blocks|key|1373912|text|C%2B%2B标准没有定义堆栈/堆。此外，有许多方法可以在程序中调用未定义的行为--所有这些方法都可能损坏您的堆栈(毕竟是UB+)。简短的答案是--你的问题太模糊了，没有一个有意义的答案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1373913|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

<p>The C++ standard does not define stack/heap. Further, there are a number of ways to invoke undefined behavior in a program -- all of which may corrupt your stack (it's UB, after all). The short answer is -- your question is too vague to have a meaningful answer.</p>


blocks|key|1589041|text|使用错误的调用约定调用函数。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1589042|(虽然这在技术上是特定于编译器的，而不是C%2B%2B的问题，但是每个C%2B%2B编译器都必须处理这个问题。)|1589043|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

<p>Calling a function with the wrong calling convention.</p>

<p>(though this is technically compiler-specific, not a question of C++, every C++ compiler has to deal with that.)</p>


blocks|key|1589101|text|违反One+Definition规则可能会导致堆栈损坏。下面的例子看起来很愚蠢，但我在不同的库以不同的配置编译的情况下见过几次。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1589102|header.h|1589103|struct+MyStruct
{
+++int+val;
#ifdef+LARGEMYSTRUCT
+++char+padding[16];
#endif
}|code-block|syntax|javascript|1589104|file1.cpp|1589105|#define+LARGEMYSTRUCT
#include+"header.h"

//Here+it+looks+like+MyStruct+is+20+bytes+in+size++++

void+func(MyStruct+s)
{
+++memset(s.padding,+0,+16);+//corrupts+the+stack+as+below+file2.cpp+does+not+have+LARGEMYSTRUCT+declared+and+declares+Mystruct+with+4+bytes
+++return;+//Will+probably+crash+here+as+the+return+pointer+has+been+overwritten
}|1589106|file2.cpp|1589107|#include+"header.h"
//Here+it+looks+like+MyStruct+is+only+4+bytes+in+size.
extern+void+func(MyStruct+s);

void+caller()
{
+++MyStruct+s;
+++func(s);+//push+four+bytes+on+to+the+stack
}|1589108|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|V|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|P|5|F|7|Y|8|@]|9|@]|A|$G|H]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

<p>Violations of the One Definition Rule can lead to stack corruption. The following example looks stupid, but I've seen it a couple of times with different libraries compiled in different configurations.</p>

<h2>header.h</h2>

<pre><code>struct MyStruct
{
   int val;
#ifdef LARGEMYSTRUCT
   char padding[16];
#endif
}
</code></pre>

<h2>file1.cpp</h2>

<pre><code>#define LARGEMYSTRUCT
#include "header.h"

//Here it looks like MyStruct is 20 bytes in size    

void func(MyStruct s)
{
   memset(s.padding, 0, 16); //corrupts the stack as below file2.cpp does not have LARGEMYSTRUCT declared and declares Mystruct with 4 bytes
   return; //Will probably crash here as the return pointer has been overwritten
}
</code></pre>

<h2>file2.cpp</h2>

<pre><code>#include "header.h"
//Here it looks like MyStruct is only 4 bytes in size.
extern void func(MyStruct s);

void caller()
{
   MyStruct s;
   func(s); //push four bytes on to the stack
}
</code></pre>


blocks|key|1374076|text|将指针指向堆栈变量是一种很好的方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1374077|void+foo()
{
++my_struct+s;
++bar(&s);
}|code-block|syntax|javascript|1374078|如果bar保留了指针的副本，那么将来任何事情都可能发生。|1374079|总结:当有错误的指针指向堆栈时，就会发生堆栈损坏。|1374080|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

<p>Taking pointers to stack variables is a good way:</p>

<pre><code>void foo()
{
  my_struct s;
  bar(&amp;s);
}
</code></pre>

<p>If bar keeps a copy of the pointer then anything can happen in the future.</p>

<p>Summing up: Stack corruption happens when there's stray pointers pointing to the stack.</p>


blocks|key|1374092|text|在析构函数中抛出异常是一个很好的选择。这会打乱堆栈的展开。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1374093|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

<p>Throwing an exception inside a destructor is a good candidate. It would mess up the stack unwinding.</p>


<p>In C++, in which way the stack may get corrupted. One way I guess is to overwriting the stack variables by accessing an array beyond its boundaries. Is there any other way that it can get corrupted?</p>


Stack corruption in C++

编译器

在C++中，堆栈可能会被损坏。我猜一种方法是通过访问超出其边界的数组来覆盖堆栈变量。有没有其他方式可以破坏它？

问C++中的堆栈损坏
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问C++中的堆栈损坏EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问C++中的堆栈损坏
EN