Question

Problem solved, I missed a +1 when malloc

I am doing something on fuse, and I got a SIGABRT here, and then I use gdb to track that, I found something odd. I get a negative strlen result. I think that’s why when I free my char*, I got this signal.(sprintf may write more bytes then we malloc, so if I malloc a very small number, it still could write things in, but when I free that, the problem comes)

The function is here, the arguments are provided by fuse(A use space filesystem).

static int fs_getattr(const char *path, struct stat *stbuf)

    {
        int res;
        char *fullpath = NULL;
        fullpath = malloc(cpflen+strlen(path));
        sprintf(fullpath, "%s%s", cachepathfix, path);  
        res = lstat(fullpath, stbuf);
        free(fullpath);
    }

I ran gdb to see what’s going on there, at first I thought that may be due to the const char * do not ended by \000, but it actually ended by this

(gdb) x/10c path
0x8937140:  47 '/'  116 't' 101 'e' 115 's' 116 't' 0 '\000'

And then I try p strlen(path), I got a wired number -1218664720

(gdb) p strlen(path)
$2 = -1218664720

Is that I could not use strlen to measure the length of a const char * or other things I’ve done is wrong? Thanks you guys.

Answer 1

Add enough space for terminating null character in fullpath.

Change:

fullpath = malloc(cpflen+strlen(path));

to:

fullpath = malloc(sizeof(char) * (cpflen + strlen(path) + 1));