Pointers and Memory Addresses in C

Memory can be pictured as a sequence of numbered bytes. Each number is an address. An object such as an int occupies consecutive bytes, and its address identifies its first byte. The name you use in source code lets the compiler find that object; the language does not require a name label to be stored beside its value.

Measure storage with sizeof

sizeof reports bytes and produces a size_t value. Use %zu to print it:

int scores[4] = {12, 18, 15, 21};
printf("%zu %zu\n", sizeof scores, sizeof scores[0]);

With 4-byte ints, this prints 16 4. The first result measures all four elements; the second measures one. sizeof(char) is always 1. A common 64-bit desktop layout uses 4-byte ints, 8-byte doubles, and 8-byte object pointers. Other targets can differ. Even among 64-bit systems, long commonly occupies 8 bytes on Linux and macOS but 4 on Windows.

Storage size and text length answer different questions. For char word[20] = "hi";, sizeof word is 20, while strlen(word) is 2. The array still contains 20 elements even though its string uses only two letters and a terminator. Except for variable-length arrays, these object sizes are fixed at compile time.

Follow an array's addresses

Hexadecimal addresses use digits 0 through 9, then a through f. The prefix 0x marks base 16. For an illustrative array beginning at 0x1000, four 4-byte elements start at:

0x100C is decimal 4108, twelve bytes beyond 0x1000. Array elements have no gaps. Separately declared variables have no guaranteed order or spacing; real printed addresses can also change between runs. A compiler can keep a value in a processor register when no addressable storage is needed.

Alignment and byte order

Alignment restricts where a type's objects can begin. A common layout places 4-byte ints at multiples of 4 and 8-byte doubles at multiples of 8. The compiler supplies suitable alignment for declared objects.

Endianness is the order of bytes within a multibyte value. For a 4-byte unsigned int containing 0x12345678, little-endian storage has bytes 78 56 34 12 from low to high addresses; big-endian storage has 12 34 56 78. An unsigned char * can inspect an object's representation one byte at a time. Byte order does not change the array's index order.

Keep the object alive

An ordinary local variable has automatic storage duration: its lifetime lasts through its block's execution. Typical implementations keep such objects in a call's stack frame and reuse that storage afterward. Globals, static variables, and string literals last throughout the program. Saving an address does not extend the lifetime of its object.

A pointer stores an address and has a type describing the object it can access. Declaring an int * gives you storage for a pointer; it does not create an int for that pointer to use. Give the pointer a known value when you declare it.

Take an object's address

int count = 42;
int *p = &count;

The unary address-of operator & obtains the address of count. If count begins at the illustrative address 0x1000, p holds 0x1000, while count holds 42. The pointer is also an object: &p is the address of the separate storage holding that pointer.

You can take the address of an array element, such as &scores[2]. A numeric constant or calculation result is not a stored object you can address this way: &42 and &(count + 1) are invalid. The binary expression a & b uses the same symbol for bitwise AND; the number of operands tells you which operation is present.

Read each declarator

Whitespace changes none of these types. int* p and int *p are equivalent. Declaring one pointer per line makes its star harder to miss. On common 64-bit desktops an object pointer occupies 8 bytes, but its own size does not tell you the size of the object it points to.

The target type matters. For double price = 9.5;, use double *r = &price;. Initializing an int * with &price produces an incompatible-pointer diagnostic. A cast that hides the diagnostic does not make an int access to that double valid: the type controls how the stored bytes are accessed.

Redirect a pointer

int a = 5, b = 8;
int *p = &a;
p = &b;

The final assignment replaces the address in p. It does not move either integer or copy one integer's value to the other. Now p points to b; a is still 5 and b is still 8. Several pointer variables can also store the same address.

Use a known empty state

An uninitialized local pointer has an indeterminate value, sometimes called a wild pointer. Do not inspect or dereference it. Initialize it with a valid object's address or with NULL, available from headers including <stddef.h> and <stdio.h>:

int *pending = NULL;
if (pending == NULL) {
    pending = &count;
}

A null pointer designates no object. !pending is another null test. These tests make sense only for initialized pointers; they do not validate an arbitrary address or a pointer whose object has died.

