以下代碼顯示分段錯誤

-1

爲什麼下面的代碼顯示分段錯誤？以下代碼顯示分段錯誤

int CreateRawSocket(int protocol_to_sniff) 
{ 
    int rawsock; 

    if((rawsock = socket(PF_PACKET, SOCK_RAW, htons(protocol_to_sniff)))== -1) 
    { 
     perror("Error creating raw socket: "); 
     exit(-1); 
    } 

    return rawsock; 
} 

int BindRawSocketToInterface(char *device, int rawsock, int protocol) 
{ 

    struct sockaddr_ll sll; 
    struct ifreq ifr; 

    bzero(&sll, sizeof(sll)); 
    bzero(&ifr,sizeof(ifr)); 

    /* First Get the Interface Index */ 

     char *t=(char*)ifr.ifr_name; 
    strncpy(t, device, 1024); 
    if((ioctl(rawsock, SIOCGIFINDEX, &ifr)) == -1) 
    { 
     printf("Error getting Interface index !\n"); 
     exit(-1); 
    } 

    /* Bind our raw socket to this interface */ 

    sll.sll_family = AF_PACKET; 
    sll.sll_ifindex = ifr.ifr_ifindex; 
    sll.sll_protocol = htons(protocol); 


    if((bind(rawsock, (struct sockaddr *)&sll, sizeof(sll)))== -1) 
    { 
     perror("Error binding raw socket to interface\n"); 
     exit(-1); 
    } 

    return 1; 

} 

void PrintPacketInHex(unsigned char *packet, int len) 
{ 
    unsigned char *p = packet; 

    printf("\n\n---------Packet---Starts----\n\n"); 

    while(len--) 
    { 
     printf("%.2x ", *p); 
     p++; 
    } 

    printf("\n\n--------Packet---Ends-----\n\n"); 

} 


main(int argc, char **argv) 
{ 
    int raw; 
    unsigned char packet_buffer[2048]; 
    int len; 
    int packets_to_sniff; 
    struct sockaddr_ll packet_info; 
    int packet_info_size = sizeof(packet_info); 

    /* create the raw socket */ 

    raw = CreateRawSocket(ETH_P_IP); 

    /* Bind socket to interface */ 

    BindRawSocketToInterface(argv[1], raw, ETH_P_IP); 

    /* Get number of packets to sniff from user */ 

    packets_to_sniff = atoi(argv[2]); 

    /* Start Sniffing and print Hex of every packet */ 

    while(packets_to_sniff--) 
    { 
     if((len = recvfrom(raw, packet_buffer, 2048, 0, (struct sockaddr*)&packet_info, &packet_info_size)) == -1) 
     { 
      perror("Recv from returned -1: "); 
      exit(-1); 
     } 
     else 
     { 
      /* Packet has been received successfully !! */ 

      PrintPacketInHex(packet_buffer, len); 
     } 
    } 


    return 0; 
}

來源

2010-11-11 user484457

它在哪裏崩潰？它在什麼地址崩潰？什麼是緩衝區的大小？ – Patrick 2010-11-11 13:52:53

我甚至拒絕看這個。做一些調試並縮小範圍。你顯然對編程並不陌生，或者你不會編寫這種複雜的程序。一旦你縮小到特定的模塊和線路崩潰，發回。 – 2010-11-11 13:53:29

唉，我的眼睛。太多的空白！ – 2010-11-11 13:55:44

崩潰是由這條線在你的日常BindRawSocketToInterface造成的：

strncpy(t, device, 1024);

在這裏，你問過strncpy寫1024個字節到char *t。 請注意，strncpy用指定數量的空字節填充目標字符串，請參閱man strncpy）。

但是t指向一個不夠大的數組，即ifr.ifr_name[IFNAMSIZ]。在我的linux系統上，IFNAMSIZ只有16個。所以strncpy溢出並且會造成內存不應該被觸及。

改變strncpy參數如下修復崩潰匹配數組的正確尺寸：

strncpy(t, device, IFNAMSIZ);

來源

2010-11-11 19:03:43 Kamal

當您沒有提供足夠的命令行參數，因爲您沒有檢查argc，所以存在內存違規。

來源

2010-11-11 14:04:20

以下代碼顯示分段錯誤

回答

相關問題