -1;
    ^~~~~~~~

// Example detection:
int process() {
    char *buf = malloc(100);
    if (!buf) return -1;
    
    if (error_condition) {
        return -1;  // Warning: leak!
    }
    
    free(buf);
    return 0;
}

// Xcode uses this by default
// Can integrate into CI pipelines

$ gcc -fanalyzer -g program.c

program.c: In function 'process':
program.c:10:12: warning: leak of 'buf' [CWE-401]
   10 |     return -1;
      |            ^~

// Also detects:
// - Double free
// - Use after free
// - Memory leaks

// Example with GCC 13:
void test() {
    int *p = malloc(4);
    if (cond) {
        free(p);
        return;
    }
    // p not freed if !cond
}  // warning: leak

# Install: sudo apt install cppcheck
$ cppcheck --enable=all program.c

[program.c:5]: (error) Memory leak: ptr
[program.c:12]: (error) Memory leak: data
[program.c:20]: (error) Resource leak: fp

// Also checks:
// - Uninitialized variables
// - Null pointer dereference
// - Buffer overflows
// - Stylistic issues

// Integrate into build:
cppcheck --error-exitcode=1 \
         --enable=warning,performance,portability \
         --suppress=missingIncludeSystem \
         src/

// Commercial static analysis
// Used by many large projects

// Coverity Scan (free for open source)
$ cov-build --dir cov-int make
$ tar czvf myproject.tgz cov-int

// Upload to Coverity Scan

// Detects:
// - Complex interprocedural leaks
// - Resource leaks (files, sockets)
// - Data races
// - Security vulnerabilities

# Ubuntu/Debian
sudo apt install valgrind

# Fedora/RHEL
sudo dnf install valgrind

# macOS (with Homebrew)
brew install valgrind
# Note: Valgrind on modern macOS has limitations

# From source
wget https://sourceware.org/pub/valgrind/valgrind-3.22.0.tar.bz2
tar -xjf valgrind-3.22.0.tar.bz2
cd valgrind-3.22.0
./configure
make
sudo make install

// Simple test program (buggy.c)
#include 

int main() {
    int *p = malloc(10 * sizeof(int));
    p[10] = 42;  // Buffer overflow!
    free(p);
    p[0] = 100;  // Use after free!
    return 0;
}

// Compile with debug info
gcc -g -o buggy buggy.c

// Run Valgrind
valgrind --leak-check=full ./buggy

// Output shows:
// - Invalid write of size 4 (p[10])
// - Invalid write of size 4 (use after free)
// - 40 bytes definitely lost

# Generate suppression for known false positives
valgrind --gen-suppressions=yes ./program 2>&1 | tee supp.txt

# Create suppression file (supp.txt)
{
   
   Memcheck:Leak
   ...
   fun:malloc
   fun:some_library_function
}

# Use suppression
valgrind --suppressions=supp.txt ./program

# Common false positives:
# - System libraries
# - Compiler-generated code
# - Custom allocators

#include 

void my_function() {
    char buffer[1024];
    
    // Mark memory as defined (even if uninitialized)
    VALGRIND_MAKE_MEM_DEFINED(buffer, sizeof(buffer));
    
    // Mark memory as inaccessible
    VALGRIND_MAKE_MEM_NOACCESS(buffer, sizeof(buffer));
    
    // Check for leaks at this point
    VALGRIND_DO_LEAK_CHECK;
    
    // Mark memory as a pool for custom allocators
    VALGRIND_CREATE_MEMPOOL(pool, 0, 0);
    VALGRIND_MEMPOOL_ALLOC(pool, ptr, size);
}

# Cache profiling
valgrind --tool=cachegrind ./program

# Generates cachegrind.out.PID
cg_annotate cachegrind.out.12345

# Shows:
# - I1 cache misses (instruction)
# - D1 cache misses (data)
# - LL cache misses (last level)
# - Branch mispredictions

# Perfect for optimization

# Heap profiler
valgrind --tool=massif ./program

# Generates massif.out.PID
ms_print massif.out.12345

# Shows heap usage over time:
# - Peak memory usage
# - Allocation patterns
# - Which functions allocate most

# Graphical view:
massif-visualizer massif.out.12345

# Thread error detector
valgrind --tool=helgrind ./program

# Detects:
# - Data races
# - Lock ordering problems
# - Improper pthread usage

# Example output:
==12345== Possible data race during read of size 4
==12345==    at 0x400547: worker (thread.c:15)
==12345==  This conflicts with a previous write
==12345==    at 0x4005A3: main (thread.c:30)

#include 
#include 

struct bad_packed {
    char c;      // offset 0, size 1
    // 3 bytes PADDING here (to align int)
    int i;       // offset 4, size 4
    short s;     // offset 8, size 2
    // 2 bytes PADDING here (to align next struct)
    char d;      // offset 12, size 1
    // 3 bytes PADDING at end (for array alignment)
};

