Stack Smashing Detected at End of Program

问题

I am currently testing a program on a smaller scale to distinguish a problem when I attempt to exit the program by return 0; at the end of the main function.

Main.c

#include <stdio.h>
#include <stdlib.h>
#include "Header.h"

int main (void)
{
        int i;
        int Fin = 0;


        Student sStu;
        Array aAry;
        Student *Stu = &sStu;
        Array *Ary = &aAry;

        InitArray(Ary, 1);

        while(Fin != 2)
        {
                printf("Please choose a selection.\n");
                printf("1. Add Student\n");
                printf("2. Print Students\n");
                printf("3. Exit\n");
                scanf("%d", &i);
                switch(i)
                {
                        case 1:
                        {
                                AddStudent(Stu, Ary);
                                break;
                        }
                        case 2:
                        {
                                for(i = 0; i < Ary->Size; i++)
                                {
                                        printf("%s %d\n", Stu[i].Name, Stu[i].IDn);
                                }
                                break;
                        }
                        case 3:
                        {
                                return 0;
                        }
                }
        }
}

Header.h

#ifndef HEADER_H_
#define HEADER_H_

typedef struct student
{
        char Name[30];
        int IDn;
}Student;

typedef struct array
{
        Student *Student;
        size_t Used;
        size_t Size;
}Array;


void InitArray(Array *Ary, int InitSize);
void AddArray(Array *Ary);
Student AddStudent(Student *Stu, Array *Ary);

#endif

Grade.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "Header.h"

void InitArray(Array *Ary, int InitSize)
{
        Ary->Student =  malloc(InitSize * sizeof(Student));
        Ary->Used = 0;
        Ary->Size = InitSize;
        memset(&Ary->Student[0], 0 , sizeof(Student) * InitSize);
}

void AddArray(Array *Ary)
{
        Student Stud;
        if(Ary->Used == Ary->Size)
        {
                Ary->Size *= 2;
                Ary->Student = realloc(Ary->Student, Ary->Size * sizeof(Student));
        }

        strcpy(Ary->Student[Ary->Used].Name, Stud.Name);
        Ary->Student[Ary->Used].IDn = Stud.IDn;

        Ary->Used++;
}

Student AddStudent(Student *Stu, Array *Ary)
{
        int i;

        printf("\nStudent ID numbers cannot be the same!\n");
        printf("Please enter the student's name: ");
        scanf("%s", Stu[Ary->Used].Name);
        printf("Please enter the student's ID Number: ");
        scanf("%d", &Stu[Ary->Used].IDn);
        AddArray(Ary);
        printf("\n");
        return;
}

At the end of the file, when I try to return 0; I get this error:

* stack smashing detected *: ./a.out terminated Segmentation fault (core dumped)

When I use valgrind, I get this output:

==9966== Invalid write of size 1
==9966==    at 0x402C6C3: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9966==    by 0x8048687: AddArray (in /home/ctj0033/CSCE_1040/Homework/2_Homework/2_Test/a.out)
==9966==    by 0x804874B: AddStudent (in /home/ctj0033/CSCE_1040/Homework/2_Homework/2_Test/a.out)
==9966==    by 0x804881C: main (in /home/ctj0033/CSCE_1040/Homework/2_Homework/2_Test/a.out)
==9966==  Address 0x41f804c is 0 bytes after a block of size 36 alloc'd

valgrind terminates due to an fatal error during my attempt to exit my program.

It only happens at the end and I can print the contents of the struct array properly. I have looked into realloc(); since I am fairly sure the error lies within that, however I am uncertain precisely what I have done wrong. I have attempted to alter the way I allocate the memory in InitArray(); and the way I use realloc(); but to no avail.

What have I done wrong?

回答1:

Your immediate problem is that you're trying to use an "invalid pointer". (Actually, it's a completely valid pointer, it just points to a wrong place)

sStu is a Student, and Stu is a pointer to it. But when you add your second student, you write to Stu[1] - which is the space after sStu. Most likely there's something else in this space, so when you write to Stu[1], you overwrite something else. (It's unpredictable exactly what will be in that space.)

It looks like you want to use Ary->Student everywhere you have Stu.

(If you do that, you might find some more problems - such as the fact that you check if you need to expand the array after writing to the next element)

来源：https://stackoverflow.com/questions/32959038/stack-smashing-detected-at-end-of-program