为什么在执行memcpy时会检测到堆栈粉碎？

Question

    char test[]={"abcde"};
    char* test1={"xyz"};
    memcpy(test+5,test1,3);
    printf("%s",test);

I'm trying to grasp how exactly memcpy works and this is the example I've written so far. This gives output as abcdexyz&vjunkcharacters

and the following message.

*** stack smashing detected ***: ./testcode terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x45)[0xb7656dd5]
/lib/i386-linux-gnu/libc.so.6(+0xffd8a)[0xb7656d8a]
./testcode[0x8048797]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3)[0xb75704d3]
./testcode[0x80483a1]

What are the reasons behind this situation?

Answer 1

Root Cause:

char test[]={"abcde"};

Allocates enough memory space to store 5 characters only.

memcpy(test+5,test1,3);  

Copies the data pointed by test1 beyond the allocated memory space.
Technically, writing beyond the bounds of an allocated memory in this fashion is Undefined Behavior , which means anything can happen.

What actually happens?

What actually happens here is memcpy copies characters beyond the allocated memory thus overwritting the NULL terminator which marks ends of your character array test .
Further, printf reads the contents from starting address of test till it encounters a random NULL thus printing out junk characters.

Solution:
You should ensure that destination buffer has enough memory allocated before you perform the memcpy . Since you intend to copy 3 characters, Your destination buffer test should be atleast:

5 + 3 + 1 byte for NULL terminator = 9 bytes

You can simply use:

char test[9]="abcde";

Answer 2

Your memcpy call does smash the stack, which is why you see that message. You're copying data past the end of your test array, which isn't allowed.

Answer 3

Doing it without an additional buffer

The most straight-forward approach, indeed, would be to avoid the copy:

#include <string.h>
#include <stdio.h>

int main() {
  char a[] = "abcde";
  char b[] = "xyz";
  printf("%s%s\n", a, b);
  return 0;
}

---

Doing it with memcpy

memcpy copies n bytes from src to dest . You need to keep track of copying null termination bytes of the strings correctly yourself.

#include <string.h>
#include <stdio.h>

int main() {
  char a[] = "abcde";
  char b[] = "xyz";

  /* note that both strings add a '\0' termination */
  char c[sizeof(a) + sizeof(b) - 1];

  /* copy the content of a to c */
  memcpy(c, a, sizeof(a));

  /* copy the content of b to where a ends (concatenate the strings) */
  memcpy(c + sizeof(a) - 1, b, sizeof(b));

  /* note that the '\0' termination of the string is necessary to let
   * functions like printf know where the string is over 
   */
  printf(c);

  return 0;
}

---

Doing it with strcpy and strcat

Note that there's a lot of pitfalls dealing correctly with the null termination of the strings when using memcpy. To simplify this procedure for strings you should do the following.

If these are indeed strings and not random bytes you should stick to the string functions of the standard library. This is how it's done.

#include <string.h>
#include <stdio.h>

int main() {
  char a[] = "abcde";
  char b[] = "xyz";

  /* note that both strings add a '\0' termination */
  char c[sizeof(a) + sizeof(b) - 1];

  /* copy the content of a to c */
  strcpy(c, a);

  /* copy the content of b to where a ends (concatenate the strings) */
  strcat(c, b);

  /* note that the '\0' termination of the string is necessary to let
   * functions like printf know where the string is over 
   */
  printf(c);

  return 0;
}

---

On knowing the size of the strings

Concerning knowing the size of the buffer, note that you can usually not simply do sizeof(a_string) . If you pass a character array to a function it decays to a pointer and this operation no longer returns the expected size of the array but the size of the pointer.

For strings you need to issue strlen(a_string) which scans for the occurance of the null termination and returns the length of the string (not including the termination).

As for character buffers containing random data (or empty buffers that need to be written to) this approach doesn't work either. You always need to pass the size of the buffer as an additional parameter.

Answer 4

The line memcpy(test+5,test1,3); does the following in plain words:

"start at the last element of array "test" and copy 3 characters from array "test1" to there", which basically writes 2 characters beyond the length of the array 'test'.

So if you just want to play around with 'memcpy' define a 3rd array:

char test[]="abcde";
char test1[]="xyz";
char output[sizeof(test) + sizeof(test1)];
memset(output, 0, sizeof(output));
memcpy(&output[0],test,5);
memcpy(&output[5],test1,3);
printf("%s",output);

Answer 5

Variable test1 is in memory 4 chars, 3 plus the ending string terminator. Try this:

char test[9]={"abcde"};
char* test1={"xyz"};
memcpy(test+5,test1,4);