0

I have been having this rare segfault, and while debugging it, I managed to get the following output from addr2line program.

void std::string::_S_copy_chars<__gnu_cxx::__normal_iterator<unsigned char 
const*, std::vector<unsigned char, std::allocator<unsigned char> > > >
(char*, __gnu_cxx::__normal_iterator<unsigned char const*, 
std::vector<unsigned char, std::allocator<unsigned char> > >,
__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, 
std::allocator<unsigned char> > >)
??:?

Since _S_copy_chars() is a private function in std::string, I am obviously not calling it directly. But I am unable to guess which public function is calling it. If I can figure out the public function, I can zero in on the null de-referencing that is causing the segfault.

I am suspecting the following code...

std::string CInProtocolBase::RetrieveStr(std::vector<unsigned 
char>::const_iterator& iter)
{
    unsigned long sizeOfStr;
    const unsigned char& size = *iter;
    memcpy(&sizeOfStr,&size,4);
    sizeOfStr = 
    boost::asio::detail::socket_ops::network_to_host_long(sizeOfStr);
    std::string str(iter+4,iter+4+sizeOfStr); // <= Could this be culprit??
    iter += (4 + sizeOfStr);
    return str;
}

The Other candidate is this:

std::string CInProtocolBase::VectorToStr(const std::vector<unsigned char>& vec)
{
    return std::string(vec.begin(),vec.end());
}
4

1 回答 1

3

我memcpy(&sizeOfStr,&size,4)看到两个问题。

第一个是从一个单字节变量中复制四个字节。这是一个明确的未定义行为。

第二个sizeOfStr可能是 8 个字节（在 64 位系统上，GCC 通常long是 64 位）。这将使部分变量未初始化，因此是不确定的，再次导致未定义的行为。

使用普通赋值并让编译器为您正确进行转换：

sizeOfStr = size;
于 2017-12-12T09:35:43.460 回答