相邻对象的C数组边界错误

Question

来自 http://www.doc.ic.ac.uk/teaching/projects/Distinguished03/AndrewSuffield.pdf :

#include <string.h>

struct x
{
  char s[10];
  int a[4];
};

void bang(struct x *d)
{
  strcat(d->s, "!");
}

int main(void)
{
  struct x d;
  strcpy(d.s, "012345678");
  d.a[0] = 3;
  d.a[1] = 2;
  d.a[2] = 1;
  d.a[3] = 0;
  bang(&d);
  return a[0];
}

In this example, struct x contains a 10-byte string immediately followed by a 4-integer array. d is initialized with a 9-character string (occupying 10 bytes because of the trailing NULL) and four integers. bang() appends a ! to the string, making it "012345678!" plus a trailing NULL.

The NULL byte at the end of the string will overwrite the first byte of d.a[0]. On a big-endian host, this will have no effect because that byte was already zero. On a little-endian host, this will change the value of d.a[0] to zero

两个问题:

s & a 之间是否存在结构漏洞，因此上述论点不成立。 gcc 给出的返回值为 3。

返回 a[0] 在我的系统 (gcc) 上不起作用。

Answer 1

字段之间很可能存在填充。在任何现代系统上都会有。试试通过 strcat更长的字符串。

return a[0]显然是一个错字。它应该是 return d.a[0] .