C中简单可变参数字符串连接的内存分配

Question

I have the following test function to copy and concatenate a variable number of string arguments, allocating automatically:

char *copycat(char *first, ...) {
    va_list vl;
    va_start(vl, first);
    char *result = (char *) malloc(strlen(first) + 1);
    char *next;
    strcpy(result, first);
    while (next = va_arg(vl, char *)) {
        result = (char *) realloc(result, strlen(result) + strlen(next) + 1);
        strcat(result, next);
    }
    return result;
}

Problem is, if I do this:

puts(copycat("herp", "derp", "hurr", "durr"));

it should print out a 16-byte string, "herpderphurrdurr" . Instead, it prints out a 42-byte string, which is the correct 16 bytes plus 26 more bytes of junk characters.

I'm not quite sure why yet. Any ideas?

Answer 1

The variable-argument-list functions don't magically know how many arguments there are, so you're most likely walking the stack until you happen to hit a NULL .

You either need an argument numStrings , or supply an explicit null-terminator argument after your list of strings.

Answer 2

You need a sentinel marker on your list:

puts(copycat("herp", "derp", "hurr", "durr", NULL));

Otherwise, va_arg doesn't actually know when to stop. That fact that you're getting junk is pure accident since you're invoking undefined behaviour. For example, when I ran your code as-is, I got a segmentation fault.

Variable argument functions, such as printf need some sort of indication as to how many items are passed in: printf itself uses the format string up front to figure this out.

The two general methods are a count (or format string) which is useful when you can't use one of the possible values as a sentinel (a marker at the end).

If you can use a sentinel (like NULL in the case of pointers, or -1 in the case of non-negative signed integers, that's usually better so you don't have to count the elements (and possible get the element count and element list out of step).

---

Keep in mind that puts(copycat("herp", "derp", "hurr", "durr")); is a memory leak since you're allocating memory then losing the pointer to it. Using:

char *s = copycat("herp", "derp", "hurr", "durr");
puts(s);
free (s);

is one way to fix that, and you may want to put in error checking code in case the allocations fail.

Answer 3

What I understand from your code is that you assume va_next will return NULL once each argument has been "popped". That's wrong as va_next has absolutely no way to determine the number of arguments : your while loop will keep running until a NULL is randomly hit.

Solution : either provide the number of arguments, or add call your function with an additional "NULL" argument.

PS: if you are wondering why printf doesn't require such an additional argument, it's because the number of expected arguments is deduced from the format string (the number of '%flag')

Answer 4

As an addition to the other answers, you should cast the NULL to the expected type when using it as an argument to a variadic function: (char *)NULL . If NULL is defined as 0, then an int will be stored instead, which will accidentally work when int has the sime size as the pointer and NULL is represented by all bits 0. But none of this is guaranteed, so you may run into strange behaviour that's hard to debug when porting the code or even when only changing the compiler.

Answer 5

As others have mentioned, va_arg does not know when to stop. It is up to you to provide NULL (or some other marker) when you call the function. Just a few side notes:

• You must call free on pointers you obtain from malloc and realloc .
• There is no reason to cast the result of malloc or realloc in C.

• When calling realloc , it is best to store the return value into a temporary variable. If realloc is unable to reallocate enough memory, it returns NULL but the original pointer is not freed. If you use realloc the way you do, and it is unable to reallocate the memory, then you have lost the original pointer and your subsequent call to strcat will likely fail. You could use it like this:

   char *tmp = realloc(result, strlen(result) + strlen(next) + 1); if (tmp == NULL) { // handle error here and free the memory free(result); } else { // reallocation was successful, re-assign the original pointer result = tmp; }