C program buffer overflow issue

Question

I have a code for which the char array size is 8. If the gcc to compile the code with -fno-stack-protector, the stack smashing detected will only be detected after the string size is 12, such as 12345678901234567890. If I use -fstack-protector, size 9 input will cause segmentation fault as shown below. May I know why the error only be detected at size 12 String input, not other numbers?

I did try different inputs with different char array sizes, the error will be detected when the overflow size is 11 to 13 (input size - char array size).

Code:

#include <stdio.h>

int i;

void readinput()
{
    char c, buf[8]; 
    int i;

    printf("Enter a string: ");
    for (i = 0; (c = getchar()) != '\n'; i++) buf[i] = c;
    buf[i] = '\0';
    printf("string = [%s]\n", buf);
}


int main(int argc, char *argv[])
{
    readinput();
    return 0;
}

Undefined behaviour can do whatever it likes. There is no rhyme or reason to what will happen. — Jonathan Leffler
– Jonathan Leffler, Commented Mar 25, 2022 at 10:03
A wire is rated with 100 kg strength. Why doesn't it snap at 101 kg tension? — Weather Vane
– Weather Vane, Commented Mar 25, 2022 at 10:11
Leak detection tools will only trigger on stack based variables when you get past the stack frame. If you don't exceed the stack frame, and corrupt neighbouring variables, nothing will be reported. — cup
– cup, Commented Mar 25, 2022 at 10:35

chqrlie · Accepted Answer · 2022-03-25 10:55:49Z

1

The code does not check that i is less than the length of the array, so it has undefined behavior if user input exceeds 7 characters. Enabling compiler options for buffer overflow checking is not foolproof, not every offending access is tested. The C programmer is in charge, good practices are needed to try and avoid such problems.

Here is a modified version:

#include <stdio.h>

void readinput(void) {
    char buf[8]; 
    size_t i;
    int c;

    printf("Enter a string: ");
    for (i = 0; (c = getchar()) != EOF && c != '\n';) {
        if (i + 1 < sizeof(buf))
            buf[i++] = c;
    }
    buf[i] = '\0';
    printf("string = [%s]\n", buf);
}

int main(int argc, char *argv[]) {
    readinput();
    return 0;
}

answered Mar 25, 2022 at 10:55

chqrlie

152k12 gold badges145 silver badges231 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

chux Over a year ago

Nice improvements with size_t i, int c, != EOF, i + 1 < sizeof(buf).

Collectives™ on Stack Overflow

C program buffer overflow issue

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related