Print an object pointer

printf("%p\n", (void *)p);

%p expects void *, so supply the cast when using a typed object pointer. Its printed representation is chosen by the implementation and is commonly hexadecimal. %d and %x expect integer arguments of particular types and cannot be used as substitutes for %p.

The unary dereference operator * follows a pointer to its object. If p points to x, *p designates x itself. Reading *p reads that object; assigning to *p changes it.

Trace a write through an address

int x = 10;
int *p = &x;
*p = *p + 5;
int y = *p * 2;
printf("%d %d %d\n", x, *p, y);

First p stores the address of x. On the assignment's right side, *p reads 10. Adding 5 gives 15, and the left-side *p stores 15 in x. The next line multiplies the updated value by 2, so y becomes 30. Output is 15 15 30.

Context distinguishes the stars: int *p declares a pointer, unary *p accesses an object, and *p * 2 also contains a binary multiplication. For a valid object x, *&x designates x; for a pointer to a valid object, &*p gives back the pointer value.

Separate addresses from contents

Start each trace with two rows of information: what address each pointer holds and what value each integer holds. Suppose p points to a, containing 3, and q points to b, containing 8.

A memory diagram uses a box for each object. Label a box with its name and address, put its current value inside, and draw an arrow from a pointer to its target. An address assignment moves an arrow; a pointed-to assignment changes a target box's contents.

After p = q, the pointers are aliases for b. If you then execute *p = 20;, reading *q or b gives 20. Copying an address creates another route to the same object, not another integer.

Check that a dereference is valid

A pointer used for access must designate a live object of a suitable type, and writing also requires a modifiable object. Null pointers designate no object. Uninitialized pointers have no usable known target. A pointer becomes dangling when its target's lifetime ends.

Access through an invalid pointer is undefined behavior: C imposes no requirements on the outcome. The program may stop with a segmentation fault, corrupt data, or appear to run normally. An apparently successful run cannot establish that the access was valid.

For a pointer that can legitimately be null, test before accessing it:

if (p != NULL) {
    *p = 0;
}

Assigning NULL to a pointer you no longer need can prevent later accidental use of that variable. It does not reset other aliases. Keep track of the object's lifetime separately.

Put parentheses around the value you mean

Postfix ++ binds more tightly than unary *. Thus *p++ means *(p++): it uses the old pointer to reach a value and advances the pointer. (*p)++ increments the pointed-to value and leaves the pointer in place. *p + 1 reads the value and adds 1 without storing the result. These are three different actions.

C passes every argument by value. A parameter is a local variable initialized from the argument. Passing an address does not change that rule: the function receives a copy of the address, and that copy can reach the caller's object.

Compare two reset functions

void reset_copy(int n) {
    n = 0;
}

void reset(int *n) {
    *n = 0;
}

For int score = 12;, reset_copy(score) changes only its local n. score stays 12. The call reset(&score) copies score's address into pointer parameter n; assigning to *n then changes score to 0. This technique is often called pass by reference, although the language's actual argument passing remains by value.

The address in the call and the dereference in the body do different jobs. &score tells the function where the object is. *n = 0 tells it what to store there. Calling reset(score) supplies an integer where a pointer is required and triggers a compiler diagnostic.

Work through a swap

void swap(int *a, int *b) {
    int t = *a;
    *a = *b;
    *b = t;
}

/* Inside a calling function: */
int x = 3, y = 8;
swap(&x, &y);

1. a points to x and b points to y.
2. t saves the original x, which is 3.
3. *a = *b writes 8 into x.
4. *b = t writes the saved 3 into y.

Both caller variables change. A version taking plain int a, int b exchanges only copies. A pointer version that does int *t = a; a = b; b = t; also fails to exchange the integers: it redirects only the local pointer parameters.

Deliver more than one result

A return statement supplies one value, but pointer parameters can carry additional outputs:

void divide(int total, int size, int *q, int *r) {
    *q = total / size;
    *r = total % size;
}

/* size must be positive for these example inputs. */
int q, r;
divide(17, 5, &q, &r);

Integer division gives q equal to 3 and r equal to 2. The caller supplies two distinct writable objects. Another useful interface returns a success status and writes an output only on success; callers check that status before using the output.

Recognize the same pattern in library calls

scanf("%d", &age) needs age's address because it stores a parsed integer there. Passing age supplies a value instead of the required int *, producing undefined behavior. Check that scanf returns 1 before using the newly read value.

For text, char name[20]; scanf("%19s", name); passes a pointer to the array's first character. The width allows at most 19 input characters, leaving room for '\0'. The array expression already provides the required character pointer.

An array parameter likewise receives an address, not a copied block of elements. In void zero(int *a, size_t n), assignments to a[i] affect the caller's array. Passing the address copies only a pointer, which also lets read-only functions inspect large arrays without copying every element.

A pointer interface should make two things clear: whether the function may write through it, and how long the pointed-to storage remains valid. const answers the first question. The object's lifetime answers the second.

Locate the const restriction

A pointer to const limits this access path. If x was defined as ordinary int x = 5;, x = 6; is still allowed even while a const int * points to it. If the object itself was defined const, attempting to modify it through any pointer is undefined behavior.

A const pointer keeps one address. It must be initialized, and the address cannot later be replaced. The object at that address can still change when its type permits it. Read outward from the name: int *const p makes p constant; const int *p protects the int reached through p.

Use a read-only parameter such as const char *s when a function only examines a string. An ordinary char * can be passed to that parameter without a cast. The function can advance its local s, but assigning through *s is rejected. Converting back to a writable type requires more than removing a compiler warning: the underlying object must actually be modifiable.

Return a position in caller-owned storage

int *find(int *a, size_t n, int target) {
    for (size_t i = 0; i < n; i++) {
        if (a[i] == target) return &a[i];
    }
    return NULL;
}

For int v[] = {4, 9, 2, 9};, find(v, 4, 9) returns &v[1]. The function ends, but v belongs to the caller and remains alive there. After checking the result against NULL, the caller can compute found - v to obtain index 1 or assign *found = 0 to update the element. A search for 7 returns NULL, which must not be dereferenced. strchr and strstr use the same null-for-not-found convention.

Reject addresses of expired locals

int *bad(void) {
    int result = 42;
    return &result;
}

result has automatic storage duration. Its lifetime ends when the call returns, leaving the caller with a dangling pointer. The compiler may warn, and any later access through that pointer has undefined behavior. The old bytes being visible on one run does not keep the object alive.

The same problem can occur at an inner block's closing brace. An outer pointer cannot extend the lifetime of an inner variable whose address it saved.

Choose storage that lasts long enough

Return an int value when the caller needs only an integer result. For several results, let the caller supply storage to fill. A returned pointer can also refer to the caller's array, a string literal exposed through const char *, or a static object.

A static local is initialized once and lasts throughout the program, but all calls share it. If a later call stores a new value there, every earlier returned pointer sees that change. Static storage solves the lifetime problem without giving each call its own independent result object.

Adding an integer to a pointer moves by elements of the pointed-to type. If p points to array element i, p + n points to element i + n, provided the resulting position is within the array or one past it.

Scale the address once

At an illustrative address 0x1000, adding 3 gives these results:

The compiler performs the scaling. Writing p + 3 * sizeof *p scales twice and generally goes to the wrong element. Use unsigned char * when the intended step really is one byte of an object's representation.

For int a[6] = {10, 20, 30, 40, 50, 60}; and int *p = &a[1];, *(p + 2) reads a[3], which is 40. The assignment p += 3; moves the pointer itself to a[4], containing 50. From there *(p - 1) reads 40. p++, p--, p += n, and p -= n all use element steps.

