Question

我试图在这个产生＆＃34;缓冲区溢出警告＆＃34;的简单示例代码中找到问题，在看了一会儿之后我决定发布这个以期希望某人可能看到我的代码中的错误？

消息：警告C6386 写入＆t; tmpArray＆＃39;时缓冲区溢出：可写大小为＆＃39; line.public：unsigned int __thiscall std :: basic_string，class std :: allocator＆gt; :: length（void）const（）* 12 * 4＆＃39;字节，但是＆＃39; 52＆＃39;可能会写入字节。

产生警告的示例：

#define STEP 12

void main()
{
    std::string line("Hello!");

    float* tmpArray = new float[line.length() * STEP];

    unsigned int v = 0;

    for (unsigned int i = 0; i < line.length(); i++)
    {
        tmpArray[  v  ]  = 0.0f;
        tmpArray[v + 1]  = 0.0f;
        tmpArray[v + 2]  = 0.0f;
        tmpArray[v + 3]  = 0.0f;
        tmpArray[v + 4]  = 0.0f;
        tmpArray[v + 5]  = 0.0f;
        tmpArray[v + 6]  = 0.0f;
        tmpArray[v + 7]  = 0.0f;
        tmpArray[v + 8]  = 0.0f;
        tmpArray[v + 9]  = 0.0f;
        tmpArray[v + 10] = 0.0f;
        tmpArray[v + 11] = 0.0f;

        v += STEP;
    }

    delete[] tmpArray;
}

我不知道我在哪里踩到不属于tmpArray的内存，我的意思是缓冲区是根据与字符串长度相同的值精确分配的。步长。

Answer 1

感谢上面评论过的aschepler，对此的解决方案是将.length（）返回的值复制到const unsigned int中，然后在两个地方使用它，如下所示：

<?php
if(isset($_POST['email'])) {

$email_to = "myemailaddress@test.com";
$email_subject = "New Subscriber";

$name = $_POST['name']; 
$email = $_POST['email']; 

function clean_string($string) {
  $bad = array("content-type","bcc:","to:","cc:","href");
  return str_replace($bad,"",$string);
}

$email_message = "Name: ".clean_string($name)."\n";
$email_message .= "Email: ".clean_string($email)."\n";

$headers = 'From: '.$name."\r\n".
'Reply-To: '.$email."\r\n" .
'X-Mailer: PHP/' . phpversion();
@mail($email_to, $email_subject, $email_message, $headers);  
header('Location: index.php');
}?>

分配：

const unsigned int lineLength = line.length();

For loop：

float* tmpArray = new float[lineLength * STEP];

缓冲区溢出 - 无法找到问题

1 个答案: