In
computing
Computing is any goal-oriented activity requiring, benefiting from, or creating computing machinery. It includes the study and experimentation of algorithmic processes, and development of both hardware and software. Computing has scientific, e ...
, a segmentation fault (often shortened to segfault) or access violation is a
fault, or failure condition, raised by hardware with
memory protection
Memory protection is a way to control memory access rights on a computer, and is a part of most modern instruction set architectures and operating systems. The main purpose of memory protection is to prevent a process from accessing memory that ha ...
, notifying an
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
(OS) the software has attempted to access a restricted area of memory (a memory access violation). On standard
x86
x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel based on the Intel 8086 microprocessor and its 8088 variant. The 8086 was introd ...
computers, this is a form of
general protection fault
A general protection fault (GPF) in the x86 instruction set architectures (ISAs) is a fault (a type of interrupt) initiated by ISA-defined protection mechanisms in response to an access violation caused by some running code, either in the kernel ...
. The
operating system kernel
The kernel is a computer program at the core of a computer's operating system and generally has complete control over everything in the system. It is the portion of the operating system code that is always resident in memory and facilitates in ...
will, in response, usually perform some corrective action, generally passing the fault on to the offending
process
A process is a series or set of activities that interact to produce a result; it may occur once-only or be recurrent or periodic.
Things called a process include:
Business and management
*Business process, activities that produce a specific se ...
by sending the process a
signal
In signal processing, a signal is a function that conveys information about a phenomenon. Any quantity that can vary over space or time can be used as a signal to share messages between observers. The ''IEEE Transactions on Signal Processing'' ...
. Processes can in some cases install a custom signal handler, allowing them to recover on their own,
[''Expert C programming: deep C secrets'' By Peter Van der Linden, page 188] but otherwise the OS default signal handler is used, generally causing
abnormal termination
An abnormal end or abend is an abnormal termination of software, or a program crash.
This usage derives from an error message from the IBM OS/360, IBM zOS operating systems. Usually capitalized, but may appear as "abend". Some common ABEND codes ...
of the process (a program
crash
Crash or CRASH may refer to:
Common meanings
* Collision, an impact between two or more objects
* Crash (computing), a condition where a program ceases to respond
* Cardiac arrest, a medical condition in which the heart stops beating
* Couch su ...
), and sometimes a
core dump
In computing, a core dump, memory dump, crash dump, storage dump, system dump, or ABEND dump consists of the recorded state of the working memory of a computer program at a specific time, generally when the program has crashed or otherwise terminat ...
.
Segmentation faults are a common class of error in programs written in languages like
C that provide low-level memory access and few to no safety checks. They arise primarily due to errors in use of
pointers for
virtual memory
In computing, virtual memory, or virtual storage is a memory management technique that provides an "idealized abstraction of the storage resources that are actually available on a given machine" which "creates the illusion to users of a very l ...
addressing, particularly illegal access. Another type of memory access error is a
bus error
In computing, a bus error is a fault raised by hardware, notifying an operating system (OS) that a process is trying to access memory that the CPU cannot physically address: an invalid address for the address bus, hence the name. In modern use on ...
, which also has various causes, but is today much rarer; these occur primarily due to incorrect ''physical'' memory addressing, or due to misaligned memory access – these are memory references that the hardware ''cannot'' address, rather than references that a process is not ''allowed'' to address.
Many programming languages may employ mechanisms designed to avoid segmentation faults and improve memory safety. For example,
Rust
Rust is an iron oxide, a usually reddish-brown oxide formed by the reaction of iron and oxygen in the catalytic presence of water or air moisture. Rust consists of hydrous iron(III) oxides (Fe2O3·nH2O) and iron(III) oxide-hydroxide (FeO(OH ...
employs an ownership-based model to ensure memory safety. Other languages, such as
Lisp
A lisp is a speech impairment in which a person misarticulates sibilants (, , , , , , , ). These misarticulations often result in unclear speech.
Types
* A frontal lisp occurs when the tongue is placed anterior to the target. Interdental lisping ...
and
Java
Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's List ...
, employ
garbage collection
Waste collection is a part of the process of waste management. It is the transfer of solid waste from the point of use and disposal to the point of treatment or landfill. Waste collection also includes the curbside collection of recyclabl ...
, which avoids certain classes of memory errors that could lead to segmentation faults.