Subtract positions to count elements

&a[5] - &a[1] is 4, and reversing the operands gives -4. The result already counts elements; do not divide it by sizeof(int). Its signed type is ptrdiff_t, declared in <stddef.h>, and %td prints it.

Subtract only pointers into the same array, including its one-past position, with a result representable in ptrdiff_t. This operation describes positions within that array. Subtracting addresses of unrelated variables is undefined behavior even if the printed numbers happen to be close.

Use the one-past position as a boundary

For six elements, a + 6 is a valid one-past-the-end pointer. It can serve as a bound and participate in valid same-array subtraction, but it cannot be dereferenced. a + 7 and a - 1 already have undefined behavior when formed; avoiding a later dereference does not repair them.

for (int *p = a; p < a + 6; p++) {
    printf("%d\n", *p);
}

The body runs for indices 0 through 5. After the final increment, p equals a + 6, and the next test stops the loop. Using <= would allow the body to access that non-element.

For arithmetic rules, a single object acts like a one-element array. You may form &x + 1; you may not use it to read a supposed next variable.

Compare only meaningful positions

Ordering operators such as < compare positions within one array. Do not order pointers to unrelated objects. Equality and inequality can compare compatible pointer types and can test against a null pointer.

You cannot add two pointers, multiply pointers, or do standard C arithmetic on a void * or a function pointer. To find the midpoint of a same-array range [p, q), use p + (q - p) / 2: subtract positions to obtain a count, divide that count, then advance from p.

An array is a block of elements. A pointer is a separate object holding an address. Their close relationship comes from an automatic conversion that happens in most expressions, not from the two objects being the same kind of thing.

Convert an array expression

int a[5] = {3, 1, 4, 1, 5};
int *p = a;

Here a converts to a pointer to a[0]. This array-to-pointer conversion, often called decay, makes the initializer equivalent to &a[0]. Both *p and a[0] read 3.

C defines subscripting through arithmetic: a[i] means *(a + i). Therefore p[3] works too and reads 1. &a[i] and a + i identify the same element. Even 3[a] has the same defined meaning as a[3], although the usual spelling is much clearer.

Know when the whole array stays an array

The conversion does not occur for operands of sizeof or unary &. It also does not occur for C23 typeof and typeof_unqual, or when a string literal initializes a character array.

You cannot assign a new address to an array or increment its name: a = p; and a++; are invalid. You can redirect p, such as with p = a + 2;. Copy array contents with an element loop or an appropriate memcpy call.

Follow the adjusted parameter type

int sum(const int *values, size_t n) {
    int total = 0;
    for (size_t i = 0; i < n; i++) total += values[i];
    return total;
}

The caller supplies both an address and a count. For the array above, sum(a + 2, 3) visits original indices 2, 3, and 4, adding 4, 1, and 5 to return 10. Inside the function, index 0 is relative to the supplied starting pointer.

In a function parameter list, int a[], int a[10], and int *a all declare a pointer parameter. The plain [10] spelling supplies no checked bound and transfers no length. Inside such a function, sizeof a measures a pointer. The expression sizeof a / sizeof a[0] would give 2 on an 8-byte-pointer, 4-byte-int system, regardless of the caller's real array length.

Distinguish an element pointer from an array pointer

a converts to int *, while &a has type int (*)[5], a pointer to the whole five-element array. Both identify the beginning of the same storage, but arithmetic follows their different types. a + 1 advances one int, or 4 bytes in this layout. &a + 1 advances one entire array, or 20 bytes, to its one-past position.

A printed starting address cannot reveal that type difference. Read the declaration and keep the pointed-to type beside the pointer when tracing an expression.

A pointer loop needs a current position and a stopping rule. A counted array uses an end pointer; a string uses its terminating '\0'. Choose the form that makes the visited elements easiest to see.

