C中的缓冲区溢出具有分配双数组的功能

Question

我很容易地分配了一个字符串数组，到目前为止它工作得很好，但我在使用这个函数的一个程序中遇到了缓冲区溢出。

代码：

/*
\fn char **clean_double_alloc(int y, int x)
\brief allocate array of string in desirated size.
\param y : the number of string
\param x : the lenght of each string
\return a new array of string(char **).
*/

char **clean_double_alloc(int y, int x)
{
    char **double_buffer = NULL;

    double_buffer = malloc(sizeof(char *) * (y + 1));
    if (double_buffer == NULL) {
        put_error("allocation error !\n");
        return (NULL);
    }
    for (int i = 0; i < y; i++) {
        double_buffer[i] = NULL;
        double_buffer[i] = clean_alloc(x);
        if (double_buffer[i] == NULL) {
            put_error("allocation error !\n");
            return (NULL);
        }
    }
    double_buffer[y + 1] = NULL;
    return (double_buffer);
}

注意：我的 clean_alloc 将它可以容纳的字符数作为参数而不是字节大小，然后它用 '\0' 填充分配的 space。

clean_alloc 代码在这里：

char *clean_alloc(int size)
{
    char *str = NULL;

    str = malloc(size * sizeof(char));
    if (str == NULL) {
        my_putstr("allocation error !");
        return (NULL);
    }
    for (int i = 0; i < size; i++)
        str[i] = '[=11=]';
    return (str);
}

我使用 -fsanitize=address 编译并得到以下跟踪：

==8342==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000040 at pc 0x000000405176 bp 0x7ffc8d494ff0 sp 0x7ffc8d494fe0
WRITE of size 8 at 0x604000000040 thread T0
    #0 0x405175 in clean_double_alloc warlock/string/initialize_more.c:35
    #1 0x4015cc in prepare_maze src/main.c:55
    #2 0x4013f7 in main src/main.c:38
    #3 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
    #4 0x40119d in _start (/home/mlg/Programming/github repo/Dante-s-Star/generator/generator+0x40119d)

0x604000000040 is located 0 bytes to the right of 48-byte region [0x604000000010,0x604000000040)
allocated by thread T0 here:
    #0 0x7f8f29663c58 in __interceptor_malloc (/lib64/libasan.so.5+0x10dc58)
    #1 0x405038 in clean_double_alloc warlock/string/initialize_more.c:22
    #2 0x4015cc in prepare_maze src/main.c:55
    #3 0x4013f7 in main src/main.c:38
    #4 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)

SUMMARY: AddressSanitizer: heap-buffer-overflow warlock/string/initialize_more.c:35 in clean_double_alloc
Shadow bytes around the buggy address:
  0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c087fff8000: fa fa 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa

Answer 1

你 malloc 了一个 y + 1 指针长的数组，但是你有这个调用：

double_buffer[y + 1] = NULL;

这看起来差一个错误，应该是：

double_buffer[y] = NULL;

这突出了问题：

int buffer[3 + 1] = {1, 2, 3, 4};
printf("Correct: %d\nIncorrect: %d\n", buffer[3], buffer[3 + 1]);

C中的缓冲区溢出具有分配双数组的功能

buffer overflow in C with function to alloc double array

c

memory

malloc

buffer-overflow