Overview
![KDE Crash Handler screenshot](https://upload.wikimedia.org/wikipedia/commons/4/42/KDE_Crash_Handler_screenshot.png)
A segmentation fault occurs when a program attempts to access a
memory
Memory is the faculty of the mind by which data or information is encoded, stored, and retrieved when needed. It is the retention of information over time for the purpose of influencing future action. If past events could not be remembered, ...
location that it is not allowed to access, or attempts to access a memory location in a way that is not allowed (for example, attempting to write to a
read-only location, or to overwrite part of the
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
).
The term "segmentation" has various uses in computing; in the context of "segmentation fault", a term used since the 1950s, it refers to the address space of a ''program.'' With memory protection, only the program's own address space is readable, and of this, only the
stack and the read/write portion of the
data segment
In computing, a data segment (often denoted .data) is a portion of an object file or the corresponding address space of a program that contains initialized static variables, that is, global variables and static local variables. The size of this seg ...
of a program are writable, while read-only data and the
code segment
In computing, a code segment, also known as a text segment or simply as text, is a portion of an object file or the corresponding section of the program's virtual address space that contains executable instructions.
Segment
The term "segment" ...
are not writable. Thus attempting to read outside of the program's address space, or writing to a read-only segment of the address space, results in a segmentation fault, hence the name.
On systems using hardware
memory segmentation
Memory segmentation is an operating system memory management technique of division of a computer's primary memory into segments or sections. In a computer system using segmentation, a reference to a memory location includes a value that identifi ...
to provide
virtual memory
In computing, virtual memory, or virtual storage is a memory management technique that provides an "idealized abstraction of the storage resources that are actually available on a given machine" which "creates the illusion to users of a very l ...
, a segmentation fault occurs when the hardware detects an attempt to refer to a non-existent segment, or to refer to a location outside the bounds of a segment, or to refer to a location in a fashion not allowed by the permissions granted for that segment. On systems using only
paging
In computer operating systems, memory paging is a memory management scheme by which a computer stores and retrieves data from secondary storage for use in main memory. In this scheme, the operating system retrieves data from secondary storage ...
, an
invalid page fault
In computing, a page fault (sometimes called PF or hard fault) is an exception that the memory management unit (MMU) raises when a process accesses a memory page without proper preparations. Accessing the page requires a mapping to be added to t ...
generally leads to a segmentation fault, and segmentation faults and page faults are both faults raised by the
virtual memory
In computing, virtual memory, or virtual storage is a memory management technique that provides an "idealized abstraction of the storage resources that are actually available on a given machine" which "creates the illusion to users of a very l ...
management system. Segmentation faults can also occur independently of page faults: illegal access to a valid page is a segmentation fault, but not an invalid page fault, and segmentation faults can occur in the middle of a page (hence no page fault), for example in a
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
that stays within a page but illegally overwrites memory.
At the hardware level, the fault is initially raised by the
memory management unit
A memory management unit (MMU), sometimes called paged memory management unit (PMMU), is a computer hardware unit having all memory references passed through itself, primarily performing the translation of virtual memory addresses to physical ad ...
(MMU) on illegal access (if the referenced memory exists), as part of its memory protection feature, or an invalid page fault (if the referenced memory does not exist). If the problem is not an invalid logical address but instead an invalid physical address, a
bus error
In computing, a bus error is a fault raised by hardware, notifying an operating system (OS) that a process is trying to access memory that the CPU cannot physically address: an invalid address for the address bus, hence the name. In modern use on ...
is raised instead, though these are not always distinguished.
At the operating system level, this fault is caught and a signal is passed on to the offending process, activating the process's handler for that signal. Different operating systems have different signal names to indicate that a segmentation fault has occurred. On
Unix-like
A Unix-like (sometimes referred to as UN*X or *nix) operating system is one that behaves in a manner similar to a Unix system, although not necessarily conforming to or being certified to any version of the Single UNIX Specification. A Unix-li ...
operating systems, a signal called SIGSEGV (abbreviated from ''segmentation violation'') is sent to the offending process. On
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
, the offending process receives a STATUS_ACCESS_VIOLATION
exception.
Causes
The conditions under which segmentation violations occur and how they manifest themselves are specific to hardware and the operating system: different hardware raises different faults for given conditions, and different operating systems convert these to different signals that are passed on to processes. The proximate cause is a memory access violation, while the underlying cause is generally a
software bug
A software bug is an error, flaw or fault in the design, development, or operation of computer software that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The process of finding and correcting bugs i ...
of some sort. Determining the
root cause Root cause may refer to:
* "Root Cause" (''Person of Interest''), a TV show episode
* Root cause analysis
In science
Science is a systematic endeavor that builds and organizes knowledge in the form of testable explanations and predic ...
