Re: Can this cause a program to crash?

"weidongtom@xxxxxxxxx" wrote:

I was reading some code and I came across this function:

function reformatted to be visible in one page. Why double
linefeeds?


static char *
base_name(char *s) {
char *bp;
char *ep;

bp = s;
ep = 0; /* Can this cause problem? */ /* NO. NULL better */
while (*s) {
if (s[0] == '/' && s[1] && s[1] != '/') bp = s + 1;
if (s > bp && s[0] == '/' && s[-1] != '/') ep = s;
++s;
}
if (!ep) ep = s;
*s = 0;
return bp;
}

Seems valid. Convoluted, but valid. Mishandles "\n".


ep = 0; Memory is not allocated to ep, so, this could write to any
memory address right? And I tried it out with:

#include <stdio.h>

int main(void){
char *b;
*b = 0;
return 0;
}

and I get a segmentation fault. So I guess that's a bug right?
(This is from the source code of hexdump-1.5).

The fault is because b is uninitialized and you attempt to use it.

--
<http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.txt>
<http://www.securityfocus.com/columnists/423>
<http://www.aaxnet.com/editor/edit043.html>
<http://kadaitcha.cx/vista/dogsbreakfast/index.html>
cbfalconer at maineline dot net



--
Posted via a free Usenet account from http://www.teranews.com

.

Relevant Pages

  • Re: Memory Access Error
    ... First, scanfexpects a char pointer ... of 'inputstring') you still would have the problem that 'inputstring' ... you a char pointer but not also some memory it would be pointing to. ...
    (comp.os.linux.development.apps)
  • Re: Memory leak
    ... that worries me is the potential for memory overwrites. ... Is it possible XML string is larger than m_XMLMessage buffer will ... > //Returns tag value for a given tag name from XML event ... > char* GetTagValueFromXMLmessage ...
    (microsoft.public.windowsce.embedded.vc)
  • Re: Passing Pointers
    ... And now you know why you didn't want to allocate that 100 char array above: ... Note the memory you're deleting was allocated within Input. ... so name now points to a dynamically allocated array of chars. ... >void Output ...
    (comp.lang.cpp)
  • Re: Unix process image limit Q
    ... I was talking about the memory image of the program after it gets ... For example if char aappears in the global space of the ... Assuming that there is a limit on the process image, ...
    (comp.unix.programmer)
  • Re: arrays and K&R §5.10
    ... > to a pointer to char. ... > like an array you have to first allocate memory it points to. ... > treating as an array of char pointers, i.e. you try to push values into ... > even seem to work because what 'apple' is pointing to is random and so ...
    (comp.lang.c)