What are the most common mistakes in C programming?

The most common C programming mistakes: (1) Structure — missing #include, void main(), missing semicolons, mismatched braces. (2) Logic — missing braces around if/for bodies, using = instead of == in conditions, off-by-one array errors. (3) Memory — not checking malloc return value, forgetting free, buffer overflows. (4) Runtime — NULL pointer dereference, integer overflow, infinite recursion.

What causes segmentation fault in C?

Segfault in C occurs when the program accesses invalid memory: dereferencing a NULL pointer (fopen/malloc returned NULL but wasn't checked), array out-of-bounds access, use-after-free, or stack overflow from infinite recursion. Diagnose with: gcc -g -fsanitize=address prog.c -o prog && ./prog

What is an off-by-one error in C?

Off-by-one occurs when a loop iterates one too many or too few times. Arrays are 0-indexed — a 5-element array has indices 0..4. Using i <= n instead of i < n accesses arr[n] which is out of bounds — undefined behavior. Always use: for (int i = 0; i < n; i++) to access all n elements.

What is the = vs == bug in C?

if (x = 5) assigns 5 to x and evaluates to true (non-zero), so the body always runs regardless of x's original value. It compiles silently. GCC -Wall warns: 'suggest parentheses around assignment used as truth value'. Fix: use == for comparison. Yoda conditions (if (5 == x)) make the typo a compile error.

Last updated: March 2025

Common Mistakes in C Programming: 16 Errors With Exact Fixes

Q: Why does my C program compile but give wrong output?

Common causes: using = instead of == in an if condition (always true), missing braces so only one statement is in the if-body, off-by-one loop error, reading an uninitialized variable (garbage value), or integer overflow. Compile with -Wall -fsanitize=undefined to catch most of these.

Q: What is undefined behavior in C?

Undefined behavior means the C standard makes no guarantee — the program might crash, produce wrong output, or appear to work but fail after a compiler update. Common causes: signed integer overflow, reading uninitialized variables, NULL dereference, array out-of-bounds, use-after-free. Catch with -fsanitize=undefined.

Q: How do I find memory leaks in C?

Two tools: (1) valgrind --leak-check=full ./prog — exhaustive, reports exact allocation sites. (2) gcc -fsanitize=address prog.c -o prog && ./prog — AddressSanitizer, ~2x overhead, reports leaks at exit. Use ASan for daily dev; valgrind for final checks.

Q: What is the = vs == bug in C?

if (x = 5) assigns 5 to x and evaluates to true (non-zero), so the body always runs regardless of x's original value. It compiles silently. GCC -Wall warns: 'suggest parentheses around assignment used as truth value'. Fix: use == for comparison. Yoda conditions (if (5 == x)) make the typo a compile error.

By CoodeVerse Editorial Team March 1, 2025 ⏱ 11 min read

Every C programmer hits the same wall of mistakes. The good news: most of them produce specific, recognizable symptoms — a specific compiler error, crash pattern, or wrong output. This guide organizes the 16 most common mistakes into four categories, gives you the exact error message or symptom, shows the broken code and the fix, and tells you which compiler flag or tool catches it.

🔴

Category 1 — Structure Errors

Detected at compile time. GCC refuses to build until fixed.

Mistake 1Missing #include for a function

warning: implicit declaration of function 'printf'

Caught by: gcc -Wall (warning; error in C99+)

You called a function without including the header that declares it. In C99 and later, calling an undeclared function is an error. The error always names the function — search for the header that declares it.

❌ missing include

int main() {
    printf("Hi\n");  // undeclared
    return 0;
}

✅ fixed

#include <stdio.h>
int main() {
    printf("Hi\n");
    return 0;
}

Mistake 2void main() instead of int main()

warning: return type of 'main' is not 'int'

Caught by: gcc -Wall, -std=c11

void main() is not valid C. The OS and shell scripts need main()'s return value as the process exit code. Shell scripts test it with echo $?; CI systems use it to detect failures.

❌ non-standard

void main() {
    printf("Hi\n");
}

✅ standard

int main() {
    printf("Hi\n");
    return 0;
}

Mistake 3Missing semicolon after a statement

error: expected ';' before 'return'

Caught by: GCC at compile time

GCC detects the error one line after the actual mistake — it only knows the semicolon is missing when it sees the next unexpected token. Always check the line before the reported error line.

❌ missing ;

int x = 10   // ← missing ;
return 0;

✅ fixed

int x = 10;
return 0;

Mistake 4Mismatched or missing braces

error: expected '}' at end of input

Caught by: GCC at compile time

Every { needs a matching }. GCC reports the error at the end of the file — far from the actual mistake. Use an editor with bracket matching (VS Code highlights the mismatched brace; Vim's % key jumps between pairs).

❌ unmatched

int main() {
    if (1) {
        printf("hi\n");
    // ← missing }
    return 0;
}

✅ matched

int main() {
    if (1) {
        printf("hi\n");
    }
    return 0;
}

🟡

Category 2 — Logic Bugs

Code compiles and runs — but produces wrong output. Often silent.