–
debugging
In computer programming and software development, debugging is the process of finding and resolving '' bugs'' (defects or problems that prevent correct operation) within computer programs, software, or systems.
Debugging tactics can involve in ...
the bug – can be simple in some cases, where the program will consistently cause a segmentation fault (e.g., dereferencing a
null pointer
In computing, a null pointer or null reference is a value saved for indicating that the pointer or reference does not refer to a valid object. Programs routinely use null pointers to represent conditions such as the end of a list of unknown lengt ...
), while in other cases the bug can be difficult to reproduce and depend on memory allocation on each run (e.g., dereferencing a
dangling pointer
Dangling pointers and wild pointers in computer programming are pointers that do not point to a valid object of the appropriate type. These are special cases of memory safety violations. More generally, dangling references and wild references ar ...
).
The following are some typical causes of a segmentation fault:
* Attempting to access a nonexistent memory address (outside process's address space)
* Attempting to access memory the program does not have rights to (such as kernel structures in process context)
* Attempting to write read-only memory (such as code segment)
These in turn are often caused by programming errors that result in invalid memory access:
* Dereferencing a
null pointer
In computing, a null pointer or null reference is a value saved for indicating that the pointer or reference does not refer to a valid object. Programs routinely use null pointers to represent conditions such as the end of a list of unknown lengt ...
, which usually points to an address that's not part of the process's address space
* Dereferencing or assigning to an uninitialized pointer (
wild pointer
Wild, wild, wilds or wild may refer to:
Common meanings
* Wild animal
* Wilderness, a wild natural environment
* Wildness, the quality of being wild or untamed
Art, media and entertainment Film and television
* ''Wild'' (2014 film), a 2014 Am ...
, which points to a random memory address)
* Dereferencing or assigning to a freed pointer (
dangling pointer
Dangling pointers and wild pointers in computer programming are pointers that do not point to a valid object of the appropriate type. These are special cases of memory safety violations. More generally, dangling references and wild references ar ...
, which points to memory that has been freed/deallocated/deleted)
* A
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
* A
stack overflow
In software, a stack overflow occurs if the call stack pointer exceeds the stack bound. The call stack may consist of a limited amount of address space, often determined at the start of the program. The size of the call stack depends on many fac ...
* Attempting to execute a program that does not compile correctly. (Some compilers will output an
executable file
In computing, executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instructions", as opposed to a data fil ...
despite the presence of compile-time errors.)
In C code, segmentation faults most often occur because of errors in pointer use, particularly in
C dynamic memory allocation
C dynamic memory allocation refers to performing manual memory management for dynamic memory allocation in the C programming language via a group of functions in the C standard library, namely , , , and .
The C++ programming language includes t ...
. Dereferencing a null pointer, which results in
undefined behavior
In computer programming, undefined behavior (UB) is the result of executing a program whose behavior is prescribed to be unpredictable, in the language specification to which the computer code adheres. This is different from unspecified behavior, ...
, will usually cause a segmentation fault. This is because a null pointer cannot be a valid memory address. On the other hand, wild pointers and dangling pointers point to memory that may or may not exist, and may or may not be readable or writable, and thus can result in transient bugs. For example:
char *p1 = NULL; // Null pointer
char *p2; // Wild pointer: not initialized at all.
char *p3 = malloc(10 * sizeof(char)); // Initialized pointer to allocated memory
// (assuming malloc did not fail)
free(p3); // p3 is now a dangling pointer, as memory has been freed
Dereferencing any of these variables could cause a segmentation fault: dereferencing the null pointer generally will cause a segfault, while reading from the wild pointer may instead result in random data but no segfault, and reading from the dangling pointer may result in valid data for a while, and then random data as it is overwritten.
Handling
The default action for a segmentation fault or bus error is
abnormal termination
An abnormal end or abend is an abnormal termination of software, or a program crash.
This usage derives from an error message from the IBM OS/360, IBM zOS operating systems. Usually capitalized, but may appear as "abend". Some common ABEND codes ...
of the process that triggered it. A
core file
In computing, a core dump, memory dump, crash dump, storage dump, system dump, or ABEND dump consists of the recorded state of the working Computer storage, memory of a computer program at a specific time, generally when the program has crash (comp ...
may be generated to aid debugging, and other platform-dependent actions may also be performed. For example,
Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
systems using the grsecurity patch may log SIGSEGV signals in order to monitor for possible intrusion attempts using
buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memory ...
s.
