使用double的sprintf語句出錯（緩沖區溢出？）

Question

我遇到了錯誤的sprintf語句。 我添加了一個printf命令來幫助調查，似乎我的雙打之一可能沒有被理解（printf輸出一串無意義的數字，其中％3.1f應該是。）但是，double是第一次被正確解釋它在printf語句中調用。 通過將大小名稱從120增加到320，segfault確實消失了。 但雙重仍然沒有被正確解釋，即它仍然輸出一串無意義的數字，其中一個簡單的％3.1f應該是。 我無法弄清楚我做錯了什么。 有任何想法嗎？ 代碼的最小測試用例版本和下面發布的錯誤消息。

    #include <iostream>
    #include <string>
    #include <fstream>
    #include <sstream>
    #include <strstream>
    #include <vector>

    using namespace std;


    void Back_Subt_beta()
    {

        int resonances = 4;
        char name[320];
        double rpos[66];
        double rbinmin[66];
        double rbinmax[66];

        ifstream binedgein;
        binedgein.open("binedges.dat");
        if (binedgein.is_open()) {
            cout << "data file opens" << endl;
            }
        for (int vline=1; vline<=4; vline++)
        {
            binedgein >> var1 >> var2 >> var3;
            rpos[vline-1] = var1;
            rbinmin[vline-1] = var2;
            rbinmax[vline-1] = var3;
        }
        binedgein.close();


        for (int m=2; m<=7; m++)
        {
            for (int j=0; j<resonances; j++)
            {
                printf("resonance%0#7.2feV/gammas_%3.1feV_Mcl%i", rpos[j],rpos[j],m);
                sprintf(name,"resonance%0#7.2feV/gammas_%3.1feV_Mcl%i",rpos[j],rpos[j],m);
            }
        }
        exit();
    }

和文件binedges.dat

16.2      16.0      16.5
38.75     38.25     39.25
44.5      43.5      45.5
55.25     54.75     55.75

而錯誤：

Processing Back_Subt_beta.C...
data file opens

 *** Break *** segmentation violation
resonance0016.20eV/gammas_917241681885348612676436160464141677586357964289319457240620564649334534999701390133785258335880600276911524435084428436805391368574132924760441246552362332456319675531264.0eV_Mcl16(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".
Attaching to program: /proc/7689/exe, process 7689
[Thread debugging using libthread_db enabled]
[New Thread -1208284352 (LWP 7689)]
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.
(no debugging symbols found)...done.

0x006dd7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x014d3533 in __waitpid_nocancel () from /lib/tls/libc.so.6
#2  0x0147c869 in do_system () from /lib/tls/libc.so.6
#3  0x00962b8d in system () from /lib/tls/libpthread.so.0
#4  0x00bebc8e in TUnixSystem::Exec () from /usr/local/root/lib/libCore.so
#5  0x00be6dfb in TUnixSystem::StackTrace () from /usr/local/root/lib/libCore.so
#6  0x00be5c53 in TUnixSystem::DispatchSignals () from /usr/local/root/lib/libCore.so
#7  0x00bebf4d in SigHandler () from /usr/local/root/lib/libCore.so
#8  0x00be0590 in sighandler () from /usr/local/root/lib/libCore.so
#9  <signal handler called>
#10 0x014b1d0a in strcmp () from /lib/tls/libc.so.6
#11 0x003033be in G__searchvariable () from /usr/local/root/lib/libCint.so
#12 0x002f9514 in G__getvariable () from /usr/local/root/lib/libCint.so
#13 0x0021de97 in G__getitem () from /usr/local/root/lib/libCint.so
#14 0xbfeb89dc in ?? ()
#15 0x0021c633 in G__getexpr () from /usr/local/root/lib/libCint.so
#16 0x00000048 in ?? ()
#17 0x002e9bc8 in G__letvariable () from /usr/local/root/lib/libCint.so
#18 0xbfeb987c in ?? ()
Root > Function Back_Subt_beta() busy flag cleared

Answer 1

我認為您的問題是char數組name只有120個字節，但是您使用sprintf語句溢出了該緩沖區。 將char緩沖區的大小從120字節增加到更大的值。 更好的是，使用snprintf()而不是sprintf() 。

Answer 2

我想知道這個號碼是什么，所以我這樣做了：

$ python
Python 2.7.2+ (default, Oct  4 2011, 20:06:09) 
[GCC 4.6.1] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> x = 917241681885348612676436160464141677586357964289319457240620564649334534999701390133785258335880600276911524435084428436805391368574132924760441246552362332456319675531264.0
>>> import struct
>>> struct.pack('<d', x)
'resonanc'

所以原始錯誤肯定是由你的字符串覆蓋緩沖區引起的。 如果你得到一個不同的垃圾值，嘗試查看實際位，也許你會弄清楚。

Answer 3

你溢出name char數組只有120字符。 更好的方法是使用std::string namestr然后在填充name時執行str.c_str()