Question

I am building an FTP client in C++ for personal use and for the learning experience, but I have run into a problem when allocating memory for storing LIST responses. The library I am using for FTP requests is libcurl which will call the following function when it receives a response from the server:

size_t FTP_getList( char *ptr, size_t size, size_t nmemb, void *userdata) {
    //GLOBAL_FRAGMENT is global
    //libcurl will split the resulting list into smaller approx 2000 character
    //strings to pass into this function so I compensate by storing the leftover
    //fragment in a global variable.
    size_t fraglen = 0;
    if(GLOBAL_FRAGMENT!=NULL) {
        fraglen = strlen(GLOBAL_FRAGMENT);
    }
    size_t listlen = size*nmemb+fraglen+1;
    std::cout<<"Size="<<size<<" nmemb="<<nmemb;
    char *list = new char[listlen];
    if(GLOBAL_FRAGMENT!=NULL) {
        snprintf(list,listlen,"%s%s",GLOBAL_FRAGMENT,ptr);
    } else {
        strncpy(list,ptr,listlen);
    }
    list[listlen]=0;
    size_t packetSize = strlen(list);
    std::cout<<list;
    bool isComplete = false;
    //Check to see if the last line is complete (i.e. newline terminated)
    if(list[size]=='\n') {
        isComplete = true;
    }
    if(GLOBAL_FRAGMENT!=NULL) {
        delete[] GLOBAL_FRAGMENT;
    }
    GLOBAL_FRAGMENT = GLOBAL_FTP->listParse(list,isComplete);
    delete[] list;
    //We return the length of the new string to prove to libcurl we
    //our function properly executed
    return size*nmemb;
}

The function above calls the next function to split each line returned into individual
strings to be further processed:

char* FTP::listParse(char* list, bool isComplete) {
    //std::cout << list;
    //We split the list into seperate lines to deal with independently
    char* line = strtok(list,"\n"); 
    int count = 0;
    while(line!=NULL) {
        count++;
        line = strtok(NULL,"\n");
    }
    //std::cout << "List Count: " << count << "\n";
    int curPosition = 0;
    for(int i = 0; i < count-1 ; i++) {
        //std::cout << "Iteration: " << i << "\n";
        curPosition = curPosition + lineParse((char*)&(list[curPosition])) + 1; 
    }
    if(isComplete) {
        lineParse((char*)&(list[curPosition]));
        return NULL;
    } else {
        int fraglen = strlen((char*)&(list[curPosition]));
        char* frag = new char[fraglen+1];
        strcpy(frag,(char*)&(list[curPosition]));
        frag[fraglen] = 0;
        return frag;
    }
}

The function above then calls the function below to split the individual entries in a line into separate tokens:

int FTP::lineParse(char *line) {
    int result = strlen(line);
    char* value = strtok(line, " ");
    while(value!=NULL) {
        //std::cout << value << "\n";
        value = strtok(NULL, " ");
    }
    return result;
}

This program works for relatively small list responses but when I tried stress testing it by getting a listing for a remote directory with ~10,000 files in it, my program threw a SIGSEGV… I used backtrace in gdb and found that the segfault happens on lines delete[] GLOBAL_FRAGMENT;' anddelete[] list;inFTP_getList. Am I not properly deleting these arrays? I am callingdelete[]` exactly once for each time I allocate them so I don’t see why it wouldn’t be allocating memory correctly…

On a side note: Is it necessary to check to see if an array is NULL before you try to delete it?

Also, I know this would be easier to do with STD::Strings but I am trying to learn c style strings as practice, and the fact that it is crashing is a perfect example of why I need practice, I will also be changing the code to store these in a dynamically allocated buffer that only is reallocated when the new ptr size is larger than the previous length, but I want to figure out why the current code isn’t working first. 🙂 Any help would be appreciated.

Answer 1

In this code

size_t listlen = size*nmemb+fraglen+1;
std::cout<<"Size="<<size<<" nmemb="<<nmemb;
char *list = new char[listlen];
if(GLOBAL_FRAGMENT!=NULL) {
    snprintf(list,listlen,"%s%s",GLOBAL_FRAGMENT,ptr);
} else {
    strncpy(list,ptr,listlen);
}
list[listlen]=0;

You are overruning your list buffer. You have allocated listlen bytes, but you write a 0 value one past the last allocated byte. This invokes undefined behavior. More practically speaking, it can cause heap corruption, which can cause the kind of errors you observed.

I didn’t see any issues with the way you are calling delete[].

It is perfectly safe to delete a NULL pointer.