Re: pass a local variable to a function

[Lorenzo Beretta <lory.fulgi@infinito.it>]

明亮 ha scritto:
> Hi guys,
> 
> This is my first email in this list, any help is much appreciated.
> As I know, it's not allowed to pass a local variable to a function,
> because the stack where local variable resides will be reused by other
> functions.
> eg:
>      1  #include <stdio.h>
>      2
>      3  char *fetch();
>      4
>      5  int main(int argc, char *argv[]){
>      6          char *string;
>      7          string = fetch();
>      8          printf("%s\n", string);
>      9          exit(0);
>     10  }
>     11
>     12  char *fetch(){
>     13          char string[10];
>     14          scanf("%s", string);
>     15          return string;
>     16  }
> 
> When the application is executed, after input "a", it will produce
> unknown characters, like "8Šè¿ôÿO". Which is like what I expect
> 
> However, if I change line 13 to:
>     13           char string[1024];
> 
> When I type "a", it echos "a", which is out of my expectation
> 
> Why does it behave like this?
> 
> Thanks in advance,
> longapple
> --
> To unsubscribe from this list: send the line "unsubscribe linux-c-programming" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Try something like this
------
void p(int n){
	int onstack;
	printf("%p\n", &onstack);
	if(n>0) p(n-1);
}

int main(){
	p(5);
	return 0;
}
------

It should (system dependant) print a sequence of decreasing hex numbers;
that's because each time you call a function on your computer, the local 
stack grows downwards.

When you scanf() into a character array, it writes into the first 
characters of your array, that is string[0], then string[1], and so on: 
notice that the address of string[1] is GREATER than the address of 
string[0]...

Summing up there are two cases (assume that X stands for "any value"):

1) string[10]
==> { X, X, X, X, X, X, X, X, '\0', 'a' }
2) string[1024]
==> { X, X, X, (long sequence of garbage)..., '\0', a' }

When you call printf(), the printf function overwrites some bytes for 
its own stack variables: if it takes more than 10 bytes (eg 42), the 
small array will be completely overwritten, while with the big array it 
will only overwrite string[1023...980] (which was garbage anyway!), 
leaving string[0...979] intact.

I hope that was helpful; try gooling "buffer overflow" for more info


lb

--
To unsubscribe from this list: send the line "unsubscribe linux-c-programming" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html