objective-c我无法理解为什么使用sprintf lead程序崩溃

Question

-(void)InitWithPwd:(char *)pPwd
{

    char szResult[17];


    //generate md5 checksum
    CC_MD5(pPwd, strlen(pPwd),&szResult[0]);
    szResult[16] = 0;

    m_csPasswordHash[0]=0;


    for(int i = 0;i < 16;i++) 
    {

        char sz[3] = {'\0'};
        //crash in blow row. The first pass is ok. The third pass crash. 
        //I can't understand.
        sprintf(&sz[0],"%2.2x",szResult[i]);
        strcat(m_csPasswordHash,sz);
    }

    m_csPasswordHash[32] = 0;
    printf("pass:%s\n",m_csPasswordHash);
    m_ucPacketType = 1;

}

I want to get the md5 of the password. But above code crash again and again. I can't understand why.

Answer 1

Your buffer ( sz ) is too small, causing sprintf() to generate a buffer overflow which leads to undefined behavior, in your case a crash.

Note that szResult[1] might be a negative value when viewed as an int (which happens when passing a char -type value to sprintf() ), which can cause sprintf() to disregard your field width and precision directives in order to format the full value.

Here is an example showing this problem . The example code is written in C, but that shouldn't matter for this case.

This solves the problem by making sure the incoming data is considered unsigned:

sprintf(sz, "%02x", (unsigned char) szResult[i]);