Calling isalpha Causing Segmentation Fault

问题

I have the following program that causes a segmentation fault.

#include <stdio.h>
#include <string.h>
#include <ctype.h>

int main(int argc, char *argv[])
{
    printf("TEST");

    for (int k=0; k<(strlen(argv[1])); k++)
    {
        if (!isalpha(argv[1])) {
            printf("Enter only alphabets!");
            return 1;
        }
    }

    return 0;
}

I've figured out that it is this line that is causing the problem

if (!isalpha(argv[1])) {

and replacing argv[1] with argv[1][k] solves the problem.

However, I find it rather curious that the program results in a segmentation fault without even printing TEST. I also expect the isalpha function to incorrectly check if the lower byte of the char* pointer to argv[1], but this doesn't seem to be the case. I have code to check for the number of arguments but isn't shown here for brevity.

What's happening here?

回答1:

In general it is rather pointless to discuss why undefined behaviour leads to this result or the other.

But maybe it doesn't harm to try to understand why something happens even if it is outside the spec.

There are implementation of isalpha which use a simple array to lookup all possible unsigned char values. In that case the value passed as parameter is used as index into the array. While a real character is limited to 8 bits, an integer is not. The function takes an int as parameter. This is to allow entering EOF as well which does not fit into unsigned char.

If you pass an address like 0x7239482342 into your function this is far beyond the end of the said array and when the CPU tries to read the entry with that index it falls off the rim of the world. ;)

Calling isalpha with such an address is the place where the compiler should raise some warning about converting a pointer to an integer. Which you probably ignore...

The library might contain code that checks for valid parameters but it might also just rely on the user not passing things that shall not be passed.

回答2:

printf was not flushed
the implicit conversion from pointer to integer that ought to have generated at least compile-time diagnostics for constraint violation produced a number that was out of range for isalpha. isalpha being implemented as a look-up table means that your code accessed the table out of bounds, therefore undefined behaviour.
Why you didn't get diagnostics might be in one part because of how isalpha is implemented as a macro. On my computer with Glibc 2.27-3ubuntu1, isalpha is defined as
```
# define isalpha(c)     __isctype((c), _ISalpha)
# define __isctype(c, type) \
    ((*__ctype_b_loc ())[(int) (c)] & (unsigned short int) type)
```
the macro contains an unfortunate cast to int in it, which will silence your error!

One reason why I am posting this answer after so many others is that you didn't fix the code, it still suffers from undefined behaviour given extended characters and char being signed (which happens to be generally the case on x86-32 and x86-64).

The correct argument to give to isalpha is (unsigned char)argv[1][k]! C11 7.4:

In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined.

回答3:

I find it rather curious that the program results in a segmentation fault without even printing TEST

printf doesn't print instantly, but it writes to a temporal buffer. End your string with \n if you want to flush it to actual output.

and replacing argv[1] with argv[1][k] solves the problem.

isalpha is intended to work with single characters.

回答4:

First of all, a conforming compiler must give you a diagnostic message here. It is not allowed to implicitly convert from a pointer to the int parameter that isalpha expects. (It is a violation of the rules of simple assignment, 6.5.16.1.)

As for why "TEST" isn't printed, it could simply be because stdout isn't flushed. You could try adding fflush(stdout); after printf and see if this solves the issue. Alternatively add a line feed \n at the end of the string.

Otherwise, the compiler is free to re-order the execution of code as long as there are no side effects. That is, it is allowed to execute the whole loop before the printf("TEST");, as long as it prints TEST before it potentially prints "Enter only alphabets!". Such optimizations are probably not likely to happen here, but in other situations they can occur.

来源：https://stackoverflow.com/questions/50564810/calling-isalpha-causing-segmentation-fault

标签

pointers

segmentation-fault