Probleme when trying to store char[] into char*

Question

I'm curently developping a web application in C on a Debian (don't ask me why). I made a method to get the data from a form using POST :

const char* getParam(char* postResult, char* param)
{
char stock[30];
char* pointer = strstr(postResult, param);
while(*pointer != 61)
    pointer++;

int i = 0;
++pointer;
while(*pointer != 38)
{
    stock[i] = *pointer;
    i++;
    *pointer++;
}
stock[i] = 0;
const char *result;
if(stock[0] == 0) {
    result = "";
}else{
    result = stock;
}
return result;
}

when calling this method I store the data in a variable declared by

char fname[40];

like this

strcpy(fname,getParam(ptr, "firstn"));

Then when trying to display the data it shows weird characters.

*Don't ask me why* Why? You are returning pointer to local variable. Please follow warnings on your compiler. If there is no warning, enable all possible warnings in GCC. — unalignedmemoryaccess, Nov 24 '17 at 05:51
I use gcc and it doesn't display any warning even when using -Wall it only displays the unused things. — Guillaume Drillaud, Nov 24 '17 at 05:52
Be sure to use `gcc -Wall ...` (not sure it sees this one, though) — Déjà vu, Nov 24 '17 at 05:53
no warning is issued in that case because you're assigning the local buffer to a pointer. The compiler is lost at this point and cannot issue the warning. — Jean-François Fabre, Nov 24 '17 at 05:58
@GuillaumeDrillaud always fix all the warnings, even the "non important ones". if you don't do that, after a few months your code issues 3003434 warnings and you don't see the important ones. — Jean-François Fabre, Nov 24 '17 at 06:01

score 0 · Accepted Answer · answered Nov 24 '17 at 05:54

You are returning a pointer to a local variable (stock) that is not available anymore if the function is finished.

Make stock static to make it stay or make it an dynamically allocated memory or pass fname into the function and store it there.

In any case you need to make sure that the memory you store the content is there as long you use it.

Amin Negm-Awad · Answer 2 · 2017-11-25T05:21:38.393

Instead returning a pointer to a local var inside getParam(), you can pass a pointer to a buffer.

const char* getParam(char *stock, char* postResult, char* param)
{
  // char stock[20] you do not need that anymore
  char* pointer = strstr(postResult, param);
  while(*pointer != 61)
    pointer++;

  // int i = 0;
  ++pointer;

  // Move that up
  if( pointer==0 )
  {
    *stock=0;
    return;
  }

  while(*pointer != 38)
  {
    *stock = *pointer;
    stock++;
    *pointer++;
  }
  stock = 0;

}

In this case you do not need to use strcpy(), too:

char fname[40]; 
getParam(fname, ptr, "firstn"));

Typed in browser.

However, you should check for too long args and for strings without 38. In your current version there is an attack vector for buffer overflows.

Probleme when trying to store char[] into char*

2 Answers2