pset6 server.c extract query from request-target

Question

Good afternoon everyone who is reached pset 6 :-)

I got error which I could not understand. I'm splitting request target to several sub-strings.

During my last operation when I'm validating query in the end of sub-string happening re-writing of last two characters and the reason of it is not clear for me.

Could someone please clarify what is happening with memory during execution of problem

Some part from program:

char* new_line = line;   //copying request-line to the new pointer

....................................
// allocating memory for the whole request argument 

        char* request_arg_1  = calloc(1,sizeof(char));
        int len_request_arg =  strlen(request_line) - strlen(http_ver); 
        for (int i = 1; i < len_request_arg; i++)
         {
          request_arg_1[i-1] = request_line [i];
         }
        request_arg_1[len_request_arg - 1] = '\0';

.........................................................

       // first im checking that I have question sign 

        char* query_full = strstr(request_arg_1,"?");
        int len_query = strlen(query_full);
        query_full[len_query +1] = '\0';
      /*
         after creating new variable and copying 
         into it query if something presence after "?" 
         all occasion happening on this step
      */
        char* query = calloc(1,sizeof(char));  // <- at this step 
//all variables which are connected to request arguments
// are re-written, log form gdb it shows

        if (query_full != NULL)
         {
            query = strstr(request_arg_1,"q");
         }

log from gdb, as you see absolutely all pointers were re-written in last two postions

   GET /hh.kk?q=Alice HTTP/1.1

 Breakpoint 1, main (argc=5, argv=0xbffff164) at server.c:261
 261                char* query_full = strstr(request_arg_1,"?");
 (gdb) p request_arg_1 
 $1 = 0x804e048 "/hh.kk?q=Alice"
 (gdb) n
 262                int len_query = strlen(query_full);
 (gdb) p request_arg_1
 $2 = 0x804e048 "/hh.kk?q=Alice"
 (gdb) p query_full
 $3 = 0x804e04e "?q=Alice"
 (gdb) n
 263                query_full[len_query] = '\0';
 (gdb) p query_full
 $4 = 0x804e04e "?q=Alice"
 (gdb) n
 265                char* query = calloc(1,sizeof(char));
 (gdb) p query_full
 $5 = 0x804e04e "?q=Alice"
 (gdb) p request_arg_1
 $6 = 0x804e048 "/hh.kk?q=Alice"
 (gdb) n
 267                if (len_query > 2)
 (gdb) p request_arg_1
 $7 = 0x804e048 "/hh.kk?q=Ali\021"
 (gdb) p request_arg_1
 $8 = 0x804e048 "/hh.kk?q=Ali\021"
 (gdb) p query
 $9 = 0x804e058 ""

thanks for help in advance!

Answer 1

I'd guess its because you're doing calloc(1,sizeof(char)) for request_arg_1. This happens again for query & will likely cause similar problems later.

By calling calloc(1,sizeof(char)), you're calling protection for only 1 char in the heap. However, you continue to copy the entire request string into request_arg_1. It doesn't throw an error because C doesn't check for such overflow or invalid memory access. Instead, it lets you write to these memory blocks but just doesn't protect it.

When you call calloc again for query, it doesn't know you're using the memory (wrongly) for request_arg_1 as you didn't calloc it properly. As such it overwrites it, altering the value of request_arg_1.