为什么只有当选择数组为3或7个元素时才会发生分段错误？

Question

我是C的初学者，试图用ncurses开发一个小软件，带有菜单驱动的界面。我有这个代码，来自http://tldp.org/HOWTO/NCURSES-Programming-HOWTO/menus.html。

我不明白为什么如果我初始化一个3或7项的选项数组程序会出现段错误，但如果数组是任何其他大小则没问题。

这是代码。如果向n_choices或calloc（）调用添加1，则不会发生分段错误。即

my_items = (ITEM **)calloc(n_choices + 1, sizeof(ITEM *));

为什么3和7是“特殊”???

#include <ncurses.h>
#include <string.h>
#include <fcntl.h>
#include <termios.h>
#include <menu.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))

WINDOW *mywin;
int rows, cols, h, w, starty, startx;
int wybeg, wxbeg, wymax, wxmax;

// choices
char *choices[] = {
    "Choice 1",
    "Choice 2",
    "Choice 3",
    "Choice 4",
    "Choice 5",
    "Choice 6",
    "Choice 7",
};
void func(char*);

int main(int argc, char** argv)
{
    ITEM **my_items;
    int c;              
    MENU *my_menu;
    int n_choices, i;
    ITEM *cur_item;

    initscr(); //creates stdscr
    cbreak();
    noecho();
    curs_set(0);
    keypad(stdscr, TRUE);

    if(has_colors() == TRUE){
        start_color();
        init_pair(1,COLOR_YELLOW,COLOR_BLUE);
    }

    getmaxyx(stdscr, rows, cols);
    h = rows-4;
    w = cols;
    starty = 1;
    startx = 0;

    char quitHint[] = "<Press q to exit>";

    move(0,0);
    mvprintw(LINES-1, COLS-1-strlen(quitHint), "%s", quitHint);
    refresh();

    mywin = newwin(h,w,starty,startx);
    keypad(mywin,TRUE);
    box(mywin,0,0);
    wbkgd(mywin,COLOR_PAIR(1));
    wrefresh(mywin);

    // MENU
    /* Create items */
    /**************************/
    /* FROM HERE IS THE POINT */
    /**************************/
    // if choices is 3 or 7 elements, segfault occurs! If adding +1 n_choices segfault doesn't occur
    n_choices = ARRAY_SIZE(choices);
    my_items = (ITEM **)calloc(n_choices, sizeof(ITEM *));
    for(i = 0; i < n_choices; ++i){
        my_items[i] = new_item(choices[i], choices[i]);
        /* Set the user pointer */
        set_item_userptr(my_items[i], func);
    }

    mvprintw(LINES-2,2,"sizeof(choices) = %3d | sizeof(*choices) = %3d | n_choices = %3d", sizeof(choices), sizeof(*choices), n_choices);

    /* Create menu */
    my_menu = new_menu((ITEM **)my_items);

    /* Set main window and sub window */
    set_menu_win(my_menu, mywin);
    set_menu_sub(my_menu, derwin(mywin, n_choices, 38, 2, 2));

    /* Set menu mark to the string " * " */
    set_menu_mark(my_menu, " * ");
    refresh();

    set_menu_fore(my_menu, COLOR_PAIR(1) | A_REVERSE);  // selected
    set_menu_back(my_menu, COLOR_PAIR(1));                          // unselected

    /* Post the menu */
    post_menu(my_menu);
    wrefresh(mywin);

    while((c = wgetch(mywin)) != 'q')
    {
        switch(c)
        {   case KEY_DOWN:
                menu_driver(my_menu, REQ_DOWN_ITEM);
                break;
        case KEY_UP:
            menu_driver(my_menu, REQ_UP_ITEM);
            break;
        case 10: /* enter */
        {
            /* execute func() from item pointer */
            ITEM *cur;
            void (*p) (char *);

            cur = current_item(my_menu);
            p = item_userptr(cur);
            p((char *)item_name(cur));
            pos_menu_cursor(my_menu);
            break;
        }
        }
        wrefresh(mywin);
    }

    /* Unpost and free all the memory taken up */
    unpost_menu(my_menu);
    free_menu(my_menu);
    for(i = 0; i < n_choices; ++i){
        free_item(my_items[i]);
    }

    endwin();
    return EXIT_SUCCESS;
}

void func(char *local_choice){  
    mvwprintw(mywin,h-2, 2, "Item selected is : %s", local_choice);
    wclrtoeol(mywin);
    box(mywin,0,0);
    wrefresh(mywin);
}   

用gcc -lmenu -lncurses编译

运行Debian Buster 4.19.0-2-686 #1 SMP Debian 4.19.16-1 (2019-01-17) i686 GNU/Linux

Answer 1

也许作者有同样的错误并决定分配一些额外的内存？但为什么3和7是“特殊”大小并触发段错误？

不，这是new_menu功能所需要的：

new_menu函数期望items列表由NULL元素终止。

如果您阅读new_menu文档（menu_new.3x.html），您可以看到：

概要

#include <menu.h> MENU *new_menu(ITEM **items);

描述

The function new_menu creates a new menu connected to a specified item pointer array(which must be NULL-terminated).

---

因此，您在3和7案例中看到的崩溃是 - 我认为 - 与如何将数据存储在内存中有关。您可以做的一件事是在调用my_items函数之前将new_menu内存+一个元素转储到文件中。

我想你会在元素之后有一些0值，但在3和7种情况下不会。 （我猜一些4多重调用效果）