C reverse function wont work with 32 characters - c

Question

To test my skills, I'm trying to write my own version of a few standard library functions. I wrote a replacement for strlen(), strlength():
int strlength(const char *c){
int len = 0;
while (*c != '\0') {
c++;
len++;
}
return len;
}
which doesn't include the null-terminator, and I am trying to write a function to reverse a string. This:
char *reverse(const char *s){
char *str = (char *)malloc(sizeof(char) * strlength(s));
int i = 0;
while (i < strlength(s)) {
str[i] = s[(strlength(s) - 1) - i];
i++;
}
str[strlength(s)] = '\0';
return str;
}
works for every string except for one with 32 characters (not including null-terminator) like foofoofoofoofoofoofoofoofoofoofo. It hangs in the reverse() functions while-loop. For all other amounts of characters, it works. Why is this happening?

Answer 1

Your buffer for str is off by 1. Your writes are overflowing into the rest of your heap.
As for why it works for values other than 32, my guess is that it has to do with the heap's memory alignment. The compiler is adding extra padding for smaller buffer sizes, but 32 bytes is nicely aligned (it's a power of 2, multiple of 8, etc.), so it doesn't add the extra padding and that's causing your bug to manifest. Try some other multiples of 8 and you'll probably get the same behavior.

Answer 2

char *reverse(const char *s){
here you allocate N characters (where N is the length of s without \0):
char *str = (char *)malloc(sizeof(char) * strlength(s));
then you iterate N times over all characters of s
int i = 0;
while (i < strlength(s)) {
str[i] = s[(strlength(s) - 1) - i];
i++;
}
and finally you add \0 at N+1 characters
str[strlength(s)] = '\0';
return str;
}
so you should do instead:
char *str = malloc(sizeof(*str) * strlength(s) + 1); // +1 for final `\0`
and funny thing is that I just tested your code, and it works fine for me (with one character off) and your 32 characters string. As #JoachimPileborg says, "That's the fun thing about undefined behavior"!
As suggested by others, the problem is certainly due to memory alignment, when you get your data aligned with your memory it overflows, whereas when it is not aligned it overwrites padding values.

Answer 3

You asked:
But this works for every other string length. Why won't it for 32?
Most likely because the runtime allocates memory in blocks of 32 bytes. So a 1-character buffer overrun when the buffer size is, say, 22 bytes, isn't a problem. But when you allocate 32 bytes and try to write to the 33rd byte, the problem shows up.
I suspect you'd see the same error with a string of 64 characters, 96, 128, etc . . .

Answer 4

Replace
malloc(sizeof(char) * strlength(s))
by
malloc(sizeof(char) * (1+strlength(s)));
The line:
str[strlength(s)] = '\0';
works often as the malloc library routine reserves word boundary aligned block and allocates only as much of it as requested in the call, viz. power of 2, but when the overflowing data overwrites beyond the allocated part, then examining the disassembly through debugger is the best hack to understand the build tool-chain specific to target's behavior. As the line is following the while loop rather than within it, so without disassembly how is the while loop mutating into infinite is unpredictable.

Answer 5

What everybody else said about buffer overflow and the vagaries of your runtime's memory allocation implementation/strategy. The size of a C-string is 1 more than its length, due to the NUL-termination octet.
Something like this ought to do you (a little cleaner and easier to read):
#define NUL ((char)0) ;
char *reverse( const char *s )
{
int len = strlen(s) ;
char *tgt = ((char*)malloc( 1+len )) + len ;
char *src = s ;
*(tgt--) = NUL ;
while ( *src )
{
*(tgt--) = *(src++) ;
}
return tgt;
}
Your strlen() implementation is more complicated than it needs to be, too. This is about all you need:
int string_length( const char *s )
{
char *p = s ;
while ( *p ) ++p ;
return p - s ;
}