Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > C Programming > alleged mis-form with strcat

Reply
Thread Tools

alleged mis-form with strcat

 
 
Pieter Droogendijk
Guest
Posts: n/a
 
      09-12-2003
On 12 Sep 2003 06:44:30 -0700
(Jon) wrote:
> using Borland Compiler.


Doesn't matter, I hope, or this post is off-topic.

> x[32] = "this is a string"
>
> strcat(x,x)
> strcat(x,x)
>
> will produce "this is a stringthis is a stringthis is a stringthis is
> a stringt"
>
> but should produce "this is a stringthis is a stringthis is a
> stringthis is a string"
>
> does anyone know why the additional character from the beginning of
> the string is being appended at the end?


The arguments to strcat may not overlap. The way you call it leads to undefined
behaviour. Anything could happen.

> in addition does anyone know the source for the strcat function? I am
> curious as to how they did it.


www.gnu.org. Download the glibc source package. You'll see why the strings may
not overlap.

--
char*x(c,k,s)char*k,*s;{if(!k)return*s-36?x(0,0,s+1):s;if(s)if(*s)c=10+(c?(x(
c,k,0),x(c,k+=*s-c,s+1),*k)x(*s,k,s+1),0));else c=10;printf(&x(~0,0,k)[c-~-
c+"1"[~c<-c]],c);}main(){x(0,"^[kXc6]dn_eaoh$%c","-34*1'.+(,03#;+,)/'///*");}
 
Reply With Quote
 
 
 
 
Jon
Guest
Posts: n/a
 
      09-12-2003
using Borland Compiler.

x[32] = "this is a string"

strcat(x,x)
strcat(x,x)

will produce "this is a stringthis is a stringthis is a stringthis is
a stringt"

but should produce "this is a stringthis is a stringthis is a
stringthis is a string"

does anyone know why the additional character from the beginning of
the string is being appended at the end?


in addition does anyone know the source for the strcat function? I am
curious as to how they did it.
 
Reply With Quote
 
 
 
 
Jirka Klaue
Guest
Posts: n/a
 
      09-12-2003
Pieter Droogendijk wrote:
> (Jon) wrote:
>>x[32] = "this is a string"
>>
>>strcat(x,x)
>>strcat(x,x)
>>
>>will produce "this is a stringthis is a stringthis is a stringthis is
>>a stringt"
>>
>>but should produce "this is a stringthis is a stringthis is a
>>stringthis is a string"

....
> The arguments to strcat may not overlap. The way you call it leads to undefined
> behaviour. Anything could happen.


Furthermore 32 wouldn't be enough, even for *two* copies of "this is a string".

Jirka

 
Reply With Quote
 
Trevor Walker
Guest
Posts: n/a
 
      09-12-2003
In article < >,
says...
> using Borland Compiler.
>
> x[32] = "this is a string"
>
> strcat(x,x)


"this is a string" requires 17 bytes of storage. Making two copies of
it requires 33 bytes of storage, so you have not enough space allocated
even for this first strcat. But worse than that is that the arguments
to strcat may not overlap. On many machines, I would expect this to
continue writing to memory until it crashed.

> strcat(x,x)


Now we are trying to fit 65 bytes into 32. But anyway, the overlap
problem still applies.

>
> will produce "this is a stringthis is a stringthis is a stringthis is
> a stringt"
>
> but should produce "this is a stringthis is a stringthis is a
> stringthis is a string"


No, it should not. See above. You are lucky (some would say unlucky)
that this did not crash your program.

Trevor

>
> does anyone know why the additional character from the beginning of
> the string is being appended at the end?
>
>
> in addition does anyone know the source for the strcat function? I am
> curious as to how they did it.
>

 
Reply With Quote
 
Lew Pitcher
Guest
Posts: n/a
 
      09-12-2003
Jon wrote:

> using Borland Compiler.
>
> x[32] = "this is a string"
>
> strcat(x,x)
> strcat(x,x)
>
> will produce "this is a stringthis is a stringthis is a stringthis is
> a stringt"
>
> but should produce "this is a stringthis is a stringthis is a
> stringthis is a string"


Wrong. Such an action isn't guaranteed to produce anything. The source and
target strings overlap, and because of this, the results are undefined by
the standard.

From the C standard:

"The strcat function appends a copy of the string pointed to by s2
(including the terminating null character) to the end of the string
pointed to by s1. The initial character of s2 overwrites the null
character at the end of s1.
=> If copying takes place between objects that overlap, the behavior is
=> undefined."

> does anyone know why the additional character from the beginning of
> the string is being appended at the end?


See above

> in addition does anyone know the source for the strcat function? I am
> curious as to how they did it.


There's no one source for strcat. In your case, you should ask Borland for a
copy of the source code of their standard C library.

--

Lew Pitcher, IT Consultant, Application Architecture
Enterprise Technology Solutions, TD Bank Financial Group

(Opinions expressed here are my own, not my employer's)

 
Reply With Quote
 
Tom Zych
Guest
Posts: n/a
 
      09-12-2003
Jon wrote:

> using Borland Compiler.


> x[32] = "this is a string"


> strcat(x,x)
> strcat(x,x)


> will produce "this is a stringthis is a stringthis is a stringthis is
> a stringt"


Using Linux. man 3 strcat says "The strings may not overlap". Your
code has just entered a dimension of incorrectness, a dimension of
undefined behavior. Welcome to the twilight zone

--
Tom Zych
This email address will expire at some point to thwart spammers.
Permanent address: echo '' | rot13
 
Reply With Quote
 
LibraryUser
Guest
Posts: n/a
 
      09-13-2003
Trevor Walker wrote:
> says...
>
> > using Borland Compiler.
> >
> > x[32] = "this is a string"
> >
> > strcat(x,x)

>
> "this is a string" requires 17 bytes of storage. Making two
> copies of it requires 33 bytes of storage, so you have not
> enough space allocated even for this first strcat. But worse
> than that is that the arguments to strcat may not overlap. On
> many machines, I would expect this to continue writing to
> memory until it crashed.
>
> > strcat(x,x)

>
> Now we are trying to fit 65 bytes into 32. But anyway, the
> overlap problem still applies.
>

.... snip ...
> >
> > but should produce "this is a stringthis is a stringthis is a
> > stringthis is a string"

>
> No, it should not. See above. You are lucky (some would say
> unlucky) that this did not crash your program.
> >

.... snip ...
> >
> > in addition does anyone know the source for the strcat
> > function? I am curious as to how they did it.


It is very simple, and you should be able to generate such with
no problem. First you find where to start copying to, and then
you copy.

A safer function to use is strlcpy and strlcat, which is
available in the BSD distribution and other places. They specify
the size of the destination in the calls, which avoids the silly
overflows you have perpetrated above. You can find one
implementation of them at:

<http://cbfalconer.home.att.net/download/>

--
Replies should be to the newsgroup
Chuck Falconer, on vacation.
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
New Fraudulent Email Data-Mining Trick Alleged George Washington Admirer Computer Security 0 06-28-2006 05:41 AM
Alleged MPAA hacker named in court filing imhotep Computer Security 0 06-28-2006 01:45 AM
Texas D.A. Won't Prosecute Alleged Braindumper Rick MCSE 0 06-08-2004 05:51 PM
article: Alleged Trojan horse in Israeli Anti-Ballistic Missile System Gadi Evron Computer Security 0 02-19-2004 01:15 PM
Two alleged coding best-practices Ben_ Java 16 08-05-2003 01:40 PM



Advertisments