Traverse a counted range

int a[] = {3, 1, 4, 1, 5};
int total = 0;
for (const int *p = a; p < a + 5; p++) {
    total += *p;
}

The running totals are 3, 4, 8, 9, and 14. An indexed loop adding a[i] for indices below 5 gives the same result. Modern optimizing compilers often generate similar code for these forms; pointer syntax alone promises no speed advantage.

Read before or after moving

With p at the 3 in {3, 1, 4}, int v = *p++; sets v to 3 and leaves p at the 1. Postfix increment supplies the old pointer value to * and updates the pointer. *++p first moves to the next element and then reads it. (*p)++ changes the current element and does not move the pointer.

Stop on a string terminator

size_t my_strlen(const char *s) {
    const char *p = s;
    while (*p != '\0') p++;
    return (size_t)(p - s);
}

For "pointer", p stops on the terminator, seven positions from the start. The result excludes that terminator. A character count uses the same walk: scanning "mississippi" and incrementing a counter whenever *p == 's' counts four matches among eleven letters.

A pointer into the middle of a string gives access to its suffix. With const char *msg = "hello world";, puts(msg + 6) prints "world". The earlier characters stay where they were.

Copy the terminator too

char destination[4];
const char *src = "cat";
char *dst = destination;
while ((*dst++ = *src++) != '\0') {
}

Each iteration assigns one character, tests the assigned value, and advances both pointers. The final iteration copies '\0', so the destination is a complete string. Both pointers then stand just beyond their terminators. The storage needs the text length plus one byte; omitting that extra byte causes a buffer overflow. This copy pattern also requires nonoverlapping source and destination ranges.

Reverse from both ends

For a writable string, first obtain its length. If the length is zero, stop before forming a last-character pointer. Otherwise set left = s and right = s + length - 1. While left < right, exchange the characters, increment left, and decrement right. For "stressed", four swaps produce "desserts"; the terminator remains at the original end.

The empty-string check matters because subtracting 1 from its starting pointer would form a pointer before the array.

Choose writable character storage

char word[] = "hello"; creates a modifiable six-byte array, including the terminator. const char *word = "hello"; points to a string literal with static storage duration. Modifying a string literal is undefined behavior, even if a declaration uses char * without const. Use const char * to make accidental writes a compiler error.

An array loop must stop before its one-past position, and a string walk must actually encounter a terminator within accessible storage. A pointer carries neither a length nor a guarantee that the bytes form a string.

A pointer is a stored object, so it has an address that another pointer can hold. A pointer to a pointer adds one more step between the expression and the final data.

Follow the arrows one at a time

int x = 7;
int *p = &x;
int **pp = &p;

Use illustrative addresses: x at 0x2000 holds 7; p at 0x3000 holds 0x2000; pp at 0x4000 holds 0x3000. Evaluating *pp reaches p, whose value has type int *. Evaluating **pp follows that pointer onward to x, an int.

&p has one more pointer level than p; each dereference removes one level. Initializing int **pp with &x is a mismatch because &x has type int *.

Choose the assignment level

With another live integer y, **pp = 9; changes x. The assignment *pp = &y; changes the pointer p, so future uses of **pp reach y. It leaves x at its current value. If q is another int *, pp = &q; changes only the outer pointer, making its first arrow reach q instead of p.

Do not count stars without also checking the object at each level. Before evaluating **pp, both the route to the pointer object and that object's route to the integer must be valid.

Move a caller's string pointer

void skip_spaces(const char **s) {
    while (**s == ' ') {
        (*s)++;
    }
}

/* In the caller: */
const char *text = "   hi";
skip_spaces(&text);
puts(text);

The caller passes the address of its pointer variable. *s therefore designates text; **s reads the current character. Each (*s)++ advances text by one character. After three iterations it points to 'h', and puts prints "hi". The function requires a valid pointer to a pointer into a null-terminated string.

A version taking const char *s and incrementing s changes only a local copy. The parentheses in (*s)++ are also essential: *s++ increments the outer local pointer instead of the caller's character pointer. In const char **s, the characters are read-only through this access path, but the caller's pointer may move.

