c - Anti_Virus.exe 已触发断点。 C语言

Question

我写了一个“反病毒”(不是真正的反病毒 - 只是为了学习)，它使用堆，有时当它需要使用堆时，它会破坏有关该主题的消息，然后它给我以下消息:“调试断言失败”和:“表达式:_crtisvalidheappointer(puserdata)”我真的不知道为什么......在代码中，当 while 循环在这一行中进行第五次迭代时，它发生在函数运行中:

if (!(results = (char**)realloc(results, sizeof(results) + sizeof(char*))))

功能:

void run(char* dir_path, char* virus_path, char mode)
{
    DIR* dir = NULL;
    FILE* virus = NULL;
    struct dirent* cur_file;  // cur_file is a pointer for struct dirent which represnts the file we are checking now (current file)
    char** results = NULL;  // resullts will be an array of strings to write in the log
    int results_len = 0, i = 0;
    char* file_path = NULL;

    //checks the arguments:
    if (!(dir = opendir(dir_path)))  // argv[1] should be the directory
    {
        printf("The path that given as the first argument doesn't point to a directory / ");
        printf("an error has occurred while opening the directory\n");
        return -1;
    }
    if (!(virus = fopen(virus_path, "rb")))
    {
        printf("The path that given as the second argument doesn't point to a file / ");
        printf("an error has occurred while opening the file\n");
        closedir(dir);
        return -1;
    }

    //running on the file in the directory:
    while (cur_file = readdir(dir))  // at the end of the directory readdir() will return NULL
    {
        if (!(strcmp(cur_file->d_name, ".")))  // at the first time wer'e reading from a directory the value of d_name will be "."
        {
            continue;
        }
        if (!(strcmp(cur_file->d_name, ".."))) //at the second time wer'e reading from a directory the value of d_name will be ".."
        {
            continue;
        }

        if (!(file_path = (char*)malloc(strlen(dir_path) + cur_file->d_namlen + 2))) //1 for \ between dir_path and d_name and 1 for the NULL
        {
            closedir(dir);
            fclose(virus);
            return -1;
        }
        strcpy(file_path, dir_path);
        strcat(file_path, "\\");
        strcat(file_path, cur_file->d_name);
        if (!(results)) // if results == NULL -> if didn't allocated memory for results already
        {
            if (!(results = (char**)malloc(sizeof(char*))))
            {
                printf("Problem with malloc\n");
                free(file_path);
                closedir(dir);
                fclose(virus);
                return -1;
            }
        }
        else
        {
            if (!(results = (char**)realloc(results, sizeof(results) + sizeof(char*))))
            {
                printf("Problem with realloc\n");
                for (i = 0; i < results_len; i++)
                {
                    free(results[i]);
                }
                free(file_path);
                free(results);
                closedir(dir);
                fclose(virus);
                return -1;
            }
        }    
        results[results_len] = check_file(file_path, virus, mode);
        if(results[results_len] == -1) // results_len will be updated later (just malloced)
        {
            for (i = 0; i < results_len; i++)
            {
                free(results[i]);
            }
            free(file_path);
            free(results);
            closedir(dir);
            fclose(virus);
            return -1;
        }
        results_len++;
        free(file_path);
    }
    fclose(virus);
    closedir(dir);
    write_to_log(dir_path, virus_path, mode, results, results_len);
}

函数 check_file 返回一个 char* (字符串)，该字符在 check_file 中进行了 malloc，并将在其他函数中释放。

有人知道原因吗？谢谢您

Answer 1

这一行:

        if (!(results = (char**)realloc(results, sizeof(results) + sizeof(char*))))

没有增加结果的大小(因此，随着result_len的增加，您会踩在它的末尾)。您可能想要使用 (result_len + 1)*sizeof(char*)，因为您已经在 results 中存储了字符串数量。