Mistake 5Missing braces around if/for/while body

No error — compiles silently, wrong output

Caught by: Code review; Apple's "goto fail" SSL bug (CVE-2014-1266) is the canonical real-world example

Without braces, only the first statement is in the if-body. Any subsequent lines always run regardless of the condition. This is the "refactoring trap" — the indentation makes it look correct but it isn't.

❌ missing braces

if (x > 0)
    printf("pos\n");
    printf("always!\n"); // ALWAYS runs

✅ with braces

if (x > 0) {
    printf("pos\n");
    printf("also pos\n");
}

Mistake 6= (assignment) instead of == (comparison)

warning: suggest parentheses around assignment used as truth value

Caught by: gcc -Wall

if (x = 5) assigns 5 to x and evaluates to true (5 is non-zero), so the body always runs. Compiles without error. GCC -Wall warns. Yoda conditions if (5 == x) make a typo a compile error.

❌ assignment

if (x = 5) {   // assigns, not compares
    printf("always\n");
}

✅ comparison

if (x == 5) {
    printf("when x is 5\n");
}

Mistake 7Off-by-one error in array loops

No compile error — wrong output or silent out-of-bounds crash

Caught by: -fsanitize=address

Arrays are 0-indexed — a 5-element array has valid indices 0..4. Using i <= n instead of i < n accesses arr[n] — out-of-bounds, undefined behavior. One too many iterations; or using i < n-1 may miss the last element.

❌ off by one

int arr[5] = {1,2,3,4,5};
for (int i = 0; i <= 5; i++)  // accesses arr[5]!
    printf("%d\n", arr[i]);

✅ correct

int arr[5] = {1,2,3,4,5};
for (int i = 0; i < 5; i++)   // 0..4
    printf("%d\n", arr[i]);

Mistake 8Stray semicolon after for/while — empty loop body

warning: empty body in a for-statement [-Wempty-body]

Caught by: gcc -Wall

A semicolon immediately after a for/while is an empty statement that IS the entire loop body. The intended body runs only once after the loop terminates (or never for an infinite loop).

❌ stray ;

for (int i=0; i<10; i++);  // empty body!
    printf("%d\n", i);  // runs once after loop

✅ fixed

for (int i=0; i<10; i++) {
    printf("%d\n", i);
}

Mistake 9Using uninitialized variables

warning: 'sum' is used uninitialized

Caught by: gcc -Wall, -fsanitize=undefined

Local variables are not automatically initialized — they contain whatever garbage was in that stack memory. Reading an uninitialized variable is undefined behavior: the program may produce different results each run, or crash.

❌ uninitialized

int sum;
for (int i=1; i<=5; i++)
    sum += i;   // sum starts as garbage

✅ initialized

int sum = 0;
for (int i=1; i<=5; i++)
    sum += i;

🟣

Category 3 — Memory Errors

Compiles and may appear to run — but corrupts memory or leaks it. Often intermittent.

Mistake 10Not checking malloc's return value

Segmentation fault (when memory exhausted)

Caught by: Code review; -fsanitize=address

malloc returns NULL when the system is out of memory. Using the returned pointer without checking it causes a null pointer dereference — an immediate crash. Always validate before use.

❌ no check

int *p = malloc(1000 * sizeof(int));
p[0] = 42;  // crash if NULL

✅ check first

int *p = malloc(1000 * sizeof(int));
if (!p) { perror("malloc"); return 1; }
p[0] = 42;

Mistake 11Memory leak — malloc without free

valgrind: LEAK SUMMARY: definitely lost: N bytes in M blocks

Caught by: valgrind --leak-check=full, -fsanitize=address

Every heap allocation needs exactly one matching free. Missing free calls accumulate — in long-running programs (servers, daemons) the process eventually exhausts memory and crashes.

❌ leak

char *buf = malloc(256);
use(buf);
// free(buf) missing

✅ freed

char *buf = malloc(256);
use(buf);
free(buf);
buf = NULL;

Mistake 12Buffer overflow — writing past an array's end

AddressSanitizer: stack-buffer-overflow / heap-buffer-overflow

Caught by: -fsanitize=address, valgrind

Writing beyond a buffer corrupts adjacent memory — other variables, return addresses, heap metadata. Buffer overflows are the leading cause of C security vulnerabilities. Use bounded alternatives: strncpy, snprintf, fgets.

❌ overflow

char buf[8];
strcpy(buf, "Hello, World!");  // overflow!

✅ bounded

char buf[8];
strncpy(buf, "Hello, World!", sizeof(buf)-1);
buf[sizeof(buf)-1] = '\0';

Mistake 13Use-after-free — accessing memory after free()

AddressSanitizer: heap-use-after-free

Caught by: -fsanitize=address, valgrind

After free(ptr), the memory may be reused for another allocation. Reading or writing through the freed pointer reads/writes someone else's data — a serious bug and common security vulnerability. Setting the pointer to NULL makes subsequent accesses crash immediately (caught) rather than silently corrupting memory (uncaught).

❌ use after free

int *p = malloc(sizeof(int));
free(p);
*p = 42;   // undefined behavior!

