缓冲区溢出-退出功能后未从堆栈中删除字符数组

Question

I am trying to concatenate a few strings to a buffer. However, if I call the function repeatedly, the size of my buffer will keep growing.

void print_message(char *str) {
    char message[8196];
    sender *m = senderlist;
    while(m) {
        /* note: stricmp() is a case-insensitive version of strcmp() */
        if(stricmp(m->sender,str)==0) {
            strcat(message,m->sender);
            strcat(message,", ");
        }
        m = m->next;
    }
    printf("strlen: %i",strlen(message));
    printf("Message: %s\n",message);
    return;
}

The size of message will continuously grow until the length will be 3799.

Example:

• 1st. call: strlen = 211
• 2nd call: strlen = 514
• 3rd call: strlen = 844
• ...
• nth call: strlen = 3799
• nth +1 call: strlen = 3799
• nth +2 call: strlen = 3799

My understanding was, that statically allocated variables like char[] will automatically be freed upon exiting the function, and I'm not dynamically allocating anything on the heap.

And why will suddenly stop growing at 3799 bytes? Thanks for any pointers.

Answer 1

Add one more statement after the buffer definition

char message[8196];
message[0] = '\0';

Or initialize the buffer when it is defined

char message[8196] = { '\0' };

or

char message[8196] = "";

that is fully equivalent to the previous initialization.

The problem with your code is that the compiler does not initialize the buffer if you wiil not specify initialization explicitly. So array message contains some garbage but function strcat at first searches the terminating zero in the buffer that to append a new string. So your program has undefined behaviour.

Answer 2

What you are seeing is the growing of the senderlist or likely garbage in message. Fortunately not exceeding 8196. The message array must start with the empty string. At the moment doing a strcat adds to garbage.

char message[8196];
sender *m = senderlist;
int len = 0;
*message = '\0';
while(m) {
    /* note: stricmp() is a case-insensitive version of strcmp() */
    if(stricmp(m->sender,str)==0) {
        int sender_len = strlen(m->sender);
        if (len + sender_len + 2 + 1 < sizeof(message)) {
            strcpy(message + len, m->sender);
            len += sender_len;
            strcpy(message + len, ", ");
            len += 2;
        } else {
            // Maybe appending "..." instead (+ 3 + 1 < ...).
            break;
        }
    }
    m = m->next;
}
printf("strlen: %i",strlen(message));
printf("Message: %s\n",message);

Answer 3

"Deallocation" is not the same as wiping the data; in fact, C generally leaves the data unerased for performance reasons.