// sizeof(struct bad_packed) = 16 bytes
// Only 1+4+2+1 = 8 bytes of data!
// 8 bytes wasted (50% overhead!)

int main() {
    struct bad_packed b;
    
    printf("Size: %zu bytes\n", sizeof(b));
    printf("c at offset %zu\n", offsetof(struct bad_packed, c));
    printf("i at offset %zu\n", offsetof(struct bad_packed, i));
    printf("s at offset %zu\n", offsetof(struct bad_packed, s));
    printf("d at offset %zu\n", offsetof(struct bad_packed, d));
    
    return 0;
}

// Output:
// Size: 16 bytes
// c at offset 0
// i at offset 4
// s at offset 8
// d at offset 12

struct good_packed {
    int i;       // offset 0, size 4
    short s;     // offset 4, size 2
    char c;      // offset 6, size 1
    char d;      // offset 7, size 1
    // No padding needed! (total 8 bytes)
};

// sizeof(struct good_packed) = 8 bytes
// All 8 bytes used! 0% waste

// Rule: Order members by size (largest to smallest)
// This minimizes padding between members

struct optimized {
    double d;    // offset 0,  size 8
    int i;       // offset 8,  size 4
    short s;     // offset 12, size 2
    char c1;     // offset 14, size 1
    char c2;     // offset 15, size 1
    // Total 16 bytes (8+4+2+1+1 = 16)
    // No padding between, only at end if needed for array
};

// Compare with different ordering:
// double(8), char(1), int(4), char(1), short(2)
// Would be 24 bytes! (8 + 1 + 3pad + 4 + 1 + 1pad + 2 + 6pad)

#ifdef __GNUC__
#define PACKED __attribute__((packed))
#else
#define PACKED
#endif

struct PACKED packed_struct {
    char c;
    int i;
    short s;
};

// No padding added!
// sizeof = 1+4+2 = 7 bytes

// But access may be slower or crash!
// On x86: slower (misaligned access)
// On ARM: may crash!

// Use only for:
// - Network protocols
// - File formats
// - Hardware interfaces

// Force specific alignment
struct __attribute__((aligned(16))) cache_line {
    int data[4];  // 16 bytes, aligned to 16
};

// Align variable to cache line
int cache_aligned_var 
    __attribute__((aligned(64)));

// For SIMD (AVX: 32-byte alignment)
float vec __attribute__((aligned(32)));

// Check alignment
_Static_assert(alignof(struct cache_line) == 16,
               "Wrong alignment");

#include 

// Standard C11 alignment
struct alignas(16) vec4 {
    float x, y, z, w;
};

// Check alignment
printf("Alignment: %zu\n", 
       alignof(struct vec4));

// Align variable
alignas(64) int cache_aligned;

// alignas can be more than natural alignment
// but not less (implementation-defined)

// alignof gives you the alignment requirement

// Self-referential structure
struct node {
    int data;
    struct node *next;  // Points to another node
};

// This works because pointer size is known
// even though struct node is incomplete

// Creating a list
struct node *head = NULL;

struct node *first = malloc(sizeof(struct node));
first->data = 10;
first->next = NULL;
head = first;

struct node *second = malloc(sizeof(struct node));
second->data = 20;
second->next = NULL;
first->next = second;

// Traverse list
for (struct node *curr = head; curr; curr = curr->next) {
    printf("%d ", curr->data);
}

// Memory layout:
// Node: [data (4)][padding (4)][next (8)] on 64-bit
// Total: 16 bytes per node

struct dnode {
    int data;
    struct dnode *prev;
    struct dnode *next;
};

// Forward declaration for circular types
struct tree_node;

struct tree_node {
    int data;
    struct tree_node *left;
    struct tree_node *right;
};

// Typedef can simplify
typedef struct tree_node Node;

// Self-referential with typedef
typedef struct list List;
struct list {
    int data;
    List *next;
    List *prev;
};

// Function operating on self-referential struct
void insert_sorted(Node **head, int value) {
    Node *new_node = malloc(sizeof(Node));
    new_node->data = value;
    new_node->next = NULL;
    
    if (!*head || (*head)->data >= value) {
        new_node->next = *head;
        *head = new_node;
        return;
    }
    
    Node *current = *head;
    while (current->next && current->next->data < value) {
        current = current->next;
    }
    
    new_node->next = current->next;
    current->next = new_node;
}

// Tagged union (discriminated union)
enum data_type { TYPE_INT, TYPE_FLOAT, TYPE_STRING };

struct tagged_data {
    enum data_type type;  // Tag to track current member
    union {
        int i;
        float f;
        char *s;
    } value;
};

void print_data(struct tagged_data *d) {
    switch (d->type) {
        case TYPE_INT:
            printf("Integer: %d\n", d->value.i);
            break;
        case TYPE_FLOAT:
            printf("Float: %f\n", d->value.f);
            break;
        case TYPE_STRING:
            printf("String: %s\n", d->value.s);
            break;
    }
}

int main() {
    struct tagged_data d1 = {TYPE_INT, .value.i = 42};
    struct tagged_data d2 = {TYPE_FLOAT, .value.f = 3.14};
    struct tagged_data d3 = {TYPE_STRING, .value.s = "hello"};
    
    print_data(&d1);
    print_data(&d2);
    print_data(&d3);
    
