程序终止，信号11，Typecasting时出现分段错误

Question

我在进行类型转换时遇到了分段错误。请参阅下面的代码段：

bool ism2_sub_set_aaa_index(
    ism2_cct_node_t * cct_node_p,
    ism2_aaa_index_t aaa_index)
{
    bool                                index_set;
    ism2_cct_node_t                    *par_p;
    ism2_cct_node_attr_t               *par_attr_p;
    ism2_opt_attr_t                    *node_opt_attr_p;
    ism2_cct_node_sub_bind_attr_t*      sub_bind_attr_p;


    if (!cct_node_p || ! cct_node_p->attr_p) {
        return FALSE;
    }

    if (cct_node_p->attr_p->aaa_index == aaa_index) {
        // unchanged
        return TRUE;            
    }                           
    index_set = (aaa_index ==  ISM2_AAA_INDEX_INVAL) ? FALSE : TRUE;

    cct_node_p->attr_p->aaa_index = aaa_index;

    /* allocate place for sub_bind_attr if needed */
    node_opt_attr_p = ism2_cct_opt_attr_find_or_alloc(
                           cct_node_p,
                           NULL,
                           ISSU_OBJID_ISM2_CCT_CFG_SUB_BIND_ATTR_T,
                           ISM2_PUBSUB_INDEX_ANY,
                           sizeof(ism2_cct_node_sub_bind_attr_t));

    sub_bind_attr_p = (ism2_cct_node_sub_bind_attr_t*)
                            node_opt_attr_p->data;

    /*some more code*/

我的coredump分析：

(gdb) bt
#0  ism2_sub_set_aaa_index (cct_node_p=0xfff4a4ffa0, aaa_index=4104454092) at sw/se/xc/bsd/config/ism2/src/ism2_sub.c:66
#1  0x00000001000c3aa0 in ism2_if_event_bind (if_state_p=0xfff85c81f8, if_node_p=0xfff2cdfe80, mbe_p=0x0, reason=0xffffffdbec)
    at sw/se/xc/bsd/config/ism2/src/ism2_inlines.h:196
#2  0x00000001000c5f68 in ism2_if_event_demux_state (obj_hdr_p=0xfff85c81f8, hdr_subid=16, mbe_p=0x0, reason=0xffffffdbec)
    at sw/se/xc/bsd/config/ism2/src/ism2_if.c:4522
#3  0x00000001000d1490 in ism2_main_process_one_msg (hdr_id=41696, hdr_subid=16, obj_hdr_p=0xfff85c81f8, event_in_q_p=0x6, mbe_p=0x0, 
    reason_p=0xffffffdbec, rc_p=0xffffffdbe8, event_in_requeue=0, buf_oper_p=0xffffffdc08) at sw/se/xc/bsd/config/ism2/src/ism2_main.c:1164
#4  0x00000001000d3cc0 in ism2_main_loop () at sw/se/xc/bsd/config/ism2/src/ism2_main.c:1886
#5  0x00000001000d71fc in ism2_main (argc=-1, argv=0xfffdc07858) at sw/se/xc/bsd/config/ism2/src/ism2_main.c:2844
#6  0x00000001000204ac in main (argc=-190513248, argv=0xfff4a4ffcc) at sw/se/xc/bsd/config/ism2/src/ism2.c:17

我怀疑它正在发生，因为两个structures(ism2_cct_node_sub_bind_attr_t and ism2_opt_attr_t)之间的对齐问题，定义为

typedef struct ism2_opt_attr_          
{   
    struct ism2_opt_attr_           *next;
    struct ism2_opt_attr_           *prev;

    ism2_opt_attr_state_t            state;

    ISSU_OBJ_ID                      oid;
    ism2_pubsub_index_t              index;
    uint32_t                         obj_size;
    ism2_mbe_info_t                  mbe_info;

    ism2_pubsub_obj_flags_t          ism2_pubsub_flags;

    void                            *data;
} ism2_opt_attr_t;

typedef struct ism2_cct_node_sub_bind_attr_
{
    u_int32_t   sub_bind_attr_set;

    u_int8_t    sub_bind_flags;
    u_int8_t    sub_bind_auth_flags;
    u_int8_t    sub_bind_type;
    u_int8_t    sub_acct_required;  /* push sub acct records to statd */
    u_int8_t    sub_clips_bounce;
    u_int8_t    padding1[3];

    u_int32_t   sub_idle_timeout_in;
    u_int32_t   sub_idle_timeout_out;
    u_int32_t   sub_idle_threshold_rate;
    u_int32_t   sub_sess_time;

    u_int64_t   sub_traffic_limit_in;
    u_int64_t   sub_traffic_limit_out;
    u_int64_t   sub_traffic_limit_both;

    u_int16_t   sub_bind_max_sess;   
    u_int16_t   padding2;

    char        *sub_bind_name_p;       
    char        *sub_bind_password_p;  
    char        *sub_bind_context_p;   
} ism2_cct_node_sub_bind_attr_t;