我在一个c++程序中分配值,就像这样:

#include <iostream>
using namespace std;
int main()
{
    int array[2];
    array[0] = 1;
    array[1] = 2;
    array[3] = 3;
    array[4] = 4;
    cout << array[3] << endl;
    cout << array[4] << endl;
    return 0;
}

程序输出3和4。这应该是不可能的。我使用g++ 4.3.3

下面是编译和运行命令

$ g++ -W -Wall errorRange.cpp -o errorRange
$ ./errorRange
3
4

只有当分配数组[3000]=3000时,它才会给我一个分割错误。

如果gcc不检查数组边界,我怎么能确定我的程序是正确的,因为它可能导致一些严重的问题以后?

我将上面的代码替换为

vector<int> vint(2);
vint[0] = 0;
vint[1] = 1;
vint[2] = 2;
vint[5] = 5;
cout << vint[2] << endl;
cout << vint[5] << endl;

这个也不会产生误差。


当前回答

C或c++不会检查数组访问的边界。

您正在堆栈上分配数组。通过数组[3]索引数组等价于*(array + 3),其中array是指向&array[0]的指针。这将导致未定义的行为。

在C语言中捕捉这种情况的一种方法是使用静态检查器,例如splint。如果你运行:

splint +bounds array.c

on,

int main(void)
{
    int array[1];

    array[1] = 1;

    return 0;
}

然后你会得到警告:

数组.c:(在函数main中) array.c:5:9:可能超出范围 存储: 数组[1] 无法解决约束的: 要求0 >= 1 需要满足的先决条件: require maxSet(array @ array.c:5:9) >= 1 地址以外的地址 分配的缓冲区。

其他回答

The behavior can depend on your system. Typically, you will have a margin for out of bounds, sometimes with value of 0 or garbage values. For the details you can check with memory allocation mechanism used in your OS. On top of that, if you use the programming language like c/c++, it will not check the bounds when you using some containers, like array. So, you will meet "undefined event" because you do not know what the OS did below the surface. But like the programming language Java, it will check the bound. If you step outside of the bound, you will get an exception.

欢迎来到每一个C/ c++程序员最好的朋友:未定义行为。

由于各种原因,语言标准中没有指定很多内容。这是其中之一。

一般来说,无论何时遇到未定义的行为,都可能发生任何事情。应用程序可能会崩溃,可能会冻结,可能会弹出您的CD-ROM驱动器,或者让恶魔从您的鼻子里出来。它可能会格式化你的硬盘,或者把你所有的色情片都发给你的祖母。

如果你真的很不幸,它甚至可能看起来工作正常。

该语言只是说明如果访问数组范围内的元素应该发生什么。它没有定义如果你出界会发生什么。它今天在编译器上似乎可以工作,但它不是合法的C或c++,并且不能保证它在下次运行程序时仍然可以工作。或者它现在还没有覆盖基本数据,您还没有遇到它将导致的问题。

至于为什么没有边界检查,有几个方面的答案:

An array is a leftover from C. C arrays are about as primitive as you can get. Just a sequence of elements with contiguous addresses. There is no bounds checking because it is simply exposing raw memory. Implementing a robust bounds-checking mechanism would have been almost impossible in C. In C++, bounds-checking is possible on class types. But an array is still the plain old C-compatible one. It is not a class. Further, C++ is also built on another rule which makes bounds-checking non-ideal. The C++ guiding principle is "you don't pay for what you don't use". If your code is correct, you don't need bounds-checking, and you shouldn't be forced to pay for the overhead of runtime bounds-checking. So C++ offers the std::vector class template, which allows both. operator[] is designed to be efficient. The language standard does not require that it performs bounds checking (although it does not forbid it either). A vector also has the at() member function which is guaranteed to perform bounds-checking. So in C++, you get the best of both worlds if you use a vector. You get array-like performance without bounds-checking, and you get the ability to use bounds-checked access when you want it.

据我所知,局部变量是在堆栈上分配的,所以在你自己的堆栈上越界只能覆盖一些其他的局部变量,除非你oob太多,超过了你的堆栈大小。 由于在函数中没有声明其他变量,因此不会产生任何副作用。尝试在第一个变量/数组之后声明另一个变量/数组,看看会发生什么。

当然,您正在重写堆栈,但是程序非常简单,因此不会注意到这种影响。

当你声明int数组[2];您保留了2个内存空间,每个空间4个字节(32位程序)。 如果你在代码中输入数组[4],它仍然对应一个有效的调用,但只有在运行时它才会抛出一个未处理的异常。c++使用手动内存管理。这实际上是一个用于黑客程序的安全漏洞

这有助于理解:

某个指针;

somepointer [0] = somepointer [5];