请教:这六个字符找不到了?
写了一个程序,本来想测试下缓冲区溢出的问题,结果缓冲区没报错,却发现一个更奇怪的问题
这是程序代码:
程序代码:
#include<stdio.h> int main() { char str_a[5]; char str_b[5]; strcpy(str_a,"Hello,world!");//ld!去哪里了? strcpy(str_b,"Hello,china!");//na!去哪里了? printf(str_a); printf("\n"); printf(str_b); return 0; }
运行会显示正确的结果:
Hello,world!
Hello,china!
问题是用gdb调试的时候,发现有6个字符找不到在哪里了:
我发现 Hello,china! 的起始地址是$ebp-0x28,可是按顺序找字符只能找到i,
后面的‘n’‘a’‘!’三个字符不知道哪里去了,
隔了一个'\0'字符,接着是Hello,world!的字符串,但是按顺序显示字符也只能找到‘r’,
后面的‘l’‘d’‘!’三个字符也不知道在哪里?
字符串打印不是碰到'\0'就停止打印么,怎么还会正常显示呢?
下面是我的调试过程,为什么会出现这样的效果,请大家指教~
(gdb) list
1 #include<stdio.h>
2
3 int main()
4 {
5 char str_a[5];
6 char str_b[5];
7 strcpy(str_a,"Hello,world!");
8 strcpy(str_b,"Hello,china!");
9 printf(str_a);
10 printf("\n");
(gdb) list
11 printf(str_b);
12 return 0;
13 }
(gdb) break 9
Breakpoint 1 at 0x401320: file str_ab.c, line 9.
(gdb) run
Starting program: E:\bccn\hacking\test/str_ab.exe
Breakpoint 1, main () at str_ab.c:9
9 printf(str_a);
(gdb) set dis intel
(gdb) x /9i $eip
0x401320 <main+80>: lea eax,[ebp-0x18]
0x401323 <main+83>: mov DWORD PTR [esp],eax
0x401326 <main+86>: call 0x401b50 <printf>
0x40132b <main+91>: mov DWORD PTR [esp],0x40301a
0x401332 <main+98>: call 0x401b50 <printf>
0x401337 <main+103>: lea eax,[ebp-0x28]
0x40133a <main+106>: mov DWORD PTR [esp],eax
0x40133d <main+109>: call 0x401b50 <printf>
0x401342 <main+114>: mov eax,0x0
(gdb) x /s $ebp-0x28
0x22ff30: "Hello,china!"
(gdb) x /c $ebp-0x28
0x22ff30: 72 'H'
(gdb) x /c $ebp-0x27
0x22ff31: 101 'e'
(gdb) x /c $ebp-0x26
0x22ff32: 108 'l'
(gdb) x /c $ebp-0x25
0x22ff33: 108 'l'
(gdb) x /c $ebp-0x24
0x22ff34: 111 'o'
(gdb) x /c $ebp-0x23
0x22ff35: 44 ','
(gdb) x /c $ebp-0x22
0x22ff36: 99 'c'
(gdb) x /c $ebp-0x21
0x22ff37: 104 'h'
(gdb) x /c $ebp-0x20
0x22ff38: 105 'i'
(gdb) x /c $ebp-0x19
0x22ff3f: 0 '\0'
(gdb) x /c $ebp-0x18
0x22ff40: 72 'H'
(gdb) x /c $ebp-0x17
0x22ff41: 101 'e'
(gdb) x /c $ebp-0x16
0x22ff42: 108 'l'
(gdb) x /c $ebp-0x15
0x22ff43: 108 'l'
(gdb) x /c $ebp-0x14
0x22ff44: 111 'o'
(gdb) x /c $ebp-0x13
0x22ff45: 44 ','
(gdb) x /c $ebp-0x12
0x22ff46: 119 'w'
(gdb) x /c $ebp-0x11
0x22ff47: 111 'o'
(gdb) x /c $ebp-0x10
0x22ff48: 114 'r'
(gdb) x /c $ebp-0x9
0x22ff4f: 127 '\177'
(gdb) x /c $ebp-0x8
0x22ff50: 0 '\0'
(gdb) x /c $ebp-0x7
0x22ff51: -16 '?