On some systems, like Linux and Windows, it is possible for the program itself to handle a segmentation fault. Depending on the architecture and operating system, the running program can not only handle the event but may extract some information about its state like getting a
stack trace,
processor register
A processor register is a quickly accessible location available to a computer's processor. Registers usually consist of a small amount of fast storage, although some registers have specific hardware functions, and may be read-only or write-only. ...
values, the line of the source code when it was triggered, memory address that was invalidly accessed and whether the action was a read or a write.
Although a segmentation fault generally means that the program has a bug that needs fixing, it is also possible to intentionally cause such failure for the purposes of testing, debugging and also to emulate platforms where direct access to memory is needed. On the latter case, the system must be able to allow the program to run even after the fault occurs. In this case, when the system allows, it is possible to handle the event and increment the processor program counter to "jump" over the failing instruction to continue the execution.
Examples
Writing to read-only memory
Writing to read-only memory raises a segmentation fault. At the level of code errors, this occurs when the program writes to part of its own
code segment
In computing, a code segment, also known as a text segment or simply as text, is a portion of an object file or the corresponding section of the program's virtual address space that contains executable instructions.
Segment
The term "segment" ...
or the read-only portion of the
data segment
In computing, a data segment (often denoted .data) is a portion of an object file or the corresponding address space of a program that contains initialized static variables, that is, global variables and static local variables. The size of this seg ...
, as these are loaded by the OS into read-only memory.
Here is an example of
ANSI C
ANSI C, ISO C, and Standard C are successive standards for the C programming language published by the American National Standards Institute (ANSI) and ISO/IEC JTC 1/SC 22/WG 14 of the International Organization for Standardization (ISO) and the ...
code that will generally cause a segmentation fault on platforms with memory protection. It attempts to modify a
string literal
A string literal (computer programming), literal or anonymous string is a String (computer science), string value in the source code of a computer program. Modern Computer programming, programming languages commonly use a quoted sequence of charact ...
, which is undefined behavior according to the ANSI C standard. Most
compiler
In computing, a compiler is a computer program that translates computer code written in one programming language (the ''source'' language) into another language (the ''target'' language). The name "compiler" is primarily used for programs that ...
s will not catch this at compile time, and instead compile this to executable code that will crash:
int main(void)
When the program containing this code is compiled, the string "hello world" is placed in the
rodata
In computing, a data segment (often denoted .data) is a portion of an object file or the corresponding address space of a program that contains initialized static variables, that is, global variables and static local variables. The size of this s ...
section of the program
executable file
In computing, executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instructions", as opposed to a data fil ...
: the read-only section of the
data segment
In computing, a data segment (often denoted .data) is a portion of an object file or the corresponding address space of a program that contains initialized static variables, that is, global variables and static local variables. The size of this seg ...
. When loaded, the operating system places it with other strings and
constant data in a read-only segment of memory. When executed, a variable, ''s'', is set to point to the string's location, and an attempt is made to write an ''H'' character through the variable into the memory, causing a segmentation fault. Compiling such a program with a compiler that does not check for the assignment of read-only locations at compile time, and running it on a Unix-like operating system produces the following
runtime error:
$ gcc segfault.c -g -o segfault
$ ./segfault
Segmentation fault
Backtrace
In computing, a stack trace (also called stack backtrace or stack traceback) is a report of the active stack frames at a certain point in time during the execution of a program. When a program is run, memory is often dynamically allocated in two p ...
of the core file from
GDB
The GNU Debugger (GDB) is a Software portability, portable debugger that runs on many Unix-like systems and works for many programming languages, including Ada (programming language), Ada, C (programming language), C, C++, Objective-C, Free Pasc ...
:
Program received signal SIGSEGV, Segmentation fault.
0x1c0005c2 in main () at segfault.c:6
6 *s = 'H';
This code can be corrected by using an array instead of a character pointer, as this allocates memory on stack and initializes it to the value of the string literal:
char s[] = "hello world";
s[0] = 'H'; // equivalently, *s = 'H';
Even though string literals should not be modified (this has undefined behavior in the C standard), in C they are of
static char []
type, so there is no implicit conversion in the original code (which points a
char *
at that array), while in C++ they are of
static const char []
type, and thus there is an implicit conversion, so compilers will generally catch this particular error.
