c - Valgrind 错误。在函数中使用 malloc 和 realloc

Question

我正在尝试使 mystrcat 函数正常工作。它似乎返回了正确的字符串，但 valgrind 在我的代码中给出了错误，我似乎无法修复。

char *mystrcat(char *dest, const char *src) {
    int len = strlen(dest) * 2;
    char *origdest = realloc(dest, len);
    while(*dest) {
        dest++;
    }

    while (*src) {
        *dest++ = *src++;
    }
    return origdest; 
}

int main(void) {
    char *str = malloc(7);
    strcpy(str, "First");

    str = mystrcat(str, "Second");
    printf("%s\n", str);
    free(str);
}

我不明白的 Valgrind 错误:

==10== Invalid read of size 1
==10==    at 0x40068B: mystrcat (mystrcat.c:9)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Address 0x5203040 is 0 bytes inside a block of size 7 free'd
==10==    at 0x4C2FD5F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x40067B: mystrcat (mystrcat.c:8)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Block was alloc'd at
==10==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x4006E6: main (mystrcat.c:22)
==10== 
==10== Invalid write of size 1
==10==    at 0x4006AF: mystrcat (mystrcat.c:14)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Address 0x5203046 is 6 bytes inside a block of size 7 free'd
==10==    at 0x4C2FD5F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x40067B: mystrcat (mystrcat.c:8)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Block was alloc'd at
==10==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x4006E6: main (mystrcat.c:22)

Answer 1

你需要这个(解释见评论):

char *mystrcat(char *dest, const char *src) {
    int len = strlen(dest) * 2;
    char *newdest = realloc(dest, len);
    // newdest contains the pointer to the newly allocated memory
    // and dest is now no longer valid

    dest = newdest;
    while(*dest) {
        dest++;
    }

    // now dest points to the end of the string in the newly
    // allocated memory

    while (*src) {
        *dest++ = *src++;
    }

    // add NUL terminator
    *dest = 0;

    // we return the newly allocated memory
    return newdest;  
}

但是这个函数仍然不完全正确。

这是错误的:

int len = strlen(dest) * 2;

将大小加倍是错误的，因为如果 src 比 dest 字符串的长度长，则内存不足，您将获得一个缓冲区溢出。

连接字符串所需的内存大小为:

原始字符串大小+待拼接字符串大小+1

+1 是必需的，因为 NUL 字符串终止符。

因此你需要这个:

int len = strlen(dest) + strlen(src) + 1;

还有一件事:

char *mystrcat(char *dest, const char *src)

可以替换为

char *mystrcat(const char *dest, const char *src)

因为我们实际上并没有修改dest指向的内存。

请注意，您的 mystrcat 仅在 destinatino 指针已分配有类似 malloc 的函数时才有效。