Pointers & References

Every variable lives somewhere in memory, and that location has an address. The unary & operator gives you a variable's address: &score. A pointer is a variable whose value is an address. int* p = &score; declares p as "pointer to int" and stores the address of score in it.

Following a pointer to the thing it points at is called dereferencing, and uses unary *: *p is score. Reading *p reads score; assigning *p = 95 changes score. The same symbols mean different things in different places, which is the main source of confusion:

#include <iostream>

int main() {
    int score = 90;
    int* p = &score;            // p holds the address of score

    std::cout << "score = " << score << '\n';
    std::cout << "*p    = " << *p << '\n';      // follow the pointer

    *p = 95;                    // writes into score
    std::cout << "score = " << score << '\n';

    int bonus = 5;
    p = &bonus;                 // a pointer can be re-aimed
    *p += 1;
    std::cout << "bonus = " << bonus << ", score still " << score << '\n';

    std::cout << std::boolalpha << (p == &bonus) << '\n';   // compare addresses
    std::cout << "a pointer takes " << sizeof(p) << " bytes\n";
}

score = 90
*p    = 90
score = 95
bonus = 6, score still 95
true
a pointer takes 8 bytes

int main() {
    int score = 90;
    int* p = score;
    return *p;
}

main.cpp:3:10: error: cannot initialize a variable of type 'int *' with an lvalue of type 'int'
    3 |     int* p = score;
      |          ^   ~~~~~

int main() {
    int score = 90;
    int* p = &score;
    return *p == 90 ? 0 : 1;
}

A pointer does not have to point at anything. The value nullptr means "no object", and it is how functions that return a pointer say "not found". Always initialise a pointer, either to a real address or to nullptr: an uninitialised local pointer holds garbage, and dereferencing it is undefined behaviour. Dereferencing nullptr is also undefined behaviour, so check first. A pointer converts to bool, so if (p) means "if p is not null".

#include <iostream>

// Returns the address of the first negative element, or nullptr if there is none.
int* findFirstNegative(int* arr, int n) {
    for (int i = 0; i < n; ++i) {
        if (arr[i] < 0) return &arr[i];
    }
    return nullptr;
}

int main() {
    int temps[] = {4, -3, 7, -8};
    int* neg = findFirstNegative(temps, 4);
    if (neg) {                                   // same as: neg != nullptr
        std::cout << "first negative: " << *neg << '\n';
        *neg = 0;                                // fix it in the array itself
    }
    std::cout << "temps[1] is now " << temps[1] << '\n';

    int summer[] = {21, 19, 24};
    int* none = findFirstNegative(summer, 3);
    if (none == nullptr) std::cout << "no negatives\n";
}

first negative: -3
temps[1] is now 0
no negatives

#include <iostream>

int* findFirstNegative(int* arr, int n) {
    for (int i = 0; i < n; ++i) {
        if (arr[i] < 0) return &arr[i];
    }
    return nullptr;
}

int main() {
    int temps[] = {21, 19, 24};
    int* neg = findFirstNegative(temps, 3);
    std::cout << "first negative: " << *neg << '\n';
}

$ c++ -std=c++20 -fsanitize=address -g main.cpp && ./a.out
AddressSanitizer:DEADLYSIGNAL
=================================================================
==84528==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000100328b54 bp 0x00016fad6680 sp 0x00016fad6580 T0)
==84528==The signal is caused by a READ memory access.
==84528==Hint: address points to the zero page.
    #0 0x000100328b54 in main main.cpp:13

int* neg = findFirstNegative(temps, 3);
if (neg) std::cout << "first negative: " << *neg << '\n';
else     std::cout << "no negatives\n";

The elements of an array sit next to each other in memory. If p points at element i, then p + 1 points at element i + 1: adding 1 moves by one element, not one byte (for int that is 4 bytes). In fact arr[i] is defined as *(arr + i), and an array name decays to a pointer to its first element, as Module 04 showed.

• p + n, p - n, ++p, --p move within the array.
• q - p gives the number of elements between two pointers into the same array (type std::ptrdiff_t).
• A pointer may point one past the last element (the "end" pointer). You may compare with it but never dereference it. This is exactly the idea behind v.end() for containers.
• Moving a pointer further than one past the end, or before the start, is undefined behaviour, even if you never dereference it.