✅ NULL after free

int *p = malloc(sizeof(int));
free(p);
p = NULL;  // next use crashes immediately

🟢

Category 4 — Runtime Errors

Program compiles, but crashes or exhibits undefined behavior at runtime.

Mistake 14NULL pointer dereference

Segmentation fault (SIGSEGV)

Caught by: -fsanitize=address (exact line), gdb backtrace

Dereferencing NULL attempts to read address 0, which the OS marks inaccessible. Most common cause: forgetting to check the return value of malloc, fopen, or scanf, all of which can return NULL.

❌ unchecked

FILE *fp = fopen("missing.txt", "r");
fread(buf, 1, 100, fp);  // crash if NULL

✅ checked

FILE *fp = fopen("file.txt", "r");
if (!fp) { perror("fopen"); return 1; }
fread(buf, 1, 100, fp);

Mistake 15Signed integer overflow — undefined behavior

No crash — silently wrong output or UB-based misoptimization

Caught by: -fsanitize=undefined

Signed integer overflow (e.g., INT_MAX + 1) is undefined behavior in C. The compiler can and does make optimizations that assume overflow never happens — leading to code that appears to work at -O0 but fails silently at -O2.

❌ overflow UB

int a = 2147483647;  // INT_MAX
int b = a + 1;       // undefined behavior!
printf("%d\n", b);

✅ wider type

long long a = 2147483647LL;
long long b = a + 1;   // 2147483648
printf("%lld\n", b);

Mistake 16Infinite recursion — stack overflow

Segmentation fault (stack exhausted)

Caught by: gdb (shows full call stack depth), -fsanitize=address

A recursive function without a reachable base case adds a stack frame every call until the stack is exhausted. Always verify that every valid input eventually reaches the base case.

❌ no base case

int fact(int n) {
    return n * fact(n - 1);  // infinite!
}

✅ base case

int fact(int n) {
    if (n <= 1) return 1;
    return n * fact(n - 1);
}

Tools: Find These Mistakes Automatically

Tool / Flag	What it finds	How to use
gcc -Wall -Wextra	Implicit declarations, unused vars, format mismatches, assignment in condition, missing returns	`gcc -Wall -Wextra prog.c -o prog`
gcc -fsanitize=address	Buffer overflows, use-after-free, double-free, stack overflows, memory leaks	`gcc -g -fsanitize=address prog.c -o prog && ./prog`
gcc -fsanitize=undefined	Signed integer overflow, null pointer dereference, out-of-bounds indexing	`gcc -g -fsanitize=undefined prog.c -o prog && ./prog`
valgrind	Memory leaks, use-after-free, uninitialized reads, invalid reads/writes	`gcc -g prog.c -o prog && valgrind --leak-check=full ./prog`
gdb	Pinpoints segfault line, shows call stack at crash, step-through debugging	`gcc -g prog.c -o prog && gdb ./prog` → `run`, `bt`
clang --analyze	Null pointer dereference, dead code, memory leaks — static, no execution needed	`clang --analyze prog.c`

Recommended one-liner for development:
gcc -Wall -Wextra -Werror -g -fsanitize=address -fsanitize=undefined -std=c11 prog.c -o prog && ./prog
This single command catches all four categories of mistakes simultaneously.

Frequently Asked Questions

What are the most common mistakes beginners make in C?▾

The five most common beginner C mistakes are: (1) missing #include for functions, (2) omitting braces around if/for/while bodies, (3) using uninitialized variables, (4) not checking malloc/fopen return values, and (5) array off-by-one errors. All five are caught by compiling with -Wall -fsanitize=address.

Why does my C program crash with "Segmentation fault"?▾

A segfault means your program accessed invalid memory. Common causes: NULL pointer dereference (forgot to check malloc/fopen), array out-of-bounds, use-after-free, or stack overflow from infinite recursion. Diagnose with: gcc -g -fsanitize=address prog.c -o prog && ./prog — AddressSanitizer prints the exact line and cause.

Why does my C program compile but give wrong output?▾

Common causes: = instead of == in an if condition (always true), missing braces so only one statement is conditional, off-by-one loop bounds, uninitialized variable (garbage value), or integer overflow. Compile with -Wall -fsanitize=undefined to catch most of these.

What is undefined behavior in C?▾

Undefined behavior (UB) means the C standard makes no guarantee — the program might crash, produce wrong output, or appear to work but fail after a compiler update or optimization level change. Common causes: signed integer overflow, reading uninitialized variables, NULL dereference, array out-of-bounds, use-after-free. Catch with -fsanitize=undefined.

How do I find memory leaks in C?▾

Two tools: (1) valgrind --leak-check=full ./prog — exhaustive, reports exact allocation sites, ~10–20x slower. (2) gcc -fsanitize=address prog.c -o prog && ./prog — AddressSanitizer, ~2x overhead, reports leaks at exit with source locations. Use ASan for daily development; valgrind for final pre-release checks.

Continue learning C on CoodeVerse

CoodeVerse Editorial Team

The CoodeVerse editorial team consists of experienced software developers and educators specializing in C, Python, Java, and web development. All content is technically reviewed and updated regularly. About us →

← Previous: Best Practices