c堆栈检测到粉碎

Question

我创建了一个文件,在用户想要输入的情况下多次打印Hello,world.

#include <stdio.h>
#include <string.h>
int main() {
    char message[10];
    int count, i;

    strcpy(message, "Hello, world!");

    printf("Repeat how many times? ");
    scanf("%d", &count);

    for(i=0; i < count; i++)
        printf("%3d - %s\n", i, message);
}

无论输入的数字是多少,它总会导致"堆栈粉碎".这是程序,任何人都可以得出结论为什么这样做？这是检测到堆栈粉碎后发生的"追溯":

sean@blue:~/programming$ ./a.out
Repeat how many times? 12
  0 - Hello, world!
  1 - Hello, world!
  2 - Hello, world!
  3 - Hello, world!
  4 - Hello, world!
  5 - Hello, world!
  6 - Hello, world!
  7 - Hello, world!
  8 - Hello, world!
  9 - Hello, world!
 10 - Hello, world!
 11 - Hello, world!
*** stack smashing detected ***: ./a.out terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x45)[0x1f8c75]
/lib/i386-linux-gnu/libc.so.6(+0xe8c27)[0x1f8c27]
./a.out[0x8048524]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3)[0x129113]
./a.out[0x80483f1]
======= Memory map: ========
00110000-00288000 r-xp 00000000 08:01 1577912    /lib/i386-linux-gnu/libc-2.13.so
00288000-0028a000 r--p 00178000 08:01 1577912    /lib/i386-linux-gnu/libc-2.13.so
0028a000-0028b000 rw-p 0017a000 08:01 1577912    /lib/i386-linux-gnu/libc-2.13.so
0028b000-0028e000 rw-p 00000000 00:00 0 
0036b000-0036c000 r-xp 00000000 00:00 0          [vdso]
00454000-00470000 r-xp 00000000 08:01 1573818    /lib/i386-linux-gnu/libgcc_s.so.1
00470000-00471000 r--p 0001b000 08:01 1573818    /lib/i386-linux-gnu/libgcc_s.so.1
00471000-00472000 rw-p 0001c000 08:01 1573818    /lib/i386-linux-gnu/libgcc_s.so.1
00e7e000-00e9c000 r-xp 00000000 08:01 1573924    /lib/i386-linux-gnu/ld-2.13.so
00e9c000-00e9d000 r--p 0001d000 08:01 1573924    /lib/i386-linux-gnu/ld-2.13.so
00e9d000-00e9e000 rw-p 0001e000 08:01 1573924    /lib/i386-linux-gnu/ld-2.13.so
08048000-08049000 r-xp 00000000 00:14 3801591    /home/sean/programming/a.out
08049000-0804a000 r--p 00000000 00:14 3801591    /home/sean/programming/a.out
0804a000-0804b000 rw-p 00001000 00:14 3801591    /home/sean/programming/a.out
08a9e000-08abf000 rw-p 00000000 00:00 0          [heap]
b77e8000-b77e9000 rw-p 00000000 00:00 0 
b77fc000-b7800000 rw-p 00000000 00:00 0 
bff87000-bffa8000 rw-p 00000000 00:00 0          [stack]
Aborted

Answer 1

因为"Hello, world!"超过10个字符......

Answer 2

message只能容纳10个字节.您正在复制字符串"Hello World!" 这是13个字节(如果你计算空字符),你将最终覆盖和破坏堆栈保护cookie.

cookie是编译器插入的随机字节,以确保在堆栈上修改返回地址时崩溃,从而防止潜在的缓冲区溢出漏洞.

如果您正在使用gcc进行编译,要进行实验,请尝试将-fno-stack-protectorswitch 添加到编译语句并再次尝试.该程序可能会崩溃(但不会出现类似的错误消息),并且容易受到缓冲区溢出漏洞的攻击.