Read a library output pointer

strtol from <stdlib.h> uses an output parameter of type char **:

char *end;
long number = strtol("42abc", &end, 10);

It returns 42 and stores a pointer to the first unused character in end, which now reaches "abc". If the end pointer equals the starting pointer, no digits were converted. A fully checked numeric parser also handles range errors; the pointer's job here is to report the stopping position.

An array can store pointers as its elements. A two-dimensional array instead stores complete rows as its elements. Both support two subscripts, but their storage and converted pointer types differ.

Store addresses of separate strings

const char *days[] = {"Mon", "Tue", "Wed"};

days holds three character pointers. Each points to a separate string literal. days[1] is the pointer to "Tue", and days[1][0] reads 'T'. With 8-byte object pointers, sizeof days is 24, regardless of the strings' lengths. The strings themselves occupy storage elsewhere.

The lengths can differ, producing a ragged collection. Reordering the list can exchange pointer elements without copying the text. Assigning days[0] = "Thursday"; is allowed: the pointer element can change even though characters reached through it are read-only.

In most expressions, days converts to a pointer to its first element. Because an element is a const char *, the converted type is const char **:

for (const char **d = days; d < days + 3; d++) {
    puts(*d);
}

The loop advances by one pointer element per iteration. *d retrieves the character pointer that puts needs.

Read command-line strings

int main(int argc, char *argv[]) receives the same parameter type as char **argv. argc is nonnegative and counts the available strings. When it is positive, argv[0] represents the program name or an empty string if that name is unavailable. User arguments occupy indices 1 through argc - 1, and argv[argc] is a null pointer.

For a typical invocation ./greet Ada 42, argc is 3, argv[1] points to "Ada", and argv[2] points to "42". The last argument is text until a conversion such as strtol reads it. argv[1][0] is 'A'. Check argc > 2 before using argv[2].

A loop that prints user arguments can use for (int i = 1; i < argc; i++) puts(argv[i]);. To walk from argv + 1 until a null pointer instead, first check argc > 0; if argc is zero, there is no user-argument range to start that way. Argument strings are modifiable, unlike string literals.

Follow complete rows

int grid[3][4] contains twelve integers in row-major order: all of row 0, then row 1, then row 2. With 4-byte ints, each row occupies 16 bytes. grid[2][1] lies 36 bytes after grid[0][0]: two complete rows contribute 32 bytes and the column contributes 4.

grid + 1 advances one row. A function accepting it can use int g[][4] or int (*g)[4], with a separate row count. It cannot use int **: the grid has no stored row pointers to dereference. A cast cannot manufacture those missing pointers.

Similarly, char names[3][6] owns eighteen character slots in fixed-size rows. const char *names[3] owns three pointer slots that can refer to strings of different lengths.

A function pointer stores a reference to a function that can be called later. Its type includes the return type and parameter types. Those types must match the function used through the pointer.

Put parentheses around the pointer name

int add(int a, int b) { return a + b; }
int sub(int a, int b) { return a - b; }
int mul(int a, int b) { return a * b; }

int (*op)(int, int) = add;

Read from op: it is a pointer, the pointed-to thing is a function taking two ints, and that function returns an int. Without the parentheses, int *op(int, int); declares a function returning an integer pointer. The parentheses change the declaration's meaning.

A function name converts to a function pointer in this initializer. op = &add; is equivalent to op = add;. Both op(6, 3) and (*op)(6, 3) call add and return 9. Assigning op = sub; makes the same call return 3. Nothing about the call expression has changed except the function stored in the pointer.

Keep the signature compatible

A pointer of type int (*)(int, int) cannot safely call a function taking and returning double. For example, assigning sqrt to it produces an incompatible-type diagnostic. Casting the function pointer to silence a diagnostic does not make a mismatched call valid; the behavior is undefined.

