如何强制 C 程序打印意外结果？

Question

The source code of square.c is:

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int square(int *ptr)
{
  int a;
  a = *ptr;
  return a * a;
}

int main(int argc, char **argv)
{
  int a, aa;
  srandom(time(NULL));
  a = random() % 10 + 1;
  aa = square(&a);
  printf("%d\n", aa);
  return 0;
}

The command-line to compile the source code is:

gcc square.c -o square

Is it possible to run the square executable in Linux so that the printed value will not be a square of any integer number?

Any method of running the program is allowed.

Answer 1

Yes. We can override printf.

Write the code in your post into square.c and compile it with gcc square.c

Make this file, fakesquare.c

int printf(char *str,int i)
{
    return puts("7");
}

Compile fakesquare.c as a shared library:

gcc -fPIC -o libfakesquare.so -shared fakesquare.c

Run the square program with libfakesquare.so preloaded:

[15:27:27 0 /tmp] $ LD_PRELOAD=./libfakesqare.so ./a.out
7
[15:29:16 0 /tmp] $ LD_PRELOAD=./libfakesqare.so ./a.out
7
[15:29:16 0 /tmp] $ LD_PRELOAD=./libfakesqare.so ./a.out
7

Witout libfakeshared.so preloaded:

[15:29:40 0 /tmp] $  ./a.out
36
[15:29:41 0 /tmp] $  ./a.out
16
[15:29:42 0 /tmp] $  ./a.out
64

Answer 2

The only dependency at your code is libc. If libc stays unmodified then your code will always work.

Also your program will fail if before running it, all available memory is exhausted. You can always check if ptr!=NULL.

Answer 3

You could use this :

Fastest way to determine if an integer's square root is an integer

Their code seems optimized, but whichever is simplest should do the trick for you.

Answer 4

Assuming a standard C environment I don't see a reason why this should fail on a standard platform. The code might fail if printf is not doing what it is inteded to do, but probably this is not what you are asking for. It also might fail on a platform where int is as small as a byte and a byte is only 6 bits wide. In this case your square function might calculate 9*9=81 which will not fit in the result type int (0..63 for 6 bit-byte). But in my opinion this is a quite academic case.