C中的缓冲区溢出，具有分配双精度数组的功能

Question

我很容易地分配了一个字符串数组，到目前为止，它仍然可以正常工作，但是使用该功能，我的程序中没有一个缓冲区溢出。

代码：

/*
\fn char **clean_double_alloc(int y, int x)
\brief allocate array of string in desirated size.
\param y : the number of string
\param x : the lenght of each string
\return a new array of string(char **).
*/

char **clean_double_alloc(int y, int x)
{
    char **double_buffer = NULL;

    double_buffer = malloc(sizeof(char *) * (y + 1));
    if (double_buffer == NULL) {
        put_error("allocation error !\n");
        return (NULL);
    }
    for (int i = 0; i < y; i++) {
        double_buffer[i] = NULL;
        double_buffer[i] = clean_alloc(x);
        if (double_buffer[i] == NULL) {
            put_error("allocation error !\n");
            return (NULL);
        }
    }
    double_buffer[y + 1] = NULL;
    return (double_buffer);
}

注：我的clean_alloc并以其不能容纳的字符数作为参数（以字节为单位，然后用'\ 0'填充分配的空间。

这里是clean_alloc代码：

char *clean_alloc(int size)
{
    char *str = NULL;

    str = malloc(size * sizeof(char));
    if (str == NULL) {
        my_putstr("allocation error !");
        return (NULL);
    }
    for (int i = 0; i < size; i++)
        str[i] = '\0';
    return (str);
}

我使用-fsanitize = address进行编译，并获得了以下跟踪信息：

==8342==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000040 at pc 0x000000405176 bp 0x7ffc8d494ff0 sp 0x7ffc8d494fe0
WRITE of size 8 at 0x604000000040 thread T0
    #0 0x405175 in clean_double_alloc warlock/string/initialize_more.c:35
    #1 0x4015cc in prepare_maze src/main.c:55
    #2 0x4013f7 in main src/main.c:38
    #3 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)
    #4 0x40119d in _start (/home/mlg/Programming/github repo/Dante-s-Star/generator/generator+0x40119d)

0x604000000040 is located 0 bytes to the right of 48-byte region [0x604000000010,0x604000000040)
allocated by thread T0 here:
    #0 0x7f8f29663c58 in __interceptor_malloc (/lib64/libasan.so.5+0x10dc58)
    #1 0x405038 in clean_double_alloc warlock/string/initialize_more.c:22
    #2 0x4015cc in prepare_maze src/main.c:55
    #3 0x4013f7 in main src/main.c:38
    #4 0x7f8f2926df42 in __libc_start_main (/lib64/libc.so.6+0x23f42)

SUMMARY: AddressSanitizer: heap-buffer-overflow warlock/string/initialize_more.c:35 in clean_double_alloc
Shadow bytes around the buggy address:
  0x0c087fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c087fff8000: fa fa 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c087fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa

Answer 1

您为一个y + 1指针长的数组分配了一个数组，但是您有这个调用：

double_buffer[y + 1] = NULL;

这似乎是一个错误，应该是：

double_buffer[y] = NULL;

这突出了问题：

int buffer[3 + 1] = {1, 2, 3, 4};
printf("Correct: %d\nIncorrect: %d\n", buffer[3], buffer[3 + 1]);