12个有趣的C语言面试题
本文的12个C语言面试题,涉及指针、进程、运算、结构体、函数、内存,而且有趣,看看你能做出几个!
1.gets()函数
问:请找出下面代码里的问题
<span class="preprocessor">#include<stdio.h></span> <span class="keyword">int</span> main(<span class="keyword">void</span>) { <span class="indent"> </span><span class="keyword">char</span> buff[<span class="number">10</span>]; <span class="indent"> </span>memset(buff,<span class="number">0</span>,<span class="keyword">sizeof</span>(buff)); <span class="indent"> </span>gets(buff); <span class="indent"> </span>printf(<span class="string">"\n The buffer entered is [%s]\n"</span>,buff); <span class="indent"> </span><span class="keyword">return</span> <span class="number">0</span>; }
答:上面代码里的问题在于函数 gets()
的使用,这个函数从 stdin
接收一个字符串而不检查它所复制的缓存的容积,这可能会导致缓存溢出。这里推荐使用标准函数 fgets()
代替。
2.strcpy()函数
问:下面是一个简单的密码保护功能,你能在不知道密码的情况下将其破解吗?
<span class="preprocessor">#include<stdio.h> </span> <span class="keyword">int</span> main(<span class="keyword">int</span> argc, <span class="keyword">char</span> *argv[]) { <span class="indent"> </span><span class="keyword">int</span> flag = <span class="number">0</span>; <span class="indent"> </span><span class="keyword">char</span> passwd[<span class="number">10</span>]; <span class="indent"> </span>memset(passwd,<span class="number">0</span>,<span class="keyword">sizeof</span>(passwd)); <span class="indent"> </span>strcpy(passwd, argv[<span class="number">1</span>]); <span class="indent"> </span><span class="keyword">if</span>(<span class="number">0</span> == strcmp(<span class="string">"LinuxGeek"</span>, passwd)) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>flag = <span class="number">1</span>; <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">if</span>(flag) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>printf(<span class="string">"\n Password cracked \n"</span>); <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">else</span> <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>printf(<span class="string">"\n Incorrect passwd \n"</span>); <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">return</span> <span class="number">0</span>; }
答:破解上述加密的关键在于利用攻破 strcpy()
函数的漏洞。所以用户在向“ passwd
”缓存输入随机密码的时候并没有提前检查“passwd
”的容量是否足够。所以,如果用户输入一个足够造成缓存溢出并且重写“ flag
”变量默认值所存在位置的内存的长“密码”,即使这个密码无法通过验证,flag验证位也变成了非零,也就可以获得被保护的数据了。例如:
$ ./psswd aaaaaaaaaaaaa Password cracked
虽然上面的密码并不正确,但我们仍然可以通过缓存溢出绕开密码安全保护。
要避免这样的问题,建议使用 strncpy()
函数。
作者注:最近的编译器会在内部检测栈溢出的可能,所以这样往栈里存储变量很难出现栈溢出。在我的 gcc
里默认就是这样,所以我不得不使用编译命令‘ -fno-stack-protector
’来实现上述方案。
3.main()的返回类型
问:下面的代码能 编译通过吗?如果能,它有什么潜在的问题吗?
<span class="preprocessor">#include<stdio.h> </span> <span class="keyword">void</span> main(<span class="keyword">void</span>) { <span class="indent"> </span><span class="keyword">char</span> *ptr = (<span class="keyword">char</span>*)malloc(<span class="number">10</span>); <span class="indent"> </span><span class="keyword">if</span>(NULL == ptr) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>printf(<span class="string">"\n Malloc failed \n"</span>); <span class="indent"> </span><span class="indent"> </span><span class="keyword">return</span>; <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">else</span> <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="comment">// Do some processing </span> <span class="indent"> </span><span class="indent"> </span>free(ptr); <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">return</span>; }
答:因为 main()
方法的返回类型,这段代码的错误在大多数编译器里会被当作警告。 main()
的返回类型应该是“ int
”而不是“ void
”。因为“ int
”返回类型会让程序返回状态值。这点非常重要,特别当程序是作为依赖于程序成功运行的脚本的一部分运行时。
4.内存泄露
问:下面的代码会导致内存泄漏吗?
