(char*)malloc(sizeof(char)) allocating more then one char?

Question

I am having some trouble understanding how memory is allocated to sir[i]. From what I understand (char*)malloc(sizeof(char)) should only allocate space for one character, but when I run the code it can read any word, regardless of length. Can someone plese explain how/why does this happen?

void read(char **sir,int **ln,int n)
{
    int i;
    for(i=0;i<n;i++)
    {
        printf("Read word %d: ",i+1);
        sir[i]=(char*)malloc(sizeof(char));
        fflush(stdin);
        scanf("%s",sir[i]);
        ln[i]=(int*)malloc(sizeof(int));
        *(ln[i])=strlen(sir[i]);
    }
}

Welcome to Stack Overflow! [Please see this discussion on why not to cast the return value of `malloc()` and family in `C`.](http://stackoverflow.com/q/605845/2173917). — Sourav Ghosh, Jan 20 '16 at 09:40

score 3 · Answer 1 · answered Jan 20 '16 at 09:17

3

You write beyond the boundary of the memory you allocated. This is undefined behavior, and you are unlucky enough that it seemed to "work".

answered Jan 20 '16 at 09:17

StoryTeller - Unslander Monica

159,632
21
358
434

score 1 · Answer 2 · answered Jan 20 '16 at 09:17

1

It's called a buffer overflow resulting in undefined behavior. It may or may not crash your problem, but it is a security hole nonetheless.

scanf with %s without a maximum length specified is always a security hole just like gets() and should not be used!

BTW: sizeof char is guaranteed to be 1 so you don't need to specify it - just use the number of chars you need; multiplying by sizeof char is likely to be optimized away by your compiler.

answered Jan 20 '16 at 09:17

ThiefMaster

298,938
77
579
623

Isn't the security risk is when the buffer is on the current stack frame? – StoryTeller - Unslander Monica Jan 20 '16 at 09:19
@StoryTeller Nope. It also a security risk per-se. – fuz Jan 20 '16 at 09:20
@FUZxxl, I'm not familiar with any attacks that work with memory allocated on the heap. But if you have a reference I'd be happy to learn something new. – StoryTeller - Unslander Monica Jan 20 '16 at 09:22
@StoryTeller *I'm not familiar with any attacks that work with memory allocated on the heap.* Corrupting the heap is a DOS attack at least. And given knowledge of what's in the heap and where, arbitrary data could be used to overwrite something important. – Andrew Henle Jan 20 '16 at 10:11
1

https://en.wikipedia.org/wiki/Heap_overflow mentions one – ThiefMaster Jan 20 '16 at 10:14
@AndrewHenle Lookup Heart Bleed for a fatal heap overflow attack. – fuz Jan 20 '16 at 10:18
@FUZxxl Thanks. I knew there were examples, but it's too early in the morning so I was just pointing out in general terms how overflowing a heap buffer could be an attack vector. – Andrew Henle Jan 20 '16 at 10:27

score 0 · Answer 3 · answered Jan 20 '16 at 09:33

From what I understand (char*)malloc(sizeof(char)) should only allocate space for one character

Thats correct. malloc in this case returns a pointer to 1 byte of allocated memory.

fflush(stdin);

Is undefined. At this point, anything may happen.

scanf("%s",sir[i]);

Is also undefined. Again, at this point anything may happen, from crashing your program with a segfault to it seemingly working.

(char*)malloc(sizeof(char)) allocating more then one char?

3 Answers3