#include <iostream>

int main() {
    int marks[5] = {72, 88, 95, 60, 81};
    int* first = marks;               // decays to &marks[0]
    int* end = marks + 5;             // one past the last element

    std::cout << *(first + 2) << " == " << marks[2] << '\n';

    int total = 0;
    for (int* p = first; p != end; ++p) {   // walk the array by pointer
        total += *p;
    }
    std::cout << "total " << total << '\n';

    int* best = first;
    for (int* p = first + 1; p != end; ++p) {
        if (*p > *best) best = p;
    }
    std::cout << "best " << *best << " at index " << (best - first) << '\n';
}

95 == 95
total 396
best 95 at index 2

A pointer involves two things that can each be const: the object it points at, and the pointer itself. Read the declaration right to left, starting at the variable name: const int* p is "p is a pointer to an int that is const"; int* const p is "p is a const pointer to an int".

#include <iostream>

// Promises not to modify the array: callers can pass const data too.
int sum(const int* arr, int n) {
    int total = 0;
    for (int i = 0; i < n; ++i) total += arr[i];
    return total;
}

int main() {
    const int fixedFees[3] = {100, 250, 75};
    std::cout << sum(fixedFees, 3) << '\n';

    int a = 1, b = 2;
    const int* reader = &a;   // cannot write through it...
    reader = &b;              // ...but can point somewhere else
    std::cout << *reader << '\n';

    int* const handle = &a;   // cannot re-aim...
    *handle = 10;             // ...but can write through it
    std::cout << a << '\n';
}

425
2
10

int main() {
    int limit = 100;
    const int* p = &limit;
    *p = 200;
}

main.cpp:4:8: error: read-only variable is not assignable
    4 |     *p = 200;
      |     ~~ ^

int main() {
    int limit = 100;
    int* p = &limit;
    *p = 200;
    return limit == 200 ? 0 : 1;
}

int main() {
    int a = 1, b = 2;
    int* const p = &a;
    p = &b;
}

main.cpp:4:7: error: cannot assign to variable 'p' with const-qualified type 'int *const'
    4 |     p = &b;
      |     ~ ^
main.cpp:3:16: note: variable 'p' declared const here
    3 |     int* const p = &a;
      |     ~~~~~~~~~~~^~~~~~

A reference (int& r = x;) is another name for an existing object. You met them as parameters in Module 03. Under the hood the compiler usually implements a reference as a pointer, but the language gives it three rules that make it safer and simpler to use:

Both let a function modify the caller's variable. Passing a pointer makes the call site explicit (swap(&a, &b) shows that a and b may change) and lets the caller pass nullptr for "I do not want this". Passing a reference is shorter and cannot be null. C APIs use pointers everywhere because C has no references; modern C++ prefers references, and uses a pointer parameter only when null is a meaningful value.

#include <iostream>
#include <string>

void swapByPointer(int* a, int* b) {
    int tmp = *a;
    *a = *b;
    *b = tmp;
}

void swapByReference(int& a, int& b) {
    int tmp = a;
    a = b;
    b = tmp;
}

// errorOut is optional: pass nullptr if you do not care why parsing failed
bool parseAge(const std::string& text, int& age, std::string* errorOut) {
    if (text.empty() || text.find_first_not_of("0123456789") != std::string::npos) {
        if (errorOut) *errorOut = "not a number: '" + text + "'";
        return false;
    }
    age = std::stoi(text);
    return true;
}

int main() {
    int x = 1, y = 2;
    swapByPointer(&x, &y);
    std::cout << x << ' ' << y << '\n';
    swapByReference(x, y);
    std::cout << x << ' ' << y << '\n';

    int age = 0;
    std::string why;
    if (!parseAge("4x", age, &why)) std::cout << why << '\n';
    if (parseAge("31", age, nullptr)) std::cout << "age " << age << '\n';
}

2 1
1 2
not a number: '4x'
age 31

A pointer or reference only means something while the object it refers to is alive. When the object is destroyed, the pointer still holds the old address, but that memory now belongs to something else, or to nothing. Such a pointer is dangling, and using it is undefined behaviour: the program may print the old value, a random value, or crash, and it may do different things on different runs. The three classic ways to create one:

1. Returning the address of (or a reference to) a local variable. Locals die when the function returns.
2. Keeping a pointer into a container that then reallocates. push_back on a full std::vector moves every element to a new buffer and frees the old one.
3. Using a pointer after delete (use-after-free), covered in Module 06.

