使用C语言getline()函数时出现段错误的原因排查

核心原因：无符号类型的隐式转换 #

linelen的类型是size_t，这是一个无符号整数类型，而getline的返回值是ssize_t（有符号整数类型）。当getline读取到文件末尾返回-1时，这个有符号的-1会被隐式转换为无符号的size_t类型，结果就是无符号整数的最大值18446744073709551615（也就是你看到的极大值）。

对于无符号整数来说，所有的值都是非负的，所以判断条件linelen >= 0永远为真，循环不会终止。此时用这个极大的长度调用fwrite，会超出buf的实际分配范围，读取/写入不属于程序的内存区域，最终触发段错误。

而用!= -1判断时，-1同样会被转换为无符号的最大值，此时判断linelen != 这个最大值，当getline返回EOF时，条件不成立，循环正常终止。

代码对比验证 #

正常运行的代码 #

#include<stdlib.h>
int main(int argc , char *argv[])
{
    FILE *fp = fopen(argv[argc-1],"r");
    if(fp == NULL)
    {
        printf("error : can't open file");
        exit(1);
    }
    char *buf = NULL;
    size_t linelen  = 0;
    size_t linecapp = 0;
    while((linelen = getline(&buf,&linecapp,fp)) !=-1)
    {
        fwrite(buf,linelen,1,stdout);
    }
    fclose(fp);
    return 0;
}

触发段错误的代码 #

#include<stdio.h>
#include<stdlib.h>
int main(int argc , char *argv[])
{
    FILE *fp = fopen(argv[argc-1],"r");
    if(fp == NULL)
    {
        printf("error : can't open file");
        exit(1);
    }
    char *buf = NULL;
    size_t linelen  = 0;
    size_t linecapp = 0;
    while((linelen = getline(&buf,&linecapp,fp)) >= 0)
    {
        fwrite(buf,linelen,1,stdout);
    }
    fclose(fp);
    return 0;
}

测试输出佐证 #

当程序运行到文件末尾时，linelen被赋值为转换后的无符号最大值，后续fwrite尝试写入这个长度的内容，导致输出乱码并最终崩溃：

116
hello world this is a test file to bes used for the purpose of learning basics of unix sys calls and c programming 
77
this is just an extra line to elongate the file followed by more extra lines
55
for example this is a line used in elongating the file
22
this is another line 
141
this line contain special characters like œ∑´®†¥¨ˆøπåß∂ƒ©˙∆˚¬¬¬…≈ç√∫˜µ≤≥÷¡™£¢∞§¶•ªº–
52
this line contain some numbers 1 2 3 5 7 4 6 8 9 10
18446744073709551615
his line contain some numbers 1 2 3 5 7 4 6 8 9 10
?¥¨ˆøπåß∂ƒ©˙∆˚¬¬¬…≈ç√∫˜µ≤≥÷¡™£¢∞§¶•ªº–
Xjm??ͫ?????@|m? ?5?r?@?@:?#??Zm@?` `@?`?`?Zm???#? ??#????#?????#?@?`X???\/var/folders/l5/h45_tftn3w18ws8vshrpxlsr0000gn/T//private/tmp/com.apple.launchd.pIOsn5DWl2/Listeners0?``SSH_AUTH_SOCK??`??????????????????`??`P ?b??,?,?8Zm@??Xm? ??`(?`?`HOME?Xm?D<?B`38?`P`PATH?Xm?81??` ?`?`TMPDIR?Xm?83?`??!???c?8???W&???ǀ?G???w+???C???????`??`@``?```?Z??`ԥ`???`???`???`?@`?a??\_?x?`?`?`?Z????^??\_?x?`????`?pm??   ??
m ??um??     ?x ?h
m?
 ?@
m?? ??
m?`
 ??
zsh: segmentation fault  ./getlinefunc ../../sampletextfile.txt

解决方案 #

1. 保持原判断条件!= -1：这是符合getline文档规范的写法，利用无符号转换后的最大值来判断EOF。
2. 使用ssize_t存储返回值：将linelen的类型改为ssize_t，这样可以正确处理有符号的返回值，此时用>=0判断也能正常终止循环：

ssize_t linelen = 0;
while((linelen = getline(&buf,&linecapp,fp)) >= 0)
{
    fwrite(buf, (size_t)linelen, 1, stdout);
}

注意此时fwrite的第二个参数需要强制转换为size_t，因为fwrite要求该参数是无符号类型。

内容的提问来源于stack exchange，提问作者gunslinger