为什么缓冲区溢出会在访问整数时导致分段错误？ [英] Why would buffer overruns cause segmentation faults when accessing an integer?

问题描述

在从函数A（）调用函数B（）期间，B（）分配100个字符的数组并填充它多次，包括一个101字符的字符串和一个110字符的字符串。这是一个明显的错误。

后来，函数A（）试图访问完全不相关的int变量i，发生分段错误。

我理解为什么发生缓冲区溢出，但是为什么当我访问这个整数时会出现分段错误？ code>调用 B（），B的前导码指令保存A的帧指针 - 堆栈上A保存局部变量的位置，然后用B自己的帧指针。它看起来像这样：

当B超过其局部变量时，将重新加载到帧指针中的值。这是垃圾作为帧指针值，所以A的所有局部变量都被丢弃。更糟糕的是，对局部变量的未来写入正在扰乱属于别人的内存。

During a call to function B() from function A(), B() allocates a 100-char array and fills it several times, including once with a 101-character string and once with a 110 character string. This is an obvious mistake.

Later, function A() tries to access completely unrelated int variable i, and a segmentation fault occurs.

I understand why the buffer overrun occurs, but why do I get a segmentation fault when I access this integer? Why is it that I don't simply get garbage data?

解决方案

When A() calls B(), B's preamble instructions save A's frame pointer—the location on the stack where A keeps local variables, before replacing it with B's own frame pointer. It looks like this:

When B overruns its local variables, it messes up the value which will be reloaded into the frame pointer. This is garbage as a frame pointer value, so all of A's local variables are trashed. Worse, future writes to local variables are messing with memory belonging to someone else.

这篇关于为什么缓冲区溢出会在访问整数时导致分段错误？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！