切勿使用：指向局部变量的指针作为函数的返回指针！
今天码代码的时候，出现了一个诡异的问题：
首先：函数 pkt_analyzer 返回了一个 PktUnit类型的指针。我先把端点跑到puu赋值后的下一句，查看puu里面的内容，发现是正确的： payload_len = 7，pkt_len = 35
接着我再向下跑一步，发现puu内容就不对了： payload_len = 1514280713 ;pkt_len = 17 整个就不对了……
找了一个多小时，没发现问题出在哪儿！后来突然想到，可能是函数返回的时候出的问题，不能光看函数的立即返回结果！
果然，这是一个属于：使用指向局部变量的指针作为函数返回值的例子！
pointer * Func{
return pointer = & iTemp;
}
这样做会造成非常严重的后果！！！！
千万不要企图返回局变量堆栈上的指针，返回局部栈上的指针，你的指针就指向了该局部变量iTemp的地址，由于局部栈会在函数返回的时刻清栈，然而你的指针所指向的地址还是不变的。也就是说 pointer还是指向iTemp原来的那块内存，但是接着执行下来，那块内存的内容完全是不确定的！所以，导致你下次使用 函数返回指针 ret_pointer = Func(); ret_pointer的内容完全不确定，会产生灾难性后果！！
先给出问题代码：
#include "pkt_analyzer.h" #include "stdio.h" #include "string.h" #include "malloc.h" extern PktUnit *pkt_analyzer(char *rx_buffer, int rx_len); int main() { int i = 0; int payload_len = 0; u_int8 *my_payload = (u_int8 *)malloc(sizeof(u_int8)); PktUnit *ppu = 0; char in_buffer[PKT_HDEADER_LEN + 7] = {0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0e,0x05,0x0d,0x2e,0x23,0x01,0xc2,0x0e,0x0be,0xff,0x03,0x04,0x05,0x06,0x07}; ppu = pkt_analyzer(in_buffer,sizeof(in_buffer)); printf("payload_len = %d\n",ppu->payload_len); printf("pkt_len = %d \n",ppu->pkt_len); printf("timestampe = %ul",ppu->pkt_hdr.timestamp); memcpy(my_payload, ppu->payload,sizeof(u_int8)*ppu->payload_len); for(i=0; i< ppu->payload_len ;i++){ printf("%x\n", *my_payload++); } free(my_payload); return 0; }
/* * recv_pkt_analyzer.c * * Created on: 2014-5-7 * Author: fang ying */ /* @Function Description: Perform packet analysis * * @param * @param * @return */ #include "pkt_analyzer.h" #include "stdlib.h" #include "string.h" #ifndef NULL #define NULL 0 #endif #define MakeDoubleWord(a,b,c,d,e,f,g,h) (((u_int64)(a & 0xff) << 56 )|((u_int64)(b & 0xff) << 48)|\ ((u_int64)(c & 0xff) << 40 )|((u_int64)(d & 0xff) << 32)|\ ((u_int64)(e & 0xff) << 24 )|((u_int64)(f & 0xff) << 16)|\ ((u_int64)(g & 0xff) << 8 )|((u_int64)(h & 0xff) << 0 )) #define MakeWord(a,b,c,d) (((u_int32)(a & 0xff) << 24 )|((u_int32)(b & 0xff) << 16)|\ ((u_int32)(c & 0xff) << 8 ) |((u_int32)(d & 0xff) << 0)) PktUnit *pkt_analyzer(char *rx_buffer, int rx_len){ u_int32 get_class_id = 0; u_int32 get_cmd_field = 0; u_int64 get_timestamp = 0; u_int32 get_parameter = 0; u_int32 get_pkt_payload = 0; PktUnit packet_rx; PktUnit *pkt_unit = NULL; /* first check the validity of rx buffer */ if(rx_buffer == NULL || rx_len <= 0){ return NULL; } get_class_id = MakeWord(rx_buffer[0],rx_buffer[1],rx_buffer[2],rx_buffer[3]); /* get the class identification of the rx packet */ switch(get_class_id){ case CMD_DATA: packet_rx.pkt_hdr.class_id = CMD_DATA; break; case SHORT_MSG: packet_rx.pkt_hdr.class_id = SHORT_MSG; break; case LONG_MSG: packet_rx.pkt_hdr.class_id = LONG_MSG; break; case EXTDATA_MSG: packet_rx.pkt_hdr.class_id = EXTDATA_MSG; break; case CMD_EXCHANGE: packet_rx.pkt_hdr.class_id = CMD_EXCHANGE; break; default: return NULL; } /* check direction */ get_cmd_field = MakeWord(rx_buffer[8],rx_buffer[9],rx_buffer[10],rx_buffer[11]); if(get_cmd_field != MASTER_2_TASK){ return NULL; }else{ // fill the cmd field packet_rx.pkt_hdr.cmd_field = get_cmd_field; } /* get parameter field */ get_parameter = MakeWord(rx_buffer[12],rx_buffer[13],rx_buffer[14],rx_buffer[15]); packet_rx.pkt_hdr.para_field = get_parameter; /* get timestamp information */ get_timestamp = MakeDoubleWord(rx_buffer[20],rx_buffer[21],rx_buffer[22],rx_buffer[23], rx_buffer[24],rx_buffer[25],rx_buffer[26],rx_buffer[27]); packet_rx.pkt_hdr.timestamp = get_timestamp; /* get packet length */ packet_rx.pkt_len = rx_len; /* analysis packet according to class id */ if(get_class_id == CMD_DATA){ packet_rx.payload_len = CMD_DATA_PAYLOAD_LEN; } if(get_class_id == SHORT_MSG){ switch(get_parameter){ case AUDIO_250MS: packet_rx.payload_len = AUDIO_250MS_PAYLOAD_LEN; break; case SHORT_MSG_250MS: packet_rx.payload_len = SHORT_MSG_250MS_PAYLOAD_LEN; break; case SHORT_MSG_500MS: packet_rx.payload_len = SHORT_MSG_500MS_PAYLOAD_LEN; break; case KEYBOARD_250MS: packet_rx.payload_len = KEYBOARD_250MS_PAYLOAD_LEN; break; case KEYBOARD_500MS: packet_rx.payload_len = KEYBOARD_500MS_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == LONG_MSG){ switch(get_parameter){ case LONG_MSG_500MS: packet_rx.payload_len = LONG_MSG_500MS_PAYLOAD_LEN; break; case LONG_MSG_750MS: packet_rx.payload_len = LONG_MSG_750MS_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == EXTDATA_MSG){ switch(get_parameter){ case EXT_DATA_1P2K: packet_rx.payload_len = EXT_DATA_1P2K_PAYLOAD_LEN; break; case EXT_DATA_2P4K: packet_rx.payload_len = EXT_DATA_2P4K_PAYLOAD_LEN; break; case EXT_DATA_4P8K: packet_rx.payload_len = EXT_DATA_4P8K_PAYLOAD_LEN; break; case EXT_DATA_9P6K: packet_rx.payload_len = EXT_DATA_9P6K_PAYLOAD_LEN; break; case EXT_DATA_19P2K: packet_rx.payload_len = EXT_DATA_19P2K_PAYLOAD_LEN; break; case EXT_DATA_25P6K: packet_rx.payload_len = EXT_DATA_25P6K_PAYLOAD_LEN; break; case EXT_DATA_38P4K: packet_rx.payload_len = EXT_DATA_38P4K_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == CMD_EXCHANGE){ switch(get_parameter){ case SIGNALING_400MS_RECV_MODE: break; case AUDIO_250MS_RECV_MODE: break; case SHORT_MSG_250MS_RECV_MODE: break; case SHORT_MSG_500MS_RECV_MODE: break; case KEYBOARD_250MS_RECV_MODE: break; case KEYBOARD_500MS_RECV_MODE: break; case LONG_MSG_500MS_RECV_MODE: break; case LONG_MSG_750MS_RECV_MODE: break; case EXT_DATA_1P2K_RECV_MODE: break; case EXT_DATA_2P4K_RECV_MODE: break; case EXT_DATA_4P8K_RECV_MODE: break; case EXT_DATA_9P6K_RECV_MODE: break; case EXT_DATA_19P2K_RECV_MODE: break; case EXT_DATA_25P6K_RECV_MODE: break; case EXT_DATA_38P4K_RECV_MODE: break; default: return NULL; } } /* get payload */ packet_rx.payload = (int_8 *)malloc(sizeof(u_int8)); //packet_rx.payload = &rx_buffer[PKT_HDEADER_LEN]; memcpy(packet_rx.payload,&rx_buffer[PKT_HDEADER_LEN],sizeof(u_int8)*packet_rx.payload_len); pkt_unit = &packet_rx; return (pkt_unit); }