    // Safety: always check type before accessing
    return 0;
}

// More complex variant with different sizes
enum var_type { VAR_INT, VAR_DOUBLE, VAR_POINT };

struct point {
    int x, y;
};

struct variant {
    enum var_type type;
    union {
        int i;
        double d;
        struct point p;
    } data;
};

// Type-safe accessors
int variant_get_int(struct variant *v) {
    if (v->type != VAR_INT) {
        fprintf(stderr, "Type error!\n");
        exit(1);
    }
    return v->data.i;
}

// Usage in compilers, interpreters
struct variant eval_expression(...) {
    // Returns different types based on expression
}

// Memory efficient: only stores largest type + tag
// sizeof = 1(tag) + padding + 8(double) = 16 bytes

// Traditional Array of Structs (AoS)
struct particle {
    float x, y, z;
    float vx, vy, vz;
    float mass;
    int type;
} particles[10000];

// Better: Struct of Arrays (SoA)
struct particles_soa {
    float x[10000];
    float y[10000];
    float z[10000];
    float vx[10000];
    float vy[10000];
    float vz[10000];
    float mass[10000];
    int type[10000];
};

// SoA is SIMD-friendly!
// Process all x coordinates at once
for (int i = 0; i < 10000; i += 4) {
    // SIMD load 4 x's
    // SIMD add
    // SIMD store
}

// Traditional: separate node
struct list_node {
    struct list_node *next;
    struct list_node *prev;
    void *data;
};

// Intrusive: embedding links in data
struct my_data {
    int value;
    struct my_data *next;  // Intrusive link
    struct my_data *prev;
    // No separate allocation!
};

// Linux kernel uses intrusive lists
struct list_head {
    struct list_head *next;
    struct list_head *prev;
};

struct task_struct {
    // ... task data
    struct list_head tasks;  // Intrusive list
};

// Delta encoding for sorted data
struct delta_encoded {
    int base;
    uint8_t deltas[1000];  // values base + delta
};

// Pointer compression (32-bit offsets)
struct compressed {
    uint32_t next_offset;  // instead of pointer
    uint32_t data_offset;
};

// Bit-level packing
struct packed_date {
    unsigned int year  : 12;  // 0-4095
    unsigned int month : 4;    // 1-12
    unsigned int day   : 5;    // 1-31
};  // 21 bits, fits in 4 bytes

#include 

// fopen returns a FILE* pointer (not an integer!)
FILE *fp = fopen("/path/to/file", "r");
if (!fp) {
    perror("fopen failed");
    return 1;
}

// Buffered I/O functions
char buffer[1024];
char *line = fgets(buffer, sizeof(buffer), fp);
int ch = fgetc(fp);
size_t bytes = fread(buffer, 1, sizeof(buffer), fp);

// Formatted I/O
fprintf(fp, "Hello, %s\n", name);
fscanf(fp, "%d", &value);

// Close stream
fclose(fp);

// Standard streams (available as FILE*)
stdin, stdout, stderr

// Simplified FILE structure (libc internal)
typedef struct {
    int fd;                 // Underlying file descriptor
    char *buffer;           // User-space buffer
    size_t buffer_size;     // Size of buffer
    size_t buffer_pos;      // Current position in buffer
    int flags;              // Open mode, EOF, error flags
    // ... more fields
} FILE;

// FILE* wraps a file descriptor with a buffer
// This buffer reduces system calls

// Example: fgetc() when buffer empty:
// 1. Fill buffer by reading 4KB from kernel (one system call)
// 2. Return first character from buffer
// 3. Next 4095 fgetc() calls don't need system calls!

// Without buffering: 4096 system calls
// With buffering: 1 system call

// Default for disk files
setvbuf(fp, NULL, _IOFBF, BUFSIZ);

// Data written when buffer fills
// Typical buffer size: 4096 or 8192 bytes

// Force write with fflush()
fflush(fp);

// Default for terminals (stdout)
setvbuf(fp, NULL, _IOLBF, BUFSIZ);

// Data written when newline seen
// Used for interactive output

// printf("Hello\n") → flushes immediately

// Default for stderr
setvbuf(fp, NULL, _IONBF, 0);

// Every write goes directly to kernel
// Useful for error messages
// Slower but immediate

fprintf(stderr, "Error!");  // Immediate