12个有趣的C语言面试题

12个有趣的C语言面试题

本文的12个C语言面试题，涉及指针、进程、运算、结构体、函数、内存，而且有趣，看看你能做出几个！

1.gets()函数

问：请找出下面代码里的问题

<span class="preprocessor">#include<stdio.h></span>
<span class="keyword">int</span> main(<span class="keyword">void</span>)
{
<span class="indent">  </span><span class="keyword">char</span> buff[<span class="number">10</span>];
<span class="indent">  </span>memset(buff,<span class="number">0</span>,<span class="keyword">sizeof</span>(buff));
<span class="indent">  </span>gets(buff);
<span class="indent">  </span>printf(<span class="string">"\n The buffer entered is [%s]\n"</span>,buff);
<span class="indent">  </span><span class="keyword">return</span> <span class="number">0</span>;
}

答：上面代码里的问题在于函数

gets()

的使用，这个函数从

stdin

接收一个字符串而不检查它所复制的缓存的容积，这可能会导致缓存溢出。这里推荐使用标准函数

fgets()

代替。

2.strcpy()函数

问：下面是一个简单的密码保护功能，你能在不知道密码的情况下将其破解吗？

<span class="preprocessor">#include<stdio.h> </span>
<span class="keyword">int</span> main(<span class="keyword">int</span> argc, <span class="keyword">char</span> *argv[])
{
<span class="indent">  </span><span class="keyword">int</span> flag = <span class="number">0</span>;
<span class="indent">  </span><span class="keyword">char</span> passwd[<span class="number">10</span>];
<span class="indent">  </span>memset(passwd,<span class="number">0</span>,<span class="keyword">sizeof</span>(passwd));
<span class="indent">  </span>strcpy(passwd, argv[<span class="number">1</span>]);
<span class="indent">  </span><span class="keyword">if</span>(<span class="number">0</span> == strcmp(<span class="string">"LinuxGeek"</span>, passwd))
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>flag = <span class="number">1</span>;
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">if</span>(flag)
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>printf(<span class="string">"\n Password cracked \n"</span>);
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">else</span>
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>printf(<span class="string">"\n Incorrect passwd \n"</span>);
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">return</span> <span class="number">0</span>;
}

答：破解上述加密的关键在于利用攻破

strcpy()

函数的漏洞。所以用户在向“

passwd

”缓存输入随机密码的时候并没有提前检查“

passwd

”的容量是否足够。所以，如果用户输入一个足够造成缓存溢出并且重写“

flag

”变量默认值所存在位置的内存的长“密码”，即使这个密码无法通过验证，flag验证位也变成了非零，也就可以获得被保护的数据了。例如：

$ ./psswd aaaaaaaaaaaaa

Password cracked

虽然上面的密码并不正确，但我们仍然可以通过缓存溢出绕开密码安全保护。

要避免这样的问题，建议使用

strncpy()

函数。

作者注：最近的编译器会在内部检测栈溢出的可能，所以这样往栈里存储变量很难出现栈溢出。在我的

gcc

里默认就是这样，所以我不得不使用编译命令‘

-fno-stack-protector

’来实现上述方案。

3.main()的返回类型

问：下面的代码能 编译通过吗？如果能，它有什么潜在的问题吗？

<span class="preprocessor">#include<stdio.h> </span>
<span class="keyword">void</span> main(<span class="keyword">void</span>)
{
<span class="indent">  </span><span class="keyword">char</span> *ptr = (<span class="keyword">char</span>*)malloc(<span class="number">10</span>);
<span class="indent">  </span><span class="keyword">if</span>(NULL == ptr)
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>printf(<span class="string">"\n Malloc failed \n"</span>);
<span class="indent">  </span><span class="indent">  </span><span class="keyword">return</span>;
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">else</span>
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="comment">// Do some processing </span>
<span class="indent">  </span><span class="indent">  </span>free(ptr);
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">return</span>;
}

答：因为

main()

方法的返回类型，这段代码的错误在大多数编译器里会被当作警告。

main()

的返回类型应该是“

int

”而不是“

void

”。因为“

int

”返回类型会让程序返回状态值。这点非常重要，特别当程序是作为依赖于程序成功运行的脚本的一部分运行时。

4.内存泄露

问：下面的代码会导致内存泄漏吗？

<span class="preprocessor">#include<stdio.h>  </span>
<span class="keyword">void</span> main(<span class="keyword">void</span>)
{
<span class="indent">  </span><span class="keyword">char</span> *ptr = (<span class="keyword">char</span>*)malloc(<span class="number">10</span>);
<span class="indent">  </span><span class="keyword">if</span>(NULL == ptr)
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>printf(<span class="string">"\n Malloc failed \n"</span>);
<span class="indent">  </span><span class="indent">  </span><span class="keyword">return</span>;
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">else</span>
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="comment">// Do some processing </span>
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">return</span>;
}