/* * pkt_analyzer.h * * Created on: 2014-5-7 * Author: fang ying */ #ifndef _PKT_ANALYZER_H_ #define _PKT_ANALYZER_H_ /* type defination */ typedef char int_8; typedef unsigned char u_int8; typedef unsigned short u_int16; typedef unsigned int u_int32; typedef unsigned long long u_int64; typedef struct PktHeader_t{ u_int32 class_id; /* class identification unique number*/ u_int32 board_id; /* board identification */ u_int32 cmd_field; /* command field */ u_int32 para_field; /* parameter field */ u_int64 freq_info; /* frequency information */ u_int32 channel_SNR; /* SNR of the channel */ u_int64 timestamp; /* timestamp */ }PktHeader; typedef struct PktUnit_t{ PktHeader pkt_hdr; /* packet header */ int_8 *payload; /* data payload */ u_int32 payload_len; /* packet payload length */ u_int32 pkt_len; /* packet total length */ }PktUnit; /* constriant definations */ #define PKT_HDEADER_LEN 28 /* class identification */ #define CMD_DATA 0x1 /* command data unit */ #define SHORT_MSG 0x2 /* short message data unit */ #define LONG_MSG 0x3 /* long message data unit */ #define EXTDATA_MSG 0x4 /* extra data frame unit */ #define CMD_EXCHANGE 0x5 /* command exchange unit */ /* board identification */ #define MASTER_BOARD 0x0 #define TASK_BOARD 0x1 /* command field of command data unit */ #define MASTER_2_TASK 0x1 #define TASK_2_MASTER 0x2 /******************** command data unit header explain **********************/ /* parameter field of command data unit */ #define FREQUENCY_PAYLOAD_INFO 0x1 #define FREQUENCY_INFO_ONLY 0x2 #define PAYLOAD_INFO_ONLY 0x3 #define RESERVED 0x4 #define SYN_CHECKED 0x1 #define RECEIVE_COMPLETE 0x2 #define EARLY_TX_SUCESS 0x3 #define EARLY_TX_FAILED 0x4 /******************** short and long message data unit header explain ****************/ /* parameter field of short message interact unit */ #define AUDIO_250MS 0x1 #define SHORT_MSG_250MS 0x2 #define SHORT_MSG_500MS 0x3 #define KEYBOARD_250MS 0x4 #define KEYBOARD_500MS 0x5 #define LONG_MSG_500MS 0x6 #define LONG_MSG_750MS 0x7 #define EXT_DATA_1P2K 0x8 #define EXT_DATA_2P4K 0x9 #define EXT_DATA_4P8K 0x10 #define EXT_DATA_9P6K 0x11 #define EXT_DATA_19P2K 0x12 #define EXT_DATA_25P6K 0x13 #define EXT_DATA_38P4K 0x14 /* length constraints of message */ #define CMD_DATA_PAYLOAD_LEN 7 #define AUDIO_250MS_PAYLOAD_LEN 62 #define SHORT_MSG_250MS_PAYLOAD_LEN 94 #define SHORT_MSG_500MS_PAYLOAD_LEN 94 #define KEYBOARD_250MS_PAYLOAD_LEN 94 #define KEYBOARD_500MS_PAYLOAD_LEN 94 #define LONG_MSG_500MS_PAYLOAD_LEN 478 #define LONG_MSG_750MS_PAYLOAD_LEN 766 #define EXT_DATA_1P2K_PAYLOAD_LEN 574 #define EXT_DATA_2P4K_PAYLOAD_LEN 574 #define EXT_DATA_4P8K_PAYLOAD_LEN 574 #define EXT_DATA_9P6K_PAYLOAD_LEN 1152 #define EXT_DATA_19P2K_PAYLOAD_LEN 2304 #define EXT_DATA_25P6K_PAYLOAD_LEN 3456 #define EXT_DATA_38P4K_PAYLOAD_LEN 4608 /**************** command exchange unit header explain *****************/ /* parameter