C指针分配：错误的地址和分段错误

Question

I'm having a really weird problem here, hope someone can help me. That's the code.

Node *fct(Node *list)
{
  Node *node;
  node = list;
  ...
}

Usually everything runs smoothly, but in some random cases I get a Segmentation Fault. I debuged with GDB. Normaly the address of both list and node are 0x80d4000, but when the Segfault occurs, the address of node = 0x400. (list is still 0x80d4000).
I really don't see where this could possibly go wrong, any ideas?

Answer 1

This is not enough code to be sure, but I suspect that somewhere, you pass a copy of an address (a pointer) and make modifications on the COPY (like a malloc); instead of passing the address of this address (pointer on a pointer), so you actually modify the pointer and not one of its copies.

An example to illustrate what I'm talking about:

int dostuff(char* str)
{
    str = malloc(sizeof(char));
    str[0] = 0x42;
    return 1; // size of string.
}

int main(int argc, char** argv)
{
    char* mystr = NULL;
    unsigned int strlength = 0;
    strlength = dostuff(mystr);
    printf("%s\n", mystr);  // Segfaults here: mystr == NULL.
    free(mystr);
    return 0;
}

So here is what's happening:

1. You create a new char pointer set to NULL (better if you want to realloc, for instance).
2. You pass its value (NULL) to dostuff . The function makes a copy of this value (with a char* type), and modify this copy.
3. printf accesses mystr for printing, and while trying to read from NULL[0] (0), will segfault.

The rest of the main isn't executed, of course.

Here is why someone can fall into that pit: Usually, when you use some pointer with a function doing some modification on it, you modify its content , and not its address. When you modify its address, you almost always (excepted in cases like this one) have the function modifying it to return its new address. Like in address = malloc(size) .

In the other hand, if you want to set a POINTER (and not is content obviously), you will need to pass a copy of its address to the function. Here is the working version of the code above:

int dostuff(char** str)
{
    (*str) = malloc(sizeof(char));
    (*str)[0] = 0x42;
    return 1; // size of string.
}

int main(int argc, char** argv)
{
    char* mystr = NULL;
    unsigned int strlength = 0;
    strlength = dostuff(&mystr);
    printf("%s\n", mystr);  // Now works: mystr is allocated.
    free(mystr);
    return 0;
}

So remember: when in doubt, return the pointer and get the address of the other variables ( strlength here). If not possible, be very caucious about the actual type of the data you're manipulating, and double check your addresses after modification.

I hope it helps.