# Calculate array length via pointer arithmetic

• A+
Category：Languages

I was wondering how `*(&array + 1)` actually works. I saw this as an easy way to calculate the array length and want to understand it properly before using it. I'm not very experienced with pointer arithmetic, but with my understanding `&array` gives the address of the first element of the array. `(&array + 1)` would go to end of the array in terms of address. But shouldn't `*(&array + 1)` give the value, which is at this address. Instead it prints out the address. I would really appreciate your help to get the pointer stuff clear in my head.

Here is the simple example I'm working on:

``int numbers[] = {5,8,9,3,4,6,1}; int length = *(&numbers + 1) - numbers; ``

1. `&numbers` is a pointer to the array itself. It has type `int (*)[7]`.
2. `&numbers + 1` is a pointer to the byte right after the array, where another array of 7 `int`s would be located. It still has type `int (*)[7]`.
3. `*(&numbers + 1)` dereferences this pointer, yielding an lvalue of type `int[7]` referring to the byte right after the array.
4. `*(&numbers + 1) - numbers`: Using the `-` operator forces both operands to undergo the array-to-pointer conversion, so pointers can be subtracted. `*(&numbers + 1)` is converted to an `int*` pointing at the byte after the array. `numbers` is converted to an `int*` pointing at the first byte of the array. Their difference is the number of `int`s between the two pointers---which is the number of `int`s in the array.
Edit: Although there's no valid object pointed to by `&numbers + 1`, this is what's called a "past the end" pointer. If `p` is a pointer to `T`, pointing to a valid object of type `T`, then it's always valid to compute `p + 1`, even though `*p` may be a single object, or the object at the end of an array. In that case, you get a "past the end" pointer, which does not point to a valid object, but is still a valid pointer. You can use this pointer for pointer arithmetic, and even dereference it to yield an lvalue, as long as you do not try to read or write through that lvalue. Note that you can only go one byte past-the-end of an object; attempting to go any further leads to undefined behaviour.