How did this memory corruption occur in c++? - c++

Question

I'm not sure I understand what the bug below is
const char* packs[] = {"zero","one","two","three","four",..."twelve"} //abbreviated for post
struct packinfo {
char* data;
int len;
};
std::vector<packinfo> k;
k.reserve(10000);
for (int i = 0; i < 10; ++i) {
const char* data = packs[i];
packinfo tobuf;
tobuf.data = new char[strlen(data)];
tobuf.len = strlen(data);
memcpy(tobuf.data, data, strlen(data));
k.push_back(tobuf);
}
for (int i = 0; i < k.size(); ++i)
std::cout << "k[" << i << "]: " << k[i].data << ", ";
std::cout << std::endl;
for (int i = 0; i < k.size(); ++i) {
packinfo& pack = k[i];
bool foo = (i < 5);
if (foo) std::cout << "inspecting k[" << i << "]: " << k[i].data << std::endl;
delete pack.data;
if (!foo) {
k.erase(k.begin(), k.begin() + i);
packinfo tobuf;
const char* data = packs[10];
tobuf.data = new char[strlen(data)];
tobuf.len = strlen(data);
memcpy(tobuf.data, data, strlen(data));
break; //intentionally forgot to push_back
}
}
for (int i = 0; i < k.size(); ++i)
std::cout << "k[" << i << "]: " << k[i].data << ", ";
std::cout << std::endl
;
The output of running the above is the following:
k[0]: zero, k[1]: one, ... , k[9]: nine, //all as expected
inspecting k[0]: zero
inspecting k[1]: one
...
inspecting k[4]: four
k[0]: ten^], k[1]: six, k[2] seven, k[3]: eight, k[4]L nine, //gargabe crept in
How did garbage creep into the beginning of the vector?

Answer 1

strlen gives you the length of characters in a nul-terminated string wihtout counting the nul-termination character. So you are dynamically allocating a data buffer that is too short to hold the target string:
tobuf.data = new char[strlen(data)]; // too short by 1
When you fill it using memcpy, there is no space for a null-termination for the string, and you wouldn't copy it if there was anyway, because the array is too short:
memcpy(tobuf.data, data, strlen(data)); // tobuf.data is not nul-terminated
When you attempt to read it as if it were a nul terminated string, you go out of bounds.
The immediate fix would be to use strlen(data) +1, but what you really should do is avoid the whole problem by replacing packinfo by std::string.
std::vector<std::string> k;
k.reserve(10000);

Answer 2

The problem is these lines:
tobuf.data = new char[strlen(data)];
tobuf.len = strlen(data);
memcpy(tobuf.data, data, strlen(data));
Where do you add space for the string terminator?
C++ have the std::string class, you should really use it as it will help you with these kind of problems.