Segfault using char pointer array

Question

Hi,
My project was just migrated to a SUN M9000 server running Solaris 10 with Sun Studio 12.1. Here is the cc -V output:
Sun C 5.10 SunOS_sparc 2009/06/03
Here is a simple example of code to demonstrate the problem. The compile command used is:
cc -g -m64 filename.c -o filename
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
char *statusMsg[5] = {
"0 ",
"1 ",
"2 ",
"3 ",
"4 " };
printf("Hello %s\n",statusMsg[3]);
sprintf(statusMsg[3],"%s","new3");
printf("Hello %s\n",statusMsg[3]);
return(0);
Output is:
Hello 3
Segmentation Fault
I know it crashes on the sprintf.
dbx output:
dbx crash_dummy
Reading crash_dummy
Reading ld.so.1
Reading libc.so.1
(dbx) run
Running: crash_dummy
(process id 9169)
Reading libc_psr.so.1
Hello 3
signal SEGV (access to address exceeded protections) in _ndoprnt at 0xffffffff7f3ac948
0xffffffff7f3ac948: _ndoprnt+0x295c:    stb      %o4, [%o2]
Current function is main
17 sprintf(statusMsg[3],"%s","new3");
(dbx) where
[1] _ndoprnt(0x1000009aa, 0xffffffff7ffff658, 0x7ffffffefffff62f, 0x1000009b4, 0x1000009b0, 0xffffffff7ffff460), at 0xffffffff7f3ac948
[2] sprintf(0x1000009d0, 0x7fffffff, 0x7ffffc00, 0xffffffff7f54962c, 0xffffffff7f53e000, 0xa), at 0xffffffff7f3ae024
=>[3] main(argc = 1, argv = 0xffffffff7ffff768), line 17 in "crash_dummy.c"
I think it's a bug in libc but I could be wrong. Any help will be appreciated.

Answer 1

I had forgotten about the problem of literal strings being const. Your code has two bugs, and if it ever worked, it worked only by accident.
1. Attempting to overwrite a literal string.
2. Writing beyond the end of an array.
As poster rajp pointed out, you can fix the first problem by compiling with the option -features=no%conststrings. This is not a general solution, but will work with Studio compilers.
The second problem still needs to be addressed. As an implementation detail, Studio compilers in 64-bit mode allocate a literal string on an 8-byte boundary, and allocate the literal strings that initialize the array consecutively. By accident, there are a few padding bytes between the literal strings, allowing you to write extra characters to all but the last of the literal strings. (By another accident, there might be padding after the last literal string.)
To see the bug in action, try writing beyond the accidental padding by writing "new4567890" instead of "new3":
% cat z.c
#include <stdio.h>
#include <string.h>
#define SIZE 5
int main(int argc, char **argv)
    char *statusMsg[SIZE] = {
        "0 ",
        "1 ",
        "2 ",
        "3 ",
        "4 " };
    printf("Hello %s\n",statusMsg[3]);
    printf("Hello %s\n",statusMsg[4]);
    sprintf(statusMsg[3],"%s","new4567890");
    int i;
    for( i=0; i < SIZE; ++i )
        printf("Hello %s\n",statusMsg);
return(0);
% cc -m64 -features=no%conststrings z.c
% ./a.out
Hello 3
Hello 4
Hello 0
Hello 1
Hello 2
Hello new4567890
Hello 90
Notice how the last string was clobbered.
In 32-bit mode, literal strings are allocated on 4-byte boundaries, allowing for even more interesting results. I added an unrelated array of one string, "test", then overwrote statusMsg[3] as before. This time, it clobbers not only statusMsg[4], but "test" as well:#include <stdio.h>
#include <string.h>
#define SIZE 5
int main(int argc, char **argv)
char *statusMsg[SIZE] = {
"0 ",
"1 ",
"2 ",
"3 ",
"4 " };
char *test[1] = { "test" };
printf("Hello %s\n",statusMsg[3]);
printf("Hello %s\n",statusMsg[4]);
printf("Hello %s\n",test[0]);
sprintf(statusMsg[3],"%s","new4567890");
int i;
for( i=0; i < SIZE; ++i )
printf("Hello %s\n",statusMsg[i]);
printf("Hello %s\n",test[0]);
return(0);
213% cc -m32 -features=no%conststrings z.c
214% a.out
Hello 3
Hello 4
Hello test
Hello 0
Hello 1
Hello 2
Hello new4567890
Hello 567890
Hello 90