Weird results when printing not existing list elements in C++ - c++

Question

So I am learning C++ at the moment and got some really weird results when I tried printing out element of a list of integers, that are actually out of range. (Don't ask why, I stumbled on that by accident)
This is my Code:
#include <iostream>
using namespace std;
int main() {
int nums[0] = {};
for (int i = 0; i <= 10; i++) {
cout << nums[i] << endl;
}
return 0;
}
Results of when I ran the code the first time:
0
17110752
0
4199367
0
0
0
65
0
4225392
0
Results of when I ran the code a second time:
0
1906400
0
4199367
0
0
0
65
0
4225392
0
Results of when I ran the code a third time:
0
15603424
0
4199367
0
0
0
65
0
4225392
0
Every time I run this programm, the second number seems to be diffrent.
I know why I get unexpected results, but I'm curious where these values come from.
Edit: "I know why I get unexpected results" is just poorly worded. What I meant was "I know that I get unexpected result, because I am calling a element that is not part of the list".
Are they values from the RAM?
Why are some value repeating and some not?

Answer 1

The result of compiling your code to (my invented) machine code is something like this.
1 main:
2 reserve basePtr, 2 ; reserve 2 slots on the stack, and store in basePtr
3 mov nums, basePtr ; num points at the first local variable
4 mov [nums], 0 ; int num[1] = {0} - set num to zero
5 mov i, basePtr + 1 ; i points at second slot for local variables
6 mov [i], 0 ; int i = 0;
7 for_loop:
8 cmp [i], 10 ;
9 jmp_above_or_equal fini ; exit loop
10 mov tmp, [nums+i] ;
11 call cout, tmp
12 call cout, std::endl ;
13 inc [i]
14 jmp for_loop
15 fini:
16 return 0
So we reserve 2 slots for variables, and then read beyond the reserved space.
Imagine the call works like this :-
Initial stack
+-----------+
| ret_main | // crt code which calls main
+-----------+
| nums[0] |
+-----------+
| i |
SP-> +-----------+
push param (e.g. tmp) creates a stack like so...
+-----------+
| ret_main | // crt code which calls main
+-----------+
| nums[0] |
+-----------+
| i |
+-----------+
| tmp |
SP-> +-----------+
With the call itself....
+-----------+
| ret_main | // crt code which calls main
+-----------+
| nums[0] |
+-----------+
| i |
+-----------+
| tmp |
+-----------+
| line_12 |
SP-> +-----------+
With this stack growing down through calls, your further requests are showing the memory values of the return address into your code, and the local variables of the previous call to cout.
If the stack grows the other way (more normal), a stack may look as so...
SP-> +-----------+
| line_12 |
+-----------+
| tmp |
+-----------+
| i |
+-----------+
| nums[0] |
+-----------+
| ret_main | // crt code which calls main
+-----------+
This is the normal direction for stacks in modern processors. In this case when you look further into the nums array, you are reading values of the return address for the function, and then the local variables which are from the function calling main.
In practice i is probably optimized into a register, and entry into a function would save some registry values based on the platform's calling conventions.
So the values you are reading, is likely to be in this order...
Registers saved by main
Values to detect against buffer overrun (which is happening here)
Return address to main
arguments to main
local variables in the function which calls main.
Why are they repeating. If the function calling main has copies of argv, then it would be likely the push to store argv are matched by the callers copy in local variables.
Why do some change. Since Address Space Layout Randomization (ASLR), processes normally launch with a random base address, and random stack location, making it harder to exploit a buffer overflow.