malloc（）：内存损坏

Question

Here is the simplified program that I think can lead to this error.

char *p = (char*)malloc(8192);
for(int i = 0; i < 9200; ++i){
  p[i] = '1';
}
char *s = (char*)malloc(strlen(p)); 

The original project is rather complicated, so I simplified it. I assigned 8192 bytes using malloc. Then my program will write more than 8192 characters in to the array. Then I will allocate memory using malloc.

This mini program didn't crash. But in the original big project, it crashes with this error:

malloc(): memory corruption: 0x0000000007d20bd0 ***

What may cause this difference?

Answer 1

It is undefined behavior because you have allocated 8192 bytes memory but you are trying to write 9200 bytes. Which is out of bound.

Answer 2

What may cause this difference?

Basically, the memory allocator allocates pages of memory at once for use by programs, and it gives you a pointer within them (making sure the following space is free for use). Since these pages are usually bigger than 8KiB, you have no issue in your mini-program. But if a larger program is allocating larger amounts of memory and writing further and further past the end of your allocated space, then you'll end up attempting to write into unallocated memory (or memory used by another program!), thus corrupting memory.

Answer 3

Writing to memory which you have not allocated is undefined behaviour. That's because malloc() returns a section of memory which you may write to, so when you write past the end of that region, you are overwriting something which is not yours.

That could be a structure used by malloc itself, or something else entirely.

Answer 4

It is a matter of luck. Your operating system may reserve memory more than the 8kB you requested. Also what you have reserved before and after may have an effect on the behaviour.

It is not said that your program will crash on buffer overflow. In fact the behaviour is undefined or implementation defined.