我很容易地分配了一个字符串数组，到目前为止，它可以正常工作，但不是我在使用此功能的程序中出现缓冲区溢出。
代码：
/*
\fn char **clean_double_alloc(int y, int x)
\brief allocate array of string in desirated size.
\param y : the number of string
\param x : the lenght of each string
\return a new array of string(char **).
*/
char **clean_double_alloc(int y, int x)
{
char **double_buffer = NULL;
double_buffer = malloc(sizeof(char *) * (y + 1));
if (double_buffer == NULL) {
put_error("allocation error !\n");
return (NULL);
}
for (int i = 0; i < y; i++) {
double_buffer[i] = NULL;
double_buffer[i] = clean_alloc(x);
if (double_buffer[i] == NULL) {
put_error("allocation error !\n");
return (NULL);
}
}
double_buffer[y + 1] = NULL;
return (double_buffer);
}
注意：我的clean_alloc并将其可以容纳的字符数（而不是字节数）作为参数，然后用'\ 0'填充分配的空间。
clean_alloc代码在这里：
char *clean_alloc(int size)
{
char *str = NULL;
str = malloc(size * sizeof(char));
if (str == NULL) {
my_putstr("allocation error !");
return (NULL);
}
for (int i = 0; i < size; i++)
str[i] = '\0';
return (str);
}
我使用-fsanitize = address进行编译，并得到以下跟踪：
==8342==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000040 at pc 0x000000405176 bp 0x7ffc8d494ff0 sp 0x7ffc8d494fe0
WRITE of size 8 at 0x604000000040 thread T0
#0 0x405175 in clean_double_alloc warlock/string/initialize_more.c:35
#1 0x4015cc in prepare_maze src/main.c:55
#2 0x4013f7 in main src/main.c:38
#3 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
#4 0x40119d in _start (/home/mlg/Programming/github repo/Dante-s-Star/generator/generator+0x40119d)
0x604000000040 is located 0 bytes to the right of 48-byte region [0x604000000010,0x604000000040)
allocated by thread T0 here:
#0 0x7f8f29663c58 in __interceptor_malloc (/lib64/libasan.so.5+0x10dc58)
#1 0x405038 in clean_double_alloc warlock/string/initialize_more.c:22
#2 0x4015cc in prepare_maze src/main.c:55
#3 0x4013f7 in main src/main.c:38
#4 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
SUMMARY: AddressSanitizer: heap-buffer-overflow warlock/string/initialize_more.c:35 in clean_double_alloc
Shadow bytes around the buggy address:
0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c087fff8000: fa fa 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
您已分配了一个y + 1指针长的数组，但是您有以下调用：
double_buffer[y + 1] = NULL;
这似乎是一个错误，而是应该是：
double_buffer[y] = NULL;
这突出了问题：
int buffer[3 + 1] = {1, 2, 3, 4};
printf("Correct: %d\nIncorrect: %d\n", buffer[3], buffer[3 + 1]);
本文收集自互联网，转载请注明来源。
如有侵权，请联系[email protected] 删除。
我来说两句