访问指向结构的指针会导致内存读取冲突

Question

Recently I've been programming a lot in C, due to an influx of free time. As C (in my opinion) is a very difficult language to pick up and learn, I make mistakes and memory leaks left and right, occasionally getting stuck on a seemingly unfixable problem, like I have right now.

My code is intended to be a naïve Bignum implementation: have a bit for signing a number, a list of integers, and a counter for how many ints are actually there. Because two quintillion isn't enough!

Anyways, this is my code:

#include <stdlib.h>

const unsigned int INTSZ = (int)sizeof(int), CHRSZ = (int)sizeof(char);

typedef struct {
    unsigned int negative : 1;
    unsigned int count;
    unsigned int* list;
} VLENNUM_I;

typedef struct {
    unsigned int negative : 1;
    unsigned int count;
    unsigned char* list;
} VLENNUM_C;

int ceiling(double x) {
    return (((int)x) == x) ? (int)x : (int)x + 1;
}

VLENNUM_I* vlnc_to_vlni(VLENNUM_C* toconv) {
    VLENNUM_I result = { 0 };
    VLENNUM_C drtc = *toconv;

    result.negative = drtc.negative;
    result.count = ceiling(drtc.count / INTSZ);
    result.list = calloc(result.count, INTSZ);

    unsigned int i = 0, temp = 0, toprl = 0;
    for (; i < drtc.count; ++i) {
        temp |= drtc.list[i] << (3 - i % 4) * 8; // Right here

        if (i > 0 && !((i + 1) % 4)) {
            result.list[toprl] = temp;
            temp = 0;
            ++toprl;
        }
    }

    if (!(i % 4)) result.list[toprl + 1] = temp;

    return &result;
}

VLENNUM_C* vlni_to_vlnc(VLENNUM_I* toconv) {
    VLENNUM_C result = { 0 };
    VLENNUM_I drtc = *toconv;

    result.negative = drtc.negative;
    result.count = drtc.count * INTSZ;
    result.list = calloc(result.count, CHRSZ);

    unsigned int i = 0, c = 0, masks[4] = { 255, 65280, 16711680, 4278190080 };

    for (; i < drtc.count; ++i)
        for (int j = 0; j < 4; ++j)
            result.list[(i * 4) + (3 - j)] = (char)((drtc.list[i] & masks[j]) >> (j * 8));

    return &result;
}

int main(void) {
    VLENNUM_I x = { 0 };

    x.count = 1;
    x.negative = 0;
    x.list = malloc(1 * INTSZ);

    x.list[0] = 172639;

    VLENNUM_C* y = vlni_to_vlnc(&x);

    VLENNUM_I* z = vlnc_to_vlni(y);

    return 1;
}

VLENNUM_I and VLENNUM_C are "variable length numbers" with lists of int s or char s. vlnc_to_vlni converts a VLENNUM_C to a VLENNUM_I , and vice versa for vlni_to_vlnc . Inputs and outputs are in pointers in case a large value is passed so essentially an integer is returned instead of a large chunk of data representing a struct. Running the code in Visual Studio 2020 results in a memory read error where I have pointed it out with a comment; stepping through the code with VS's debugger results in some helpful albeit meaningless to me information: toconv is filled with some kind of garbage data. For example, the count variable contained inside the struct is replaced with a random number instead of what it should be. Can someone help me find out what this means and how to fix it?