Standard C treats object pointers and function pointers separately. void * is the generic object-pointer type, not a portable container for a function pointer. Function pointers support equality and inequality tests, but no pointer arithmetic.

A null function pointer means there is no callable function. When an interface permits that state, check it:

if (op != NULL) {
    int result = op(6, 3);
    printf("%d\n", result);
}

Calling through a null function pointer is undefined behavior.

Name the type once

typedef int (*binop)(int, int);
binop ops[] = {add, sub, mul};

The typedef names a pointer type. binop selected = mul; declares one pointer; binop pick(char symbol); declares a function returning one. Without the typedef, that return declaration would be int (*pick(char symbol))(int, int);.

An array of function pointers is a dispatch table. ops[2](6, 3) selects mul and returns 18. For a signed selection index i, check i >= 0 && i < 3 before evaluating ops[i]. Indexing outside the table is invalid even if every stored function is otherwise callable.

Read larger declarations outward

Start with the name and resolve parentheses and postfix parts before moving farther outward. In int (*table[3])(int, int), table[3] makes an array of three elements, * makes each element a pointer, and (int, int) makes its target a function returning int.

In char *(*f)(const char *), f is a pointer to a function taking a const char *; that function returns a char *. Keep the returned pointer's lifetime requirements separate from the function pointer's compatible-call requirements.

A callback is a function supplied to another function, which calls it as part of its work. This separates the general traversal or sorting operation from the particular action or ordering you choose.

Pass an operation without calling it

void twice(int *x) { *x *= 2; }

void for_each(int *a, size_t n, void (*fn)(int *)) {
    for (size_t i = 0; i < n; i++) fn(&a[i]);
}

For int v[] = {1, 2, 3};, for_each(v, 3, twice); produces {2, 4, 6}. The function name supplies a pointer. Writing twice() would try to call it immediately, with no required argument, instead of supplying an operation for later calls.

Recover a type from a generic object pointer

A void * can carry an object pointer and convert back to the original type. It cannot be dereferenced or used in standard C pointer arithmetic because it supplies no element type. Preserve qualifiers: read-only data travels through const void *, then through an appropriate pointer to const.

qsort from <stdlib.h> takes a base address, an element count, an element size in bytes, and a comparison callback. The callback has type int (*)(const void *, const void *). Each argument points to an array element, and the returned sign says where the first element belongs:

Sort integers without overflow

int cmp_int(const void *a, const void *b) {
    int x = *(const int *)a;
    int y = *(const int *)b;
    return (x > y) - (x < y);
}

/* In the caller: */
int v[] = {42, -7, 19, 0, 3};
qsort(v, 5, sizeof v[0], cmp_int);

The array becomes {-7, 0, 3, 19, 42}. Comparisons produce 0 or 1, so the return expression produces only -1, 0, or 1. Reversing the ordering expression to (y > x) - (y < x) sorts in descending order.

Do not use return x - y; for arbitrary signed integers. For 32-bit int, subtracting -2000000000 from 2000000000 exceeds INT_MAX. Signed overflow has undefined behavior, so there is no promised wrapped result or reliable comparison sign.

Sort pointers to strings

int cmp_str(const void *a, const void *b) {
    return strcmp(*(const char *const *)a,
                  *(const char *const *)b);
}

const char *names[] = {"Lin", "Ada", "Grace"};
qsort(names, 3, sizeof names[0], cmp_str);

Include <string.h> for strcmp. An array element here is itself a pointer. The callback receives an address of that pointer element, so dereferencing once retrieves the string address. The added inner const prevents changing the element through this access path. After sorting, the order is "Ada", "Grace", "Lin".

strcmp(a, b) would read the bytes of the pointer slots as text. Also use sizeof names[0], the size of a pointer element, not sizeof(char) or the length of a name.

Comparators must leave elements unchanged and answer consistently, including transitive ordering. qsort does not promise to preserve the order of elements that compare equal. bsearch accepts the same comparator shape to search an array already sorted according to that ordering.