涉及指针的意外 C 行为

Question

我试图让一个char*变量指向一个malloc'd字符串，但发生了一些真正的错误，我正在处理分段错误。

这是我代码中涉及的部分，我试图给出一个可执行示例，但使用AF_UNIX套接字恐怕它不会轻松测试。

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stddef.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/types.h>
#include <stdint.h>
#include <stdarg.h>
#define MSG_LEN 64
int vasprintf(char** str, const const char* format, va_list args) {
size_t size;
va_list tmp;
va_copy(tmp, args);
size = vsnprintf(NULL, 0, format, tmp);
va_end(tmp);
if (size == -1) {
return -1;
}
if ((*str = (char*)malloc(sizeof(char) * (size + 1))) == NULL) {
return -1;
}
size = vsprintf(*str, format, args);
return size;
}
int asprintf(char** str, const char* format, ...) {
size_t size;
va_list args;
if (str == NULL) {
return 1;
}
va_start(args, format);
size = vasprintf(str, format, args);
va_end(args);
return size;
}
typedef struct {
int socket;
struct sockaddr addr;
socklen_t addrlen;
} connection_t;
int connection_init(connection_t* connection, const char* address, const uint16_t port) {
if (!port) {
if ((connection->socket = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
return -1;
}
memset(&connection->addr, 'x', sizeof(connection->addr));
((struct sockaddr_un*) & connection->addr)->sun_family = AF_UNIX;
((struct sockaddr_un*) & connection->addr)->sun_path[0] = '';
strncpy(((struct sockaddr_un*) & connection->addr)->sun_path + 1, address, strlen(address));
connection->addrlen = offsetof(struct sockaddr_un, sun_path) + 1 + strlen(address);
return 0;
}
}
int connetcion_connect(const connection_t* connection) {
if (connect(connection->socket, &connection->addr, connection->addrlen) == -1) {
return -1;
}
return 0;
}
int connection_send(const connection_t* connection, const char* buff) {
ssize_t len;
if ((len = send(connection->socket, buff, strlen(buff), 0)) == -1) {
return -1;
}
return len;
}
int connection_recv(const connection_t* connection, char** buff) {
ssize_t len;
if (((*buff) = (char*)malloc(sizeof(char) * (MSG_LEN + 1))) == NULL) {
return -1;
}
memset((*buff), 0, sizeof(char) * (MSG_LEN + 1));
len = recv(connection->socket, (*buff), MSG_LEN, 0);
if (len == -1 || len > MSG_LEN) {
free((*buff));
(*buff) = NULL;
return -1;
}
(*buff)[len] = 0;
/*  Resize if string is shorter than len    */
if (realloc((*buff), sizeof(char) * (strlen((*buff)) + 1)) == NULL) {
free((*buff));
(*buff) = NULL;
return -1;
}
return len;
}
int foo(char* query, char** result) {
connection_t con;
char* filename;
if (asprintf(&filename, "%s%s", getenv("HOME"), "/.directory/socket") == -1) {
return 1;
}
if (connection_init(&con, filename, 0) == -1) {
return 1;
}
free(filename);
if (connetcion_connect(&con) == -1) {
return 1;
}
if (connection_send(&con, query) == -1) {
return 1;
}
printf("Address %p in foo point to:n", result);
printf("%pn", *result);
if (connection_recv(&con, result) == -1) {
return 1;
}
printf("Address %p in foo point to:n", result);
printf("%pn", *result);
return 0;
}
int main(int argc, char *argv[]){
if (argc == 3 && !strncasecmp(argv[1], "hello", 5)) {
char* buff = NULL;
printf("Address %p in main point to:n", &buff);
printf("%pn", buff);
if(foo(argv[2], &buff)){
return 1;
}
printf("Address %p in main point to:n", &buff);
printf("%pn", buff);
printf("%sn", buff);
}
return 0;
}

预期输出：

Address "0x7ffd4c0c0d28" in main point to:
(nil)
Address "0x7ffd4c0c0d28" in foo point to:
(nil)
Address "0x7ffd4c0c0d28" in foo point to:
0x1bfa6a0
Address "0x7ffd4c0c0d28" in main point to:
0x1bfa6a0

实际输出：

Address "0x7ffd4c0c0d28" in main point to:
(nil)
Address "0x7ffd4c0c0d28" in foo point to:
(nil)
Address "0x7ffd4c0c0d28" in foo point to:
0x1bfa6a0
Address "0x7f74656b6367" in main point to:
Segmentation fault

我能想到的唯一可能的解释是我以某种方式损坏了堆栈，如果需要其他资源，请告诉我，我会尽快提供它们

附加信息：

尝试在return 0之前printf("%sn", *result)我得到了预期的字符串。

服务器使用相同的connection_*功能与客户端通信。

我在 RHEL8.1 上，我正在使用 gcc 8.3.1 编译它

Answer 1

您的connection_t只有一个普通的struct sockaddr addr成员，这只是基础结构。所需的实际数据大小因协议而异。当我运行您的代码时，con被分配在...29a0 并且有 24 个字节，但strncpy尝试将 41 个字节写入...29a7，从而超越结构。您需要为协议所需的特定结构分配内存。您的addr成员可能应该是一个指针，您应该为其分配内存，将指针设置为指向该内存，然后调整其他代码。