<span class="preprocessor">#include<stdio.h> </span> <span class="keyword">void</span> main(<span class="keyword">void</span>) { <span class="indent"> </span><span class="keyword">char</span> *ptr = (<span class="keyword">char</span>*)malloc(<span class="number">10</span>); <span class="indent"> </span><span class="keyword">if</span>(NULL == ptr) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>printf(<span class="string">"\n Malloc failed \n"</span>); <span class="indent"> </span><span class="indent"> </span><span class="keyword">return</span>; <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">else</span> <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="comment">// Do some processing </span> <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">return</span>; }
答:尽管上面的代码并没有释放分配给“ ptr
”的内存,但并不会在程序退出后导致内存泄漏。在程序结束后,所有这个程序分配的内存都会自动被处理掉。但如果上面的代码处于一个“ while
循环”中,那将会导致严重的内存泄漏问题!
提示:如果你想知道更多关于内存泄漏的知识和内存泄漏检测工具,可以来看看我们在Valgrind上的文章。
5.free()函数
问:下面的程序会在用户输入’ freeze
‘的时候出问题,而’ zebra
‘则不会,为什么?
<span class="comment">#include<stdio.h> </span> <span class="keyword">int</span> main(<span class="keyword">int</span> argc, char <span class="variable">*argv</span>[]) { <span class="indent"> </span>char <span class="variable">*ptr</span> = (char<span class="variable">*)</span>malloc(<span class="number">10</span>); <span class="indent"> </span><span class="keyword">if</span>(NULL == ptr) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="keyword">printf</span>(<span class="string">"\n Malloc failed \n"</span>); <span class="indent"> </span><span class="indent"> </span><span class="keyword">return</span> -<span class="number">1</span>; <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">else</span> <span class="keyword">if</span>(argc == <span class="number">1</span>) <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="keyword">printf</span>(<span class="string">"\n Usage \n"</span>); <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">else</span> <span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span>memset(ptr, <span class="number">0</span>, <span class="number">10</span>); <span class="indent"> </span><span class="indent"> </span>strncpy(ptr, argv[<span class="number">1</span>], <span class="number">9</span>); <span class="indent"> </span><span class="indent"> </span><span class="keyword">while</span>(<span class="variable">*ptr</span> != <span class="string">'z'</span>) <span class="indent"> </span><span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="keyword">if</span>(<span class="variable">*ptr</span> == <span class="string">''</span>) <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="keyword">break</span>; <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="keyword">else</span> <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="indent"> </span>ptr++; <span class="indent"> </span><span class="indent"> </span>} <span class="indent"> </span><span class="indent"> </span><span class="keyword">if</span>(<span class="variable">*ptr</span> == <span class="string">'z'</span>) <span class="indent"> </span><span class="indent"> </span>{ <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="keyword">printf</span>(<span class="string">"\n String contains 'z'\n"</span>); <span class="indent"> </span><span class="indent"> </span><span class="indent"> </span><span class="regexp">//</span> Do some more processing <span class="indent"> </span><span class="indent"> </span>} <span class="indent"> </span> free(ptr); <span class="indent"> </span>} <span class="indent"> </span><span class="keyword">return</span> <span class="number">0</span>; }
答:这里的问题在于,代码会(通过增加“ ptr
”)修改 while
循环里“ ptr
”存储的地址。当输入“ zebra
”时, while
循环会在执行前被终止,因此传给 free()
的变量就是传给 malloc()
的地址。但在“ freeze
”时,“ ptr
”存储的地址会在 while
循环里被修改,因此导致传给 free()
的地址出错,也就导致了 seg-fault
或者崩溃。
6.使用_exit退出
问:在下面的代码中, atexit()
并没有被调用,为什么?
<span class="preprocessor">#include<stdio.h> </span> <span class="keyword">void</span> func(<span class="keyword">void</span>) { <span class="indent"> </span>printf(<span class="string">"\n Cleanup function called \n"</span>); <span class="indent"> </span><span class="keyword">return</span>; } <span class="keyword">int</span> main(<span class="keyword">void</span>) { <span class="indent"> </span><span class="keyword">int</span> i = <span class="number">0</span>; <span class="indent"> </span>atexit(func); <span class="indent"> </span><span class="keyword">for</span>(;i<<span class="number">0xffffff</span>;i++); <span class="indent"> </span>_exit(<span class="number">0</span>); }
答:这是因为 _exit()
函数的使用,该函数并没有调用 atexit()
等函数清理。如果使用 atexit()
就应当使用 exit()
或者“ return
”与之相配合。
7.void*和C结构体
问:你能设计一个能接受任何类型的参数并返回 interger
(整数)结果的函数吗?
答:如下:
<span class="keyword">int</span> func(<span class="keyword">void</span> *ptr)
如果这个函数的参数超过一个,那么这个函数应该由一个结构体来调用,这个结构体可以由需要传递参数来填充。
8.* 和 ++ 操作
问:下面的操作会输出什么?为什么?