#include <iostream>

int* makeCounter() {
    int count = 0;
    return &count;
}

int main() {
    int* c = makeCounter();
    std::cout << *c << '\n';
}

main.cpp:5:13: warning: address of stack memory associated with local variable 'count' returned [-Wreturn-stack-address]
    5 |     return &count;
      |             ^~~~~

int makeCounter() {
    int count = 0;
    return count;          // a copy of the value, no pointer at all
}

#include <iostream>
#include <vector>

int main() {
    std::vector<int> scores{70, 85};
    int* best = &scores[1];          // points into the vector's buffer
    scores.push_back(92);            // may move the buffer elsewhere
    std::cout << *best << '\n';
}

$ c++ -std=c++20 -fsanitize=address -g main.cpp && ./a.out
==84921==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000000f4 at pc 0x000100900b14 bp 0x00016f4fe4b0 sp 0x00016f4fe4a8
READ of size 4 at 0x6020000000f4 thread T0
    #0 0x000100900b10 in main main.cpp:8

freed by thread T0 here:
    ... (frames inside std::vector::push_back)
    #11 0x000100900aac in main main.cpp:7

SUMMARY: AddressSanitizer: heap-use-after-free main.cpp:8 in main

std::vector<int> scores{70, 85};
std::size_t best = 1;              // an index survives reallocation
scores.push_back(92);
std::cout << scores[best] << '\n';  // 85

With a pointer to a struct, (*p).name reaches a member, but the parentheses are needed because . binds tighter than *. The arrow operator p->name is the shorthand everyone uses. You will see -> constantly: with smart pointers, iterators, and this inside classes.

An array (or vector) of pointers lets several "views" refer to the same objects without copying them: for example, a list of the employees who are on call, pointing into the main list. The pointers do not own anything, so the objects they point at must outlive them.

#include <iostream>
#include <string>
#include <vector>

struct Employee {
    std::string name;
    int salary;
};

void giveRaise(Employee* e, int percent) {
    e->salary += e->salary * percent / 100;   // same as (*e).salary
}

int main() {
    std::vector<Employee> staff{{"Asha", 50000}, {"Ravi", 42000}, {"Meera", 61000}};

    Employee* first = &staff[0];
    giveRaise(first, 10);
    std::cout << first->name << ": " << first->salary << '\n';

    // Non-owning pointers into staff: no Employee is copied.
    std::vector<Employee*> onCall{&staff[2], &staff[0]};
    for (Employee* e : onCall) {
        std::cout << "on call: " << e->name << '\n';
    }
    onCall[0]->salary += 1000;                  // changes staff[2] itself
    std::cout << staff[2].name << ": " << staff[2].salary << '\n';
}

Asha: 55000
on call: Meera
on call: Asha
Meera: 62000

Address

Where an object lives in memory. &x gives the address of x.

Pointer

A variable that holds an address. T* is "pointer to T".

Dereference

Following a pointer to the object: *p, or p->member for a struct.

nullptr

The null pointer value: points at no object. Dereferencing it is undefined behaviour.

Pointer arithmetic

p + n moves n elements (not bytes) through an array.

One-past-the-end pointer

A pointer just after the last element of an array. Valid to compare, never to dereference.

Pointer to const

const T* p: cannot modify the object through p, but p can be re-aimed.

Const pointer

T* const p: p cannot be re-aimed, but the object can be modified.

Reference

Another name for an existing object. Must be initialised, cannot be null, cannot be rebound.

Dangling pointer

A pointer or reference to an object that has been destroyed. Using it is undefined behaviour.

AddressSanitizer (ASan)

A compiler feature (-fsanitize=address) that instruments memory accesses and reports use-after-free, out-of-bounds and similar bugs with the exact line.