围绕变量 'x' 的堆栈已损坏

Question

我正在处理一个 C 代码，它需要我提取一个值、执行计算并将该值放回原始变量中。

放回值的任务导致错误：

Run-time check failiure-Stack around variable 'x' was corrupted.

代码如下：

int RBSPtoNALU (unsigned char *rbsp, NALU_t *nalu, int rbsp_size, int nal_unit_type, int nal_reference_idc, int UseAnnexbLongStartcode)
{
  int len;

  int num = nalu->buf;  ***//nalu->buf is the information i am extracting***

 int r = 0,newnum=0;

  while (num > 0)       ***// Doing a simple reverse operation***

  {
      r = num % 10;
      newnum = newnum * 10 + r;

      num =(num/10);
  }


  byte x = newnum;
  printf("x is in c %c \n", x);
  printf("x is in d %d \n \n \n", x);  getchar();

  nalu->buf = &x;  ***// My efforts end here***


  assert (nalu != NULL);
  assert (nal_reference_idc <=3 && nal_reference_idc >=0);
#if (MVC_EXTENSION_ENABLE)
  assert (nal_unit_type > 0 && nal_unit_type <= NALU_TYPE_SLC_EXT);
#else
  assert (nal_unit_type > 0 && nal_unit_type <= NALU_TYPE_FILL);
#endif
  assert (rbsp_size < MAXRBSPSIZE);

  nalu->startcodeprefix_len = UseAnnexbLongStartcode ? 4 : 3;
  nalu->forbidden_bit       = 0;  
  nalu->nal_reference_idc   = (NalRefIdc) nal_reference_idc;
  nalu->nal_unit_type       = (NaluType) nal_unit_type;

#if (MVC_EXTENSION_ENABLE)
  if(nal_unit_type==NALU_TYPE_PREFIX || nal_unit_type==NALU_TYPE_SLC_EXT)
  {
    nalu->svc_extension_flag = 0;
    //nalu->non_idr_flag       = (nal_reference_idc==NALU_PRIORITY_HIGHEST) ? 0:1;
    nalu->reserved_one_bit   = 1;

  }
  else
    nalu->svc_extension_flag = 0;
endif


  len = RBSPtoEBSP (nalu->buf, rbsp, rbsp_size);
  nalu->len = len;

  printf("length len is %d", len); printf("\n \n");

  return len;
} ***//end of code***

nalu 是结构 NALU_t 的一个实例，定义如下：

typedef struct nalu_t
{
  int       startcodeprefix_len;   //!< 4 for parameter sets and first slice in picture, 3 for everything else (suggested)
  unsigned  len;                   //!< Length of the NAL unit (Excluding the start code, which does not belong to the NALU)
  unsigned  max_size;              //!< NAL Unit Buffer size
  int       forbidden_bit;         //!< should be always FALSE
  NaluType  nal_unit_type;         //!< NALU_TYPE_xxxx
  NalRefIdc nal_reference_idc;     //!< NALU_PRIORITY_xxxx  
  ***byte     *buf;***                   //!< contains the first byte followed by the EBSP
  uint16    lost_packets;          //!< true, if packet loss is detected
#if (MVC_EXTENSION_ENABLE)
  int       svc_extension_flag;    //!< should be always 0, for MVC
  int       non_idr_flag;          //!< 0 = current is IDR
  int       priority_id;           //!< a lower value of priority_id specifies a higher priority
  int       view_id;               //!< view identifier for the NAL unit
  int       temporal_id;           //!< temporal identifier for the NAL unit
  int       anchor_pic_flag;       //!< anchor access unit
  int       inter_view_flag;       //!< inter-view prediction enable
  int       reserved_one_bit;      //!< shall be equal to 1
#endif
} NALU_t;

buf 是指向字节的指针引用，它是一个定义如下的结构：

typedef unsigned char byte;

Answer 1

int num = nalu->buf;

nalu->buf 给出指针的值（地址不是存储在该位置的值）。您需要取消引用它以获取存储在 location

中的值

int num = *(nalu->buf);

反过来

*(nalu->buf) = newnum;/* or  *(nalu->buf) = x */

Answer 2

你不能那样做：

  byte x = newnum;
  printf("x is in c %c \n", x);
  printf("x is in d %d \n \n \n", x);  getchar();

  nalu->buf = &x;  ***// My efforts end here***

x（这可能只是成为 newnum 的编译器别名，因为您不修改它）只有局部作用域！一旦您的函数退出，它就应该不复存在。但是你把它的地址保存在一个来自外部的结构中。

Answer 3

nalu->buf 定义为字节 *buf;

这意味着它是一个指向字节的指针。

您正在将nalu->buf 中的地址复制到整型变量num。这是错误的。这是一个语义错误，但您不会因此而收到异常。

进一步声明一个名为 'x' 的变量并将其地址复制到 nalu->buf 中。这是错误的，因为当这个函数退出时变量 x 将不存在。这就是您收到运行时错误的原因。

围绕变量 'x' 的堆栈已损坏

Stack around variable 'x' was corrupted

c

stack