Valgrind错误。 在函数中使用malloc和realloc

Question

I am trying to make mystrcat function to work. It seems to return right string but valgrind gives errors on my code which I cant seem to fix.

char *mystrcat(char *dest, const char *src) {
    int len = strlen(dest) * 2;
    char *origdest = realloc(dest, len);
    while(*dest) {
        dest++;
    }

    while (*src) {
        *dest++ = *src++;
    }
    return origdest; 
}

int main(void) {
    char *str = malloc(7);
    strcpy(str, "First");

    str = mystrcat(str, "Second");
    printf("%s\n", str);
    free(str);
}

Valgrind errors which I don't understand:

==10== Invalid read of size 1
==10==    at 0x40068B: mystrcat (mystrcat.c:9)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Address 0x5203040 is 0 bytes inside a block of size 7 free'd
==10==    at 0x4C2FD5F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x40067B: mystrcat (mystrcat.c:8)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Block was alloc'd at
==10==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x4006E6: main (mystrcat.c:22)
==10== 
==10== Invalid write of size 1
==10==    at 0x4006AF: mystrcat (mystrcat.c:14)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Address 0x5203046 is 6 bytes inside a block of size 7 free'd
==10==    at 0x4C2FD5F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x40067B: mystrcat (mystrcat.c:8)
==10==    by 0x40070F: main (mystrcat.c:25)
==10==  Block was alloc'd at
==10==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10==    by 0x4006E6: main (mystrcat.c:22)

Answer 1

You need this (see comments for explanations):

char *mystrcat(char *dest, const char *src) {
    int len = strlen(dest) * 2;
    char *newdest = realloc(dest, len);
    // newdest contains the pointer to the newly allocated memory
    // and dest is now no longer valid

    dest = newdest;
    while(*dest) {
        dest++;
    }

    // now dest points to the end of the string in the newly
    // allocated memory

    while (*src) {
        *dest++ = *src++;
    }

    // add NUL terminator
    *dest = 0;

    // we return the newly allocated memory
    return newdest;  
}

But this function is still not entirely correct.

This is wrong:

int len = strlen(dest) * 2;

Doubling the size is wrong, because if src is longer than the length of the dest string, there won't be enough memory and you'll get a buffer overflow.

The memory size needed for the concatenated string is:

size of the original string + size of the string to be concatenated + 1

The +1 is needed because of the NUL string terminator.

You therefore need this:

int len = strlen(dest) + strlen(src) + 1;

And another thing:

char *mystrcat(char *dest, const char *src)

can be replaced by

char *mystrcat(const char *dest, const char *src)

because we actually don't modify the memory pointed by dest .

Be aware that your mystrcat only works if the destinatino pointer has been allocated with a malloc -like function.