Valgrind的 - 爲的strcpy

Question

尺寸1的無效的寫

我swapData功能基本類型char兩個節點之間進行數據交換*

17 void swapData(struct Node *node1, struct Node *node2) 
18 { 
19  // Create a new node "temp" that stores the data of node2 
20  struct Node *temp = (struct Node *)malloc(sizeof(struct Node)); 
21  temp->data = malloc(strlen(node2->data)); 
22  
23  strcpy(temp->data,node2->data); 
24  
25  // Copy data from node1 to node2 
26  strcpy(node2->data,node1->data); 
27  
28  // Copy data from temp to node1 
29  strcpy(node1->data,temp->data); 
30  
31  free(temp->data); 
32  free(temp); 
33 } 

每當我Valgrind的運行，它不斷給我這個輸出：

==27570== Invalid write of size 1 
==27570== at 0x4C2C00F: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
==27570== by 0x400794: swapData (test4.c:23) 
==27570== by 0x400A9C: sort (list2.c:20) 
==27570== by 0x40086B: main (test4.c:49) 
==27570== Address 0x51f11dd is 0 bytes after a block of size 13 alloc'd 
==27570== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
==27570== by 0x40076B: swapData (test4.c:21) 
==27570== by 0x400A9C: sort (list2.c:20) 
==27570== by 0x40086B: main (test4.c:49) 
==27570== 
==27570== Source and destination overlap in strcpy(0x51f1130, 0x51f1130) 
==27570== at 0x4C2C085: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
==27570== by 0x4007B2: swapData (test4.c:26) 
==27570== by 0x400A9C: sort (list2.c:20) 
==27570== by 0x40086B: main (test4.c:49) 
==27570== 
==27570== Invalid read of size 1 
==27570== at 0x4C2C002: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
==27570== by 0x4007D0: swapData (test4.c:29) 
==27570== by 0x400A9C: sort (list2.c:20) 
==27570== by 0x40086B: main (test4.c:49) 
==27570== Address 0x51f11dd is 0 bytes after a block of size 13 alloc'd 
==27570== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
==27570== by 0x40076B: swapData (test4.c:21) 
==27570== by 0x400A9C: sort (list2.c:20) 
==27570== by 0x40086B: main (test4.c:49) 
==27570== 

我相信問題是在swapData中的strcpy。有人能告訴我發生了什麼事嗎？

Answer 1

你不僅需要添加一個到你的malloc長度，而且你也不能像使用strcpy那樣交換字符串。如果第一個字符串與10個字節匹配，第二個字符串與29個字節匹配呢？當您複製到交換時，您將溢出第一個字符串的緩衝區。最好交換指針。如果data被定義爲一個固定長度的數組，那麼你在做什麼是好的，但temp也可以是相同大小的數組而不是一個節點。

Answer 2

您需要的malloc一個字節以上的TEMP->數據

temp->data = malloc(strlen(node2->data)+1); 

這是因爲你需要的最後一個字節來存儲，然後「\ 0」表示字符串的結束。