c - asprintf导致分段故障的核心转储

Question

#include <sys/stat.h>
#include <stddef.h>
#include <fcntl.h>
#include <errno.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <signal.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <sys/param.h>
#include <pthread.h>
#include <ctype.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <errno.h>
#include <stdbool.h>
#include <time.h>
#include <pthread.h>
#include <sys/socket.h>
#include <netinet/tcp.h> // tcp headers
#include <netinet/ip.h>  // ip headers
#include <arpa/inet.h>
#include <sys/types.h>
#include<stdio.h>
#include<sys/socket.h>
#include<sys/types.h>
#include<string.h>
#include<unistd.h>
#include<netinet/in.h>
#include <netdb.h>
int random_int(int min, int max)
{
int k;
double d;
d = (double)rand() / ((double)RAND_MAX + 1);
k = d * (max - min + 1);
return min + k;
}
char * get_random_ip()
{
int octet1 = random_int(0, 255);
int octet2 = random_int(0, 255);
int octet3 = random_int(0, 255);
int octet4 = random_int(0, 255);
char * string;
sprintf(string, "%d.%d.%d.%d", octet1, octet2, octet3, octet4);
return string;
}
int IPv4_verify(char *ip) {
int a,b,c,d;
char t;
if (4 == sscanf(ip,"%d.%d.%d.%d%c",&a,&b,&c,&d,&t)){
if (0<=a && a<=255
&& 0<=b && b<=255
&& 0<=c && c<=255
&& 0<=d && d<=255){
return 0;
}else{
return -1;
}
}else{
return -1;
}
}

char * atk_target="86.38.217.13";
int atk_port=9000;
void *httpget(){
printf("1");
//socket part 
struct sockaddr_in srv_addrr;

int hpsock;
if (0 > (hpsock = socket(AF_INET, SOCK_STREAM, 0))) 
{ 
#ifdef DEBUG
printf("[attack] HTTP socket build failedn");
#endif
exit(0);
} 

#ifdef DEBUG
printf("[attack] HTTP socket build seccussn");
#endif   

memset(&srv_addrr, 0, sizeof(srv_addrr));
printf("1");
srv_addrr.sin_family         = AF_INET; 
srv_addrr.sin_port           = htons(atk_port);

srv_addrr.sin_addr.s_addr    = inet_addr(atk_target); 

if (0 > connect(hpsock, (struct sockaddr*)&srv_addrr, sizeof(srv_addrr))) 
{ 
#ifdef DEBUG
printf("[attack] HTTP connect failed reconnectn");
#endif
exit(0);
}
//end of socket part
const char *GET_TIME=
"GET / HTTP/1.1rn"
"Host: %srn"
"Origin:%srn"

"User-Agent:%srn"
"X-Forwarded-For:%srn"

"rn";
char * http_request ="";
int get_len = asprintf(&http_request,GET_TIME,atk_target,atk_target,"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36",get_random_ip());


}
int main(){
srand((unsigned)time(NULL));
httpget();
}

有代码，当我运行它时，我得到一个核心转储错误。但如果我删除套接字部分，它运行成功。我试着使用sprintf，仍然得到同样的错误。我已经读了其他关于堆栈溢出的帖子，我仍然不知道谁来解决这个问题垃圾垃圾垃圾垃圾垃圾languese languese languese languese languese垃圾垃圾垃圾垃圾垃圾languese languese languese languese languese垃圾垃圾垃圾垃圾垃圾languese languese languese languese languese

Answer 1

您所提供的代码中没有asprintf(3)。但是在get_random_ip()中对sprintf(3)的调用包含一个bug。

char * string;
sprintf(string, "%d.%d.%d.%d", octet1, octet2, octet3, octet4); 

上面的代码段调用了未定义的行为，因为指针string从未初始化，并且有一个不确定的值。