谁能解释这种晦涩的行为？

Question

我正在尝试为安全类(class)编写一个端口扫描器。我决定在 Linux 上用 C 编写它，因为我从来没有在 Java 之外做过任何与网络相关的事情。我在 Ubuntu 10.10 上使用 GCC 4.4.5。我有一个主要函数，它解析参数，然后使用结果变量调用扫描函数。这是我的完整程序:http://pastebin.com/DHU7SEQR

我遇到的问题是它不能正常工作(它报告所有端口都打开)，除非我在调用函数之前打印出从用户那里收到的变量(或重新排列传递给的参数的顺序)可执行文件)，这对我来说完全没有意义。注意被注释掉的行(150)，留下这行注释掉并用命令编译

gcc scanner.c -o scanner

然后用

运行程序

./scanner -a 127.0.0.1 -b 0 -e 1000 -t 1000

导致它报告所有端口都已打开。但是，取消注释该行(即在调用函数之前打印出所有变量)会导致正确报告端口状态。重新排列参数的顺序为

./scanner -b 0 -e 1000 -t 1000 -a 127.0.0.1

似乎也可以工作，向每个 case block 添加 printf 语句也是如此(即使不打印变量本身)。

Answer 1

$ valgrind ./scanner -a 127.0.0.1 -b 0 -e 1000 -t 1000
==3800== Memcheck, a memory error detector
==3800== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==3800== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
==3800== Command: ./scanner -a 127.0.0.1 -b 0 -e 1000 -t 1000
==3800== 
==3800== Syscall param socketcall.getsockopt(optlen) points to uninitialised byte(s)
==3800==    at 0x4F15DCA: getsockopt (syscall-template.S:82)
==3800==    by 0x400BC5: scan (scanner.c:83)
==3800==    by 0x400DBB: main (scanner.c:152)
==3800==  Address 0x7ff000330 is on thread 1's stack
==3800== 
==3800== Syscall param socketcall.getsockopt(optlen_out) points to uninitialised byte(s)
==3800==    at 0x4F15DCA: getsockopt (syscall-template.S:82)
==3800==    by 0x400BC5: scan (scanner.c:83)
==3800==    by 0x400DBB: main (scanner.c:152)
==3800==  Address 0x7ff000330 is on thread 1's stack
==3800== 

查看 getsockopt(2) 的联机帮助页。

For getsock‐ opt(), optlen is a value-result argument, initially containing the size of the buffer pointed to by optval, and modified on return to indicate the actual size of the value returned. If no option value is to be supplied or returned, optval may be NULL."

所以你需要在第82行初始化len。

注意:代码可能还有其他问题。