尝试取消引用动态分配的指针时出现分段错误

Question

I have a dynamically allocated char array, I want to combine two strings into it, so I tried the following:

char *strcpy2 (char *str1, char *str2)
{
    int total = strlen (str1) + strlen (str2) + 1;
    char *nstr = malloc (sizeof (char) * total);
    while (*str1 != '\0') *nstr++ = *str1++;
    while (*str2 != '\0') *nstr++ = *str2++;
    *nstr = '\0';
    printf ("size: %d\n", strlen (nstr));
    return &(nstr[0]);
}

int main (void)
{
    char *concat = strcpy2 ("Hello, ", "World.");
    puts (concat);
    free (concat);
    return 0;
}

When I ran it, it printed the size of nstr is 0 and then Segmentation fault (core dumped) .

However when I did this:

char *strcpy2 (char *str1, char *str2)
{
    int total = strlen (str1) + strlen (str2) + 1;
    char *nstr = malloc (sizeof (char) * total);
    char *p = nstr;
    while (*str1 != '\0') *p++ = *str1++;
    while (*str2 != '\0') *p++ = *str2++;
    *p = 0;
    printf ("size: %d\n", strlen (nstr));
    return nstr;
}

It worked fine and printed the correct length of nstr . I'm puzzled, what caused the crash?

Answer 1

You need to return the value of nstr that was originally returned by malloc() .

Your first code block increments nstr until it points to the end of the allocated memory. The code then attempts to use and free that address, which is not owned by your program.

You need to save the starting address of the string so you can return it.

Answer 2

In your first case, you increment the nstr constantly, and in the end, you use

printf ("size: %d\n", strlen (nstr));

where nstr points to the final location after all the increment (containing null ).Results in 0 length. Then, you return the incremented pointer to the caller and try to free() it. Results in Undefined Behavior .

OTOH, in the second case, you have the pointer to the primarily allocated memory intact, through which you count the string length, returns correct value and later, free() -ing is also proper, so that works as expected.

Answer 3

In the first function, you're returning the wrong pointer. It's pointing at the null terminator of the string, so the length is zero. When you try to free() it, it isn't a pointer you got from malloc() . Undefined behavior results.

Answer 4

You're incrementing the nstr pointer when copying the two strings, and that's the pointer you're using to represent the string itself. Simply copy it in another variable and use it when referring to the string:

char *strcpy2 (char *str1, char *str2)
{
    int total = strlen (str1) + strlen (str2) + 1;
    char *nstr = malloc (sizeof (char) * total);
    char *str = nstr;                                // the string
    while (*str1 != '\0') *nstr++ = *str1++;
    while (*str2 != '\0') *nstr++ = *str2++;
    *nstr = '\0';
    printf ("size: %d\n", strlen (str));             // used here
    return str;                                      // and here
}

You can see it in action here: https://ideone.com/ncpVMU

I also took the liberty of fixing your goofy return statement:

return &(nstr[0]);