Answer 1

Both vlnc_to_vlni and vlni_to_vlnc have a fatal flaw:

VLENNUM_I* vlnc_to_vlni(VLENNUM_C* toconv) {
    VLENNUM_I result = { 0 };
    // ...
    return &result;
}

VLENNUM_C* vlni_to_vlnc(VLENNUM_I* toconv) {
    VLENNUM_C result = { 0 };
    // ...
    return &result;
}

You're returning the address of a local variable, which is a quick way to end up with memory errors. The operating system keeps track of program execution using a call stack , which looks something like this when the program starts:

[  main: x, y, z ]

This chunk of the call stack (called a stack frame ) has the address of the current function ( main ) and that function's local variables. When you call vlni_to_vlnc :

[ main: x, y, z ][ vlni_to_vlnc: result, drtc, i, c, masks ]

That function gets its own stack frame with space for its own locals. When you return &result , you're returning this address:

[ main: x, y, z ][ vlni_to_vlnc: result, drtc, i, c, masks ]
                                 ^^^^^^

But the stack frame goes away when the function ends, which leaves you with a pointer like this:

[ main: x, y, z ]                [????]
                                 ^^^^^^

When you call vlnc_to_vlni , its stack frame goes where vlni_to_vlnc 's was:

[ main: x, y, z ][ vlnc_to_vlni: result, drtc, i, c, masks ]
                                 ^^^^^^ whoops!

In short, your VLENNUM_I * is pointing into the newly allocated stack frame, which you then write to -- so the data you expect to be there is being changed.

The solutions in this case would be to do one of the following:

• return the struct by value
• dynamically allocate it with malloc and then free it later
• take the result pointer as an argument (eg vlnc_to_vlni(VLENNUM_C *toconv, VLENNUM_I *out) ) and store the result there

Answer 2

It is crashing because the code forms a pointer to a local stack variable in both functions by returning its address. The structures either need to be allocated on the heap or referenced from a different scope.

#include <stdlib.h>
#include <assert.h>

const unsigned int INTSZ = (int)sizeof(int), CHRSZ = (int)sizeof(char);

typedef struct
{
    unsigned int  negative : 1;
    unsigned int  count;
    unsigned int* list;
} VLENNUM_I;

typedef struct
{
    unsigned int   negative : 1;
    unsigned int   count;
    unsigned char* list;
} VLENNUM_C;

int ceiling(double x)
{
    return (((int)x) == x) ? (int)x : (int)x + 1;
}

void vlnc_to_vlni(VLENNUM_C* toconv, VLENNUM_I* result)
{
    VLENNUM_C drtc   = *toconv;
    assert(result != NULL);

    result->negative = drtc.negative;
    result->count    = ceiling(drtc.count / INTSZ);
    result->list     = (unsigned int*)calloc(result->count, INTSZ);

    unsigned int i = 0, temp = 0, toprl = 0;
    for (; i < drtc.count; ++i)
    {
        temp |= drtc.list[i] << (3 - i % 4) * 8;  // Right here

        if (i > 0 && !((i + 1) % 4))
        {
            result->list[toprl] = temp;
            temp               = 0;
            ++toprl;
        }
    }

    if (!(i % 4))
        result->list[toprl + 1] = temp;
}

void vlni_to_vlnc(VLENNUM_I* toconv, VLENNUM_C *result)
{
    VLENNUM_I drtc   = *toconv;
    assert(result != NULL);

    result->negative = drtc.negative;
    result->count    = drtc.count * INTSZ;
    result->list     = (unsigned char*)calloc(result->count, CHRSZ);

    unsigned int i = 0, c = 0, masks[4] = {255, 65280, 16711680, 4278190080};

    for (; i < drtc.count && result && result->list; ++i)
    {
        for (int j = 0; j < 4; ++j)
        {
            int k = (i * 4) + (3 - j);
            if (k < drtc.count)
                result->list[k] = (char)((drtc.list[i] & masks[j]) >> (j * 8));
        }
    }

}

int main(void)
{
    VLENNUM_I x = {0};

    x.count    = 1;
    x.negative = 0;
    x.list     = (unsigned int*)malloc(1 * INTSZ);

    x.list[0] = 172639;

    VLENNUM_C y = {0};
    vlni_to_vlnc(&x, &y);

    VLENNUM_I z = {0};
    vlnc_to_vlni(&y, &z);

    return 1;
}