Null pointer dereference
In C and C-like languages,
null pointer
In computing, a null pointer or null reference is a value saved for indicating that the pointer or reference does not refer to a valid object. Programs routinely use null pointers to represent conditions such as the end of a list of unknown lengt ...
s are used to mean "pointer to no object" and as an error indicator, and
dereferencing
In computer programming, the dereference operator or indirection operator, sometimes denoted by "*" (i.e. an asterisk), is a unary operator (i.e. one with a single operand) found in List of C-family programming languages, C-like languages that in ...
a null pointer (a read or write through a null pointer) is a very common program error. The C standard does not say that the null pointer is the same as the pointer to
memory address
In computing, a memory address is a reference to a specific memory location used at various levels by software and hardware. Memory addresses are fixed-length sequences of digits conventionally displayed and manipulated as unsigned integers. Su ...
0, though that may be the case in practice. Most operating systems map the null pointer's address such that accessing it causes a segmentation fault. This behavior is not guaranteed by the C standard. Dereferencing a null pointer is
undefined behavior
In computer programming, undefined behavior (UB) is the result of executing a program whose behavior is prescribed to be unpredictable, in the language specification to which the computer code adheres. This is different from unspecified behavior, ...
in C, and a conforming implementation is allowed to assume that any pointer that is dereferenced is not null.
int *ptr = NULL;
printf("%d", *ptr);
This sample code creates a
null pointer
In computing, a null pointer or null reference is a value saved for indicating that the pointer or reference does not refer to a valid object. Programs routinely use null pointers to represent conditions such as the end of a list of unknown lengt ...
, and then tries to access its value (read the value). Doing so causes a segmentation fault at runtime on many operating systems.
Dereferencing a null pointer and then assigning to it (writing a value to a non-existent target) also usually causes a segmentation fault:
int *ptr = NULL;
*ptr = 1;
The following code includes a null pointer dereference, but when compiled will often not result in a segmentation fault, as the value is unused and thus the dereference will often be optimized away by
dead code elimination
In compiler theory, dead-code elimination (also known as DCE, dead-code removal, dead-code stripping, or dead-code strip) is a compiler optimization to remove code which does not affect the program results. Removing such code has several benefits: ...
:
int *ptr = NULL;
*ptr;
Buffer overflow
The following code accesses the character array
s
beyond its upper boundary. Depending on the compiler and the processor, this may result in a segmentation fault.
char s[] = "hello world";
char c = s[20];
Stack overflow
Another example is recursion without a base case:
int main(void)
which causes the
stack to overflow which results in a segmentation fault.
What is the difference between a segmentation fault and a stack overflow?
at Stack Overflow
In software, a stack overflow occurs if the call stack pointer exceeds the stack bound. The call stack may consist of a limited amount of address space, often determined at the start of the program. The size of the call stack depends on many fac ...
Infinite recursion may not necessarily result in a stack overflow depending on the language, optimizations performed by the compiler and the exact structure of a code. In this case, the behavior of unreachable code (the return statement) is undefined, so the compiler can eliminate it and use a tail call
In computer science, a tail call is a subroutine call performed as the final action of a procedure. If the target of a tail is the same subroutine, the subroutine is said to be tail recursive, which is a special case of direct recursion. Tail recur ...
optimization that might result in no stack usage. Other optimizations could include translating the recursion into iteration, which given the structure of the example function would result in the program running forever, while probably not overflowing its stack.
See also
* General protection fault
A general protection fault (GPF) in the x86 instruction set architectures (ISAs) is a fault (a type of interrupt) initiated by ISA-defined protection mechanisms in response to an access violation caused by some running code, either in the kernel ...
* Storage violation
In computing a storage violation is a hardware or software fault that occurs when a task attempts to access an area of computer storage which it is not permitted to access.
Types of storage violation
Storage violation can, for instance, consist ...
* Guru Meditation
Guru Meditation started as an error notice displayed by the Amiga computer when it crashes. It is now also used by Varnish, a software component used by many content-heavy websites. This has led to many internet users seeing a "Guru Meditation ...
References
External links
Process: focus boundary and segmentation fault
* ttp://c-faq.com/null/null1.html A "null pointer" explained
Answer to: NULL is guaranteed to be 0, but the null pointer is not?
{{Error messages
Articles with example C code
Computer errors
Memory management