field of command exchange unit */ #define SIGNALING_400MS_RECV_MODE 0x0 #define AUDIO_250MS_RECV_MODE 0x1 #define SHORT_MSG_250MS_RECV_MODE 0x2 #define SHORT_MSG_500MS_RECV_MODE 0x3 #define KEYBOARD_250MS_RECV_MODE 0x4 #define KEYBOARD_500MS_RECV_MODE 0x5 #define LONG_MSG_500MS_RECV_MODE 0x6 #define LONG_MSG_750MS_RECV_MODE 0x7 #define EXT_DATA_1P2K_RECV_MODE 0x8 #define EXT_DATA_2P4K_RECV_MODE 0x9 #define EXT_DATA_4P8K_RECV_MODE 0x10 #define EXT_DATA_9P6K_RECV_MODE 0x11 #define EXT_DATA_19P2K_RECV_MODE 0x12 #define EXT_DATA_25P6K_RECV_MODE 0x13 #define EXT_DATA_38P4K_RECV_MODE 0x14 #endif /* PKT_ANALYZER_H_ */
问题出在这个地方：
这里使用了指向局部变量的指针，并作为函数的返回指针。
改正后的代码如下
/* * recv_pkt_analyzer.c * * Created on: 2014-5-7 * Author: fang ying */ /* @Function Description: Perform packet analysis * * @param * @param * @return */ #include "pkt_analyzer.h" #include "stdlib.h" #include "string.h" #ifndef NULL #define NULL 0 #endif #define MakeDoubleWord(a,b,c,d,e,f,g,h) (((u_int64)(a & 0xff) << 56 )|((u_int64)(b & 0xff) << 48)|\ ((u_int64)(c & 0xff) << 40 )|((u_int64)(d & 0xff) << 32)|\ ((u_int64)(e & 0xff) << 24 )|((u_int64)(f & 0xff) << 16)|\ ((u_int64)(g & 0xff) << 8 )|((u_int64)(h & 0xff) << 0 )) #define MakeWord(a,b,c,d) (((u_int32)(a & 0xff) << 24 )|((u_int32)(b & 0xff) << 16)|\ ((u_int32)(c & 0xff) << 8 ) |((u_int32)(d & 0xff) << 0)) PktUnit *pkt_analyzer(char *rx_buffer, int rx_len){ u_int32 get_class_id = 0; u_int32 get_cmd_field = 0; u_int64 get_timestamp = 0; u_int32 get_parameter = 0; u_int32 get_pkt_payload = 0; PktUnit *packet_rx = (PktUnit *)malloc(sizeof(PktUnit)); /* first check the validity of rx buffer */ if(rx_buffer == NULL || rx_len <= 0){ return NULL; } get_class_id = MakeWord(rx_buffer[0],rx_buffer[1],rx_buffer[2],rx_buffer[3]); /* get the class identification of the rx packet */ switch(get_class_id){ case CMD_DATA: packet_rx->pkt_hdr.class_id = CMD_DATA; break; case SHORT_MSG: packet_rx->pkt_hdr.class_id = SHORT_MSG; break; case LONG_MSG: packet_rx->pkt_hdr.class_id = LONG_MSG; break; case EXTDATA_MSG: packet_rx->pkt_hdr.class_id = EXTDATA_MSG; break; case CMD_EXCHANGE: packet_rx->pkt_hdr.class_id = CMD_EXCHANGE; break; default: return NULL; } /* check direction */ get_cmd_field = MakeWord(rx_buffer[8],rx_buffer[9],rx_buffer[10],rx_buffer[11]); if(get_cmd_field != MASTER_2_TASK){ return NULL; }else{ // fill the cmd field packet_rx->pkt_hdr.cmd_field = get_cmd_field; } /* get parameter field */ get_parameter = MakeWord(rx_buffer[12],rx_buffer[13],rx_buffer[14],rx_buffer[15]); packet_rx->pkt_hdr.para_field = get_parameter; /* get timestamp information */ get_timestamp = MakeDoubleWord(rx_buffer[20],rx_buffer[21],rx_buffer[22],rx_buffer[23], rx_buffer[24],rx_buffer[25],rx_buffer[26],rx_buffer[27]); packet_rx->pkt_hdr.timestamp = get_timestamp; /* get packet length */ packet_rx->pkt_len = rx_len; /* analysis packet according to class id */ if(get_class_id == CMD_DATA){ packet_rx->payload_len = CMD_DATA_PAYLOAD_LEN; } if(get_class_id == SHORT_MSG){ switch(get_parameter){ case AUDIO_250MS: packet_rx->payload_len = AUDIO_250MS_PAYLOAD_LEN; break; case SHORT_MSG_250MS: packet_rx->payload_len = SHORT_MSG_250MS_PAYLOAD_LEN; break; case SHORT_MSG_500MS: packet_rx->payload_len = SHORT_MSG_500MS_PAYLOAD_LEN; break; case KEYBOARD_250MS: packet_rx->payload_len = KEYBOARD_250MS_PAYLOAD_LEN; break; case KEYBOARD_500MS: packet_rx->payload_len = KEYBOARD_500MS_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == LONG_MSG){ switch(get_parameter){ case LONG_MSG_500MS: packet_rx->payload_len = LONG_MSG_500MS_PAYLOAD_LEN; break; case LONG_MSG_750MS: packet_rx->payload_len = LONG_MSG_750MS_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == EXTDATA_MSG){ switch(get_parameter){ case EXT_DATA_1P2K: packet_rx->payload_len = EXT_DATA_1P2K_PAYLOAD_LEN; break; case EXT_DATA_2P4K: packet_rx->payload_len = EXT_DATA_2P4K_PAYLOAD_LEN; break; case EXT_DATA_4P8K: packet_rx->payload_len = EXT_DATA_4P8K_PAYLOAD_LEN; break; case EXT_DATA_9P6K: packet_rx->payload_len = EXT_DATA_9P6K_PAYLOAD_LEN; break; case EXT_DATA_19P2K: packet_rx->payload_len = EXT_DATA_19P2K_PAYLOAD_LEN; break; case EXT_DATA_25P6K: packet_rx->payload_len = EXT_DATA_25P6K_PAYLOAD_LEN; break; case EXT_DATA_38P4K: packet_rx->payload_len = EXT_DATA_38P4K_PAYLOAD_LEN; break; default: return NULL; } } if(get_class_id == CMD_EXCHANGE){ switch(get_parameter){ case SIGNALING_400MS_RECV_MODE: break; case AUDIO_250MS_RECV_MODE: break; case SHORT_MSG_250MS_RECV_MODE: break; case SHORT_MSG_500MS_RECV_MODE: break; case KEYBOARD_250MS_RECV_MODE: break; case KEYBOARD_500MS_RECV_MODE: break; case LONG_MSG_500MS_RECV_MODE: break; case LONG_MSG_750MS_RECV_MODE: break; case EXT_DATA_1P2K_RECV_MODE: break; case EXT_DATA_2P4K_RECV_MODE: break; case EXT_DATA_4P8K_RECV_MODE: break; case EXT_DATA_9P6K_RECV_MODE: break; case EXT_DATA_19P2K_RECV_MODE: break; case EXT_DATA_25P6K_RECV_MODE: break; case EXT_DATA_38P4K_RECV_MODE: break; default: return NULL; } } /* get payload */ packet_rx->payload = (int_8 *)malloc(sizeof(u_int8)); //packet_rx.payload = &rx_buffer[PKT_HDEADER_LEN]; memcpy(packet_rx->payload,&rx_buffer[PKT_HDEADER_LEN],sizeof(u_int8)*packet_rx->payload_len); return packet_rx; }
上面修改的地方，我定义了一个指针，并且动态申请了空间后面就对了。其思想是基于：
因为函数中的局部变量在函数调用结束后就会被释放；这句话是对的，局部变量超出其作用域后就会被释放掉
所以如果你在函数内部定义一个指针，并申请了空间；这句不怎么对，因为只查动态申请的内存都是在堆中申请，不会被释放掉
但是，如果是使用字符串指针形式，char *str = "hello world"这个叫字符串字面常量。储存在静态区，是只读！！！！的所以可以返回
#include<stdio.h> char *returnstr() { char *str="Hello!World!"; printf("In returnstr, addr of str:\t%p\n", str); return str; //"Hello!world!\n"; } int main() { char *str=returnstr(); printf("In main, addr of str:\t%p\n", str); printf("%s\n", str); return 0; }
函数中的变量存储空间是在栈上分配的，函数结束时自动释放，所以不能返回这样的变量，即使你返回了，就像7楼所说的，也得到了正确的值，请不要高兴，这是因为那块内存还没有被占用，值还没有改变，所以你得到了正确的值，有一种情况是可以返回局部指针的，就是在堆上动态分配存储空间，这些空间在函数结束时不会自动释放，但是需要自己释放，所以得记住，要是忘记了就漏掉了。
