strcpy触发Segmentation Fault后，printf为何仍会执行？

Great question! Let's unpack what's happening here, because this ties into how memory works in C and the tricky concept of undefined behavior (UB).

First, let's recap your code:

char buf[10];
strcpy(buf, "This is a string longer than way longer than ten characters.");
printf("%s\n", buf);

What's really happening with strcpy? #

When you use strcpy to copy a string way longer than buf's 10-byte size, you're writing past the bounds of the array. This is classic undefined behavior—meaning the C standard doesn't define what the program should do next. The outcome can vary wildly depending on your compiler, OS, and even the exact stack layout of your program.

A segmentation fault (segfault) doesn't happen the second you write out of bounds. It only triggers when your program tries to access memory it doesn't have permission to use, or memory that's not mapped to your process.

In this case, buf is stored on the stack. When strcpy writes past buf, it's overwriting other data on the stack first—things like the function's return address, the base pointer (EBP/RBP), or other local variables. These are still part of your process's valid stack memory, so the OS doesn't flag an error yet.

Why does printf run before the segfault? #

After strcpy finishes (even though it corrupted the stack), the program proceeds to the next line: printf. At this point, the string data you copied is still present in memory (the stack hasn't been overwritten further, and the OS hasn't blocked access yet). Since printf uses \n, it flushes the standard output buffer immediately, so you see the full string printed.

The segfault happens later, when the function tries to return. Remember that strcpy overwrote the return address on the stack. When the function finishes executing printf, it tries to jump to that corrupted return address—which points to invalid memory. That's when the OS steps in and throws the segmentation fault.

Why no output when you remove printf? #

If you delete the printf line, the program runs strcpy, then immediately tries to return from the function. It hits that corrupted return address right away, triggering the segfault before any output can be generated. There's no step in between to print anything, so you only see the segfault message.

Important notes #

• Undefined behavior is unpredictable: On some systems, the segfault might happen during strcpy (if it writes into a protected memory page immediately). On others, the program might even appear to run without crashing (though this is still dangerous).
• Always avoid this kind of mistake: Use safer functions like strncpy (but remember to null-terminate the string) or dynamically allocate enough memory with malloc to fit the entire string.

内容的提问来源于stack exchange，提问作者tj56