Diagnose a Segmentation Fault and Pointer Lifetime

Understand the likely causes

• Frequent causes include null dereferences, out-of-bounds indices, using an allocation after free or realloc, returning an automatic local object’s address, and overwriting metadata earlier. Misalignment and incompatible access types also matter. A nonnull check addresses only one condition and cannot validate arbitrary stale or corrupted addresses.

1. Preserve a bounded reproduction

Copy the smallest relevant source into an isolated development directory and use synthetic data that triggers the same path. Record compiler version, language mode, options, and input. Do not reproduce against production files or services. Avoid assuming that the reported crash line is the first incorrect operation; earlier memory corruption can surface much later.

2. Establish the access obligations

For the failing pointer, identify the owning object, its allocation or declaration, its current lifetime, accessible element count, alignment, and permitted access type. Trace every assignment and release affecting it. If a helper returns a pointer to its ordinary local variable, later dereferencing is invalid regardless of the numeric address seen in a debugger. Do not assign an expected output to that invalid path.

3. Collect targeted diagnostic evidence

For a supported GCC-compatible lab toolchain, build with debug information and address/undefined-behavior checks. The command is illustrative and requires an existing synthetic lab.c. Run the instrumented program only in the isolated test context. In a debugger, inspect the backtrace and the values establishing the violated bound or lifetime; use the first useful report to guide the investigation.

cc -std=c17 -g -O1 -Wall -Wextra -Wpedantic -fsanitize=address,undefined lab.c -o lab_checked

4. Return a value or use caller-owned storage

The repaired example writes into a live caller-owned int and reports success separately. Checking null is useful, while the caller still guarantees a valid writable target. No pointer to local helper storage escapes. For dynamic storage instead, define who frees it and when all borrowed pointers stop being valid; a null assignment to one owner does not repair aliases.

#include <stdbool.h>
#include <stdio.h>

static bool answer(int *out)
{
    if (out == NULL) return false;
    *out = 42;
    return true;
}

int main(void)
{
    int value = 0;
    if (!answer(&value)) return 1;
    printf("value=%d\n", value);
    return 0;
}

value=42

5. Repair the original ownership transition

For a resize defect, keep the realloc result temporary, commit it only on success, and rebuild every borrowed element pointer afterward. For a bounds defect, validate the index against logical length before accessing. For double release, assign one owner rather than adding speculative free calls. The repair must explain the original invariant violation, not merely move the crash.

Keep it from recurring

• Document owners, borrowing duration, accessible counts, and pointer invalidation. Initialize state before fallible work and test cleanup after each failure. Keep independent debug and release checks; changing optimization is useful evidence gathering, but it does not make undefined behavior valid.