Visual Studio - 缓冲区溢出

Question

Having this code:

#include <iostream>
#include <math.h>
#include <algorithm>


double abs_length(int * ar)
{
    return (
        sqrt(pow(double(ar[0]), 2) + pow(double(ar[1]), 2))
        );
}

int ** correction(int size, int(*ar)[2], int refX, int refY)
{
    int **ar2 = new int*[2];
    for (int i = 0; i < size; i++)
    {
        int x = abs(ar[i][0] - refX);
        int y = abs(ar[i][1] - refY);
        int vector[2] = { x,y };
        ar2[i] = vector;
    }
    return ar2;
}

double median(int size, int(*ar)[2], int refX, int refY)
{
    int **coordinates = correction(size, ar, refX, refY);
    double* lengths = new double(size);

    for (int i = 0; i < size; i++)
    {
        lengths[i] = abs_length(coordinates[i]);
    }
    sort(lengths, lengths + size);

    return  size % 2 == 0 ? (lengths[(size / 2) - 1] + lengths[size]) / 2 :
        lengths[(size / 2) - 1];
}

And for

lengths[i] = abs_length(coordinates[i]);

I am getting warning (which ends up with fatal error):

Buffer overrun while writing to 'lengths': the writable size is '1*8' bytes, but '16' bytes might be writen.

I do not understand it. Why could be 16 bytes written, when double is sizeof 8? 16 is address, but abs_length is returning double, no pointer. So where is bug?

Answer 1

There's an error here

int ** correction(int size, int(*ar)[2], int refX, int refY)
{
    int **ar2 = new int*[2];
    for (int i = 0; i < size; i++)
    {
        int x = abs(ar[i][0] - refX);
        int y = abs(ar[i][1] - refY);
        int vector[2] = { x,y };
        ar2[i] = vector;
    }
    return ar2;
}

The lines

        int vector[2] = { x,y };
        ar2[i] = vector;

create a local array and stores a pointer to that array. The array is destroyed when you exit the body of the for loop, so you are storing a pointer to an object which has been destroyed.

This code would work

        int* vector = new int[2];
        vector[0] = x;
        vector[1] = y;
        ar2[i] = vector;

There may be other errors, far too many pointers in your code.

Answer 2

You made a typo:

new double(size)

allocates space for a single double with value size .

You probably meant:

new double[size]

which allocates space for an array of size doubles.