It's 'Dirty' way of using memory addresses. When you return an address (pointer) you don't know whether it belongs to local scope of a function. It's just an address. Now that you invoked the 'foo' function, that address (memory location) of 'a' was already allocated there in the (safely, for now at least) addressable memory of your application (process). After the 'foo' function returned, the address of 'a' can be considered 'dirty' but it's there, not cleaned up, nor disturbed/modified by expressions in other part of program (in this specific case at least). A C/C++ compiler doesn't stop you from such 'dirty' access (might warn you though, if you care). You can safely use (update) any memory location that is in the data segment of your program instance (process) unless you protect the address by some means.

因为存储空间还没有被践踏。不要指望那种行为。

你的问题与范围无关。在你所展示的代码中，函数main看不到函数foo中的名称，所以你不能在foo之外直接使用这个名称访问foo中的a。

您遇到的问题是为什么程序在引用非法内存时不发出错误信号。这是因为c++标准在非法内存和合法内存之间没有明确的界限。引用弹出堆栈中的内容有时会导致错误，有时不会。视情况而定。不要指望这种行为。假设在编程时它总是会导致错误，但在调试时它永远不会发出错误信号。

What you're doing here is simply reading and writing to memory that used to be the address of a. Now that you're outside of foo, it's just a pointer to some random memory area. It just so happens that in your example, that memory area does exist and nothing else is using it at the moment. You don't break anything by continuing to use it, and nothing else has overwritten it yet. Therefore, the 5 is still there. In a real program, that memory would be re-used almost immediately and you'd break something by doing this (though the symptoms may not appear until much later!)

当您从foo返回时，您告诉操作系统您不再使用该内存，并且可以将其重新分配给其他内存。如果你很幸运，它从来没有被重新分配，而且操作系统也没有发现你再次使用它，那么你就可以摆脱这个谎言。很有可能你最终会以那个地址结尾。

现在，如果你想知道为什么编译器没有报错，这可能是因为foo被优化淘汰了。它通常会警告你这类事情。C假设您知道自己在做什么，而且从技术上讲，这里没有违反scope(在foo之外没有引用a本身)，只有内存访问规则，这只会触发警告而不是错误。

简而言之:这通常不会起作用，但有时会偶然起作用。

注意所有警告。不要只解决错误。 GCC显示此警告

警告:返回局部变量'a'的地址

这就是c++的强大之处。你应该关心记忆。有了-Werror标志，这个警告就变成了一个错误，现在您必须调试它。

给所有的答案补充一点:

如果你这样做:

#include<stdio.h>
#include <stdlib.h>
int * foo(){
    int a = 5;
    return &a;
}
void boo(){
    int a = 7;

}
int main(){
    int * p = foo();
    boo();
    printf("%d\n",*p);
}

输出可能是:7

这是因为从foo()返回后，堆栈被释放，然后被boo()重用。 如果你分解可执行文件，你会清楚地看到它。