C ++ / Gcc-当func返回结构时，堆栈将被破坏

Question

I'm actually having troubles with a simple program which is supposed to pass a struct through named pipes.

Here is my main.cpp:

#include <cstdlib>                                                                                                   
#include <cstdio>
#include <iostream>
#include <string>
#include "NamedPipe.hh"

int             main()                                                                                               
{                                                                                                                    
  pid_t         pid;                                                                                                 
  std::string   str("test_namedPipe");                                                                               
  NamedPipe     pipe(str);                                                                                           
  message       *msg;                                                                                                

  //Initialisation of my struct                                                                                      
  msg = (message *)malloc(sizeof(message) + sizeof(char) * 12);                                                      
  msg->type = 1;                                                                                                     
  sprintf(msg->str, "Hello World");                                                                                  

  //Forking                                                                                                          
  pid = fork();                                                                                                      
  if (pid != 0) {                                                                                                    
    pipe.send(msg);                                                                                                  
  } else {                                                                                                           
    message msg_receive = pipe.receive(); //Here is the overflow                                                     
    std::cout << "type: " << msg_receive.type << " file: " << msg_receive.str << std::endl;                          
  }                                                                                                                  
  return (0);                                                                                                        
}

My NamedPipe.cpp:

#include "NamedPipe.hh"                                                                                              
#include <stdio.h>

NamedPipe::NamedPipe(std::string const &_name) : name("/tmp/" + _name) {                                             
  mkfifo(name.c_str(), 0666);                                                                                        
  // std::cout << "create fifo " << name << std::endl;                                                               
}

NamedPipe::~NamedPipe() {                                                                                            
  unlink(name.c_str());                                                                                              
}

void            NamedPipe::send(message *msg) {                                                                      
  int           fd;                                                                                                  
  int           size = sizeof(char) * 12 + sizeof(message);                                                          

  fd = open(name.c_str(), O_WRONLY);                                                                                 
  write(fd, &size, sizeof(int));                                                                                     
  write(fd, msg, (size_t)size);                                                                                      
  close(fd);                                                                                                         
}

message         NamedPipe::receive() {                                                                               
  int           fd;                                                                                                  
  int           size;                                                                                                
  message       msg;                                                                                                 

  fd = open(name.c_str(), O_RDONLY);                                                                                 
  read(fd, &size, sizeof(int));                                                                                      
  read(fd, &msg, (size_t)size);                                                                                      
  close(fd);                                                                                                         
  return (msg); //I debugged with printf. This actually reach this point before overflow                             
}

And my struct is defined like:

struct                          message {                                                                            
  int                           type;                                                                                
  char                          str[0];                                                                              
};

I actually think that may be a problem of memory allocation, but I have really no idea of what I should do to fix this.

Thanks for reading/helping !

Answer 1

This is the root of your problem, your struct message :

char str[0];

This is not kosher in C++ (nor is the way you're using it kosher in C). When you allocate a message on the stack, you're allocating room for one int and 0 char s. Then in this line

read(fd, &msg, (size_t)size);

you write beyond your stack allocation into neverland. Then you return your message object which would be just one int in size.

Change your struct to this, and it should "work"

    struct message
    {
        int type;
        char str[ 16 ];
    };