为什么这个Objective-C代码会引发一个malloc错误？

Question

我用这个方法来编码对象的C的base64字符串，但该应用有时坠毁：

- (NSString *) base64Encode 
{ 
    //Point to start of the data and set buffer sizes 
    int inLength = [self length]; 
    int outLength = ((((inLength * 4)/3)/4)*4) + (((inLength * 4)/3)%4 ? 4 : 0); 
    const char *inputBuffer = [self bytes]; 
    char *outputBuffer = malloc(outLength); 
    outputBuffer[outLength] = 0; 

    //64 digit code 
    static char Encode[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz/"; 

    //start the count 
    int cycle = 0; 
    int inpos = 0; 
    int outpos = 0; 
    char temp; 

    //Pad the last to bytes, the outbuffer must always be a multiple of 4 
    outputBuffer[outLength-1] = '='; 
    outputBuffer[outLength-2] = '='; 

    /* http://en.wikipedia.org/wiki/Base64 
    Text content M   a   n 
    ASCII   77   97   110 
    8 Bit pattern 01001101 01100001 01101110 

    6 Bit pattern 010011 010110 000101 101110 
    Index   19  22  5  46 
    Base64-encoded T  W  F  u 
    */ 

    while (inpos < inLength){ 
     switch (cycle) { 
      case 0: 
       outputBuffer[outpos++] = Encode[(inputBuffer[inpos]&0xFC)>>2]; 
       cycle = 1; 
       break; 
      case 1: 
       temp = (inputBuffer[inpos++]&0x03)<<4; 
       outputBuffer[outpos] = Encode[temp]; 
       cycle = 2; 
       break; 
      case 2: 
       outputBuffer[outpos++] = Encode[temp|(inputBuffer[inpos]&0xF0)>> 4]; 
       temp = (inputBuffer[inpos++]&0x0F)<<2; 
       outputBuffer[outpos] = Encode[temp]; 
       cycle = 3;     
       break; 
      case 3: 
       outputBuffer[outpos++] = Encode[temp|(inputBuffer[inpos]&0xC0)>>6]; 
       cycle = 4; 
       break; 
      case 4: 
       outputBuffer[outpos++] = Encode[inputBuffer[inpos++]&0x3f]; 
       cycle = 0; 
       break;       
      default: 
       cycle = 0; 
       break; 
     } 
    } 
    NSString *pictemp = [NSString stringWithUTF8String:outputBuffer]; 
    free(outputBuffer); 
    return pictemp; 

} 

错误是：

malloc: *** error for object 0x164084: incorrect checksum for freed object - object was probably modified after being freed. 

，当我调试，它在此行中停止：

free(outputBuffer); 

你知道是什么导致了这里的崩溃？

Answer 1

也许这就是问题所在：你分配outLength

char *outputBuffer = malloc(outLength); 
outputBuffer[outLength] = 0; 

在第一行字节，但在第二行中，你写入一个超出结尾的字节的位置缓冲。根据页面边界和malloc内部的其他神秘事件，这可能是好的，也可能不会。这将解释为什么它不会每时间崩溃。

试试这个：

char *outputBuffer = malloc(outLength + 1); 
outputBuffer[outLength] = 0; 

这可能会解决你的问题。

Answer 2

您修改过去的malloc分配OutputBuffer中结束与：

outputBuffer[outLength] = 0; 

如果outLength是3，那么你可以设置outputBuffer[0]，outputBuffer[1]和outputBuffer[2]但不outputBuffer[3]。

要么改变你的malloc到：

char *outputBuffer = malloc(outLength+1); 

或更改您的初始化：

outputBuffer[outLength-1] = 0;