malloc...意外行为 C 编程
#include<stdio.h>
#include<malloc.h>
#include<string.h>
void foo( char ** ptr)
{
*ptr = malloc(0); // allocate some memory**
strcpy( *ptr, "Hello World");
}
int main()
{
char *ptr = 0;
// call function with a pointer to pointer
foo( &ptr );
printf("%s\n", ptr);
// free up the memory
free(ptr);
return 0;
}
并且它还运行
#include<stdio.h>
#include<malloc.h>
#include<string.h>
void foo( char ** ptr)
{
*ptr = malloc(11); // allocate some memory
strcpy( *ptr, "Hello World");
}
int main()
{
char *ptr = 0;
// call function with a pointer to pointer
foo( &ptr );
printf("%s\n", ptr);
// free up the memory
free(ptr);
return 0;
}
任意数量的更改 malloc...它始终在运行。这怎么可能？？？ Hello World 有 12 个字符，因此如何可以在 0、12、8 或任何数字中运行。
#include<stdio.h>
#include<malloc.h>
#include<string.h>
void foo( char ** ptr)
{
*ptr = malloc(0); // allocate some memory**
strcpy( *ptr, "Hello World");
}
int main()
{
char *ptr = 0;
// call function with a pointer to pointer
foo( &ptr );
printf("%s\n", ptr);
// free up the memory
free(ptr);
return 0;
}
and it is also running
#include<stdio.h>
#include<malloc.h>
#include<string.h>
void foo( char ** ptr)
{
*ptr = malloc(11); // allocate some memory
strcpy( *ptr, "Hello World");
}
int main()
{
char *ptr = 0;
// call function with a pointer to pointer
foo( &ptr );
printf("%s\n", ptr);
// free up the memory
free(ptr);
return 0;
}
change malloc by any number...it is always running.how it is possible????
Hello World has 12 character so hows that possible to run in 0,12,8,any number.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您遇到的事实是 C 不执行任何边界检查。因此，您对 malloc 内存的复制会过度运行分配，并在后面的任何内存上“乱涂乱画”。结果未定义。它可能会工作，可能会崩溃，也可能会给你一杯咖啡。你不知道。
顺便说一句，这种错误会导致缓冲区溢出攻击。
You are encountering the fact that C does not do any bounds checking. So your copy to the malloc'd memory is over-running the allocation and "scribbling" on whatever memory follows. The results are undefined. It may work, it may crash, it may make you a cup of coffee. You don't know.
Incidentally, this is the kind of mistake which leads to buffer-overrun attacks.
显然，代码中存在错误。
有两种可能性：
您很“幸运”，strcpy() 没有遇到任何后果，因此程序运行。
malloc() 通常会分配比请求更多的字节，以更好地保持内存对齐。例如，它完全有可能以 16 个物理字节为单位进行分配。
The code has bugs in it, clearly.
There are two possibilities:
You're getting "lucky" that strcpy() isn't hitting anything of consequence, so the program runs.
malloc() often allocates a few more bytes than requested to better keep memory aligned. It's entirely possible that it allocates in chunks of 16 physical bytes, for example.
C 并不关心你实际分配了多少（0 除外；如果你这样做，事情会变得很糟糕）；只要你不超越各种任意的人为界限，你的程序就会（看起来）工作。你只是没有击中其中一个而已。
C doesn't care how much you actually allocate (except for 0; things can get ugly if you do so); as long as you don't overstep various arbitrary artificial bounds your program will (appear to) work. You just didn't hit one of them.
人们普遍错误地认为这样的错误一定会导致程序崩溃。事实上，C 标准明确表示，对于像这样的未定义行为，“本国际标准没有提出任何要求”。
因此，程序可能会立即崩溃，可能会损坏随机数据，或者可能看起来可以工作。就像艾德说的那样，这很不安全。
It is a common misconception that mistakes like this must cause the program to crash. In fact, the C standard explicitly says that, for undefined behavior like this, there are "this International Standard imposes no requirements."
So the program might crash right away, it might corrupt random data, or it might seem to work. It's just unsafe, like Ed said.