<span class="comment">#include<stdio.h> </span> <span class="keyword">int</span> main(void) { char <span class="variable">*ptr</span> = <span class="string">"Linux"</span>; <span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%c</span>] \n"</span>,<span class="variable">*ptr</span>++); <span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%c</span>] \n"</span>,<span class="variable">*ptr</span>); <span class="keyword">return</span> <span class="number">0</span>; }
答:输出结果应该是这样:
[L] [i]
因为“ ++
”和“ *
”的优先权一样,所以“ *ptr++
”相当于“ *(ptr++)
”。即应该先执行 ptr++
,然后才是 *ptr
,所以操作结果是“L
”。第二个结果是“ i
”。
9.修改代码片段(或者只读代码)
问:下面的代码段有错,你能指出来吗?
<span class="comment">#include<stdio.h> </span> <span class="keyword">int</span> main(void) { char <span class="variable">*ptr</span> = <span class="string">"Linux"</span>; <span class="variable">*ptr</span> = <span class="string">'T'</span>; <span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%s</span>] \n"</span>, ptr); <span class="keyword">return</span> <span class="number">0</span>; }
答:这是因为,通过 *ptr = ‘T’
,会改变内存中代码段(只读代码)“Linux”的第一个字母。这个操作是无效的,因此会造成 seg-fault
或者崩溃。
10.会改变自己名字的进程
问:你能写出一个在运行时改变自己进程名的程序吗?
答:参见下面这段代码:
<span class="preprocessor">#include<stdio.h> </span> <span class="keyword">int</span> main(<span class="keyword">int</span> argc, <span class="keyword">char</span> *argv[]) { <span class="indent"> </span><span class="keyword">int</span> i = <span class="number">0</span>; <span class="indent"> </span><span class="keyword">char</span> buff[<span class="number">100</span>]; <span class="indent"> </span>memset(buff,<span class="number">0</span>,<span class="keyword">sizeof</span>(buff)); <span class="indent"> </span>strncpy(buff, argv[<span class="number">0</span>], <span class="keyword">sizeof</span>(buff)); <span class="indent"> </span>memset(argv[<span class="number">0</span>],<span class="number">0</span>,strlen(buff)); <span class="indent"> </span>strncpy(argv[<span class="number">0</span>], <span class="string">"NewName"</span>, <span class="number">7</span>); <span class="indent"> </span><span class="comment">// Simulate a wait. Check the process </span> <span class="indent"> </span><span class="comment">// name at this point. </span> <span class="indent"> </span><span class="keyword">for</span>(;i<<span class="number">0xffffffff</span>;i++); <span class="indent"> </span><span class="keyword">return</span> <span class="number">0</span>; }
11.返回本地变量的地址
问:下面代码有问题吗?如果有,该怎么修改?
<span class="comment">#include<stdio.h> </span> <span class="keyword">int</span>* inc(<span class="keyword">int</span> val) { <span class="keyword">int</span> a = val; a++; <span class="keyword">return</span> &a; } <span class="keyword">int</span> main(void) { <span class="keyword">int</span> a = <span class="number">10</span>; <span class="keyword">int</span> <span class="variable">*val</span> = inc(a); <span class="keyword">printf</span>(<span class="string">"\n Incremented value is equal to [<span class="variable">%d</span>] \n"</span>, <span class="variable">*val</span>); <span class="keyword">return</span> <span class="number">0</span>; }
答:尽管上面的程序有时候能够正常运行,但是在“ inc()
”中存在严重的漏洞。这个函数返回本地变量的地址。因为本地变量的生命周期就是“ inc()
”的生命周期,所以在 inc
结束后,使用本地变量会发生不好的结果。这可以通过将 main()
中变量“ a
”的地址来避免,这样以后还可以修改这个地址存储的值。
12.处理printf()的参数
问:下面代码会输出什么?
<span class="comment">#include<stdio.h> </span> <span class="keyword">int</span> main(void) { <span class="keyword">int</span> a = <span class="number">10</span>, b = <span class="number">20</span>, c = <span class="number">30</span>; <span class="keyword">printf</span>(<span class="string">"\n <span class="variable">%d</span>..<span class="variable">%d</span>..<span class="variable">%d</span> \n"</span>, a+b+c, (b = b<span class="variable">*2</span>), (c = c<span class="variable">*2</span>)); <span class="keyword">return</span> <span class="number">0</span>; }
答:输出结果是:
<span class="attribute">110..40..60</span>
这是因为C语言里函数的参数默认是从右往左处理的,输出时是从左往右。