答：尽管上面的代码并没有释放分配给“

ptr

”的内存，但并不会在程序退出后导致内存泄漏。在程序结束后，所有这个程序分配的内存都会自动被处理掉。但如果上面的代码处于一个“

while

循环”中，那将会导致严重的内存泄漏问题！

提示：如果你想知道更多关于内存泄漏的知识和内存泄漏检测工具，可以来看看我们在Valgrind上的文章。

5.free()函数

问：下面的程序会在用户输入’

freeze

‘的时候出问题，而’

zebra

‘则不会，为什么？

<span class="comment">#include<stdio.h>  </span>
<span class="keyword">int</span> main(<span class="keyword">int</span> argc, char <span class="variable">*argv</span>[])
{
<span class="indent">  </span>char <span class="variable">*ptr</span> = (char<span class="variable">*)</span>malloc(<span class="number">10</span>);
<span class="indent">  </span><span class="keyword">if</span>(NULL == ptr)
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="keyword">printf</span>(<span class="string">"\n Malloc failed \n"</span>);
<span class="indent">  </span><span class="indent">  </span><span class="keyword">return</span> -<span class="number">1</span>;
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">else</span> <span class="keyword">if</span>(argc == <span class="number">1</span>)
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="keyword">printf</span>(<span class="string">"\n Usage  \n"</span>);
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">else</span>
<span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span>memset(ptr, <span class="number">0</span>, <span class="number">10</span>);
<span class="indent">  </span><span class="indent">  </span>strncpy(ptr, argv[<span class="number">1</span>], <span class="number">9</span>);
<span class="indent">  </span><span class="indent">  </span><span class="keyword">while</span>(<span class="variable">*ptr</span> != <span class="string">'z'</span>)
<span class="indent">  </span><span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="keyword">if</span>(<span class="variable">*ptr</span> == <span class="string">''</span>)
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="keyword">break</span>;
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="keyword">else</span>
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="indent">  </span>ptr++;
<span class="indent">  </span><span class="indent">  </span>}
<span class="indent">  </span><span class="indent">  </span><span class="keyword">if</span>(<span class="variable">*ptr</span> == <span class="string">'z'</span>)
<span class="indent">  </span><span class="indent">  </span>{
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="keyword">printf</span>(<span class="string">"\n String contains 'z'\n"</span>);
<span class="indent">  </span><span class="indent">  </span><span class="indent">  </span><span class="regexp">//</span> Do some more processing
<span class="indent">  </span><span class="indent">  </span>}
<span class="indent">  </span>   free(ptr);
<span class="indent">  </span>}
<span class="indent">  </span><span class="keyword">return</span> <span class="number">0</span>;
}

答：这里的问题在于，代码会（通过增加“

ptr

”）修改

while

循环里“

ptr

”存储的地址。当输入“

zebra

”时，

while

循环会在执行前被终止，因此传给

free()

的变量就是传给

malloc()

的地址。但在“

freeze

”时，“

ptr

”存储的地址会在

while

循环里被修改，因此导致传给

free()

的地址出错，也就导致了

seg-fault

或者崩溃。

6.使用_exit退出

问：在下面的代码中，

atexit()

并没有被调用，为什么？

<span class="preprocessor">#include<stdio.h>  </span>
<span class="keyword">void</span> func(<span class="keyword">void</span>)
{
<span class="indent">  </span>printf(<span class="string">"\n Cleanup function called \n"</span>);
<span class="indent">  </span><span class="keyword">return</span>;
}
<span class="keyword">int</span> main(<span class="keyword">void</span>)
{
<span class="indent">  </span><span class="keyword">int</span> i = <span class="number">0</span>;
<span class="indent">  </span>atexit(func);
<span class="indent">  </span><span class="keyword">for</span>(;i<<span class="number">0xffffff</span>;i++);
<span class="indent">  </span>_exit(<span class="number">0</span>);
}

答：这是因为

_exit()

函数的使用，该函数并没有调用

atexit()

等函数清理。如果使用

atexit()

就应当使用

exit()

或者“

return

”与之相配合。

7.void*和C结构体

问：你能设计一个能接受任何类型的参数并返回

interger

（整数）结果的函数吗？

答：如下：

<span class="keyword">int</span> func(<span class="keyword">void</span> *ptr)

如果这个函数的参数超过一个，那么这个函数应该由一个结构体来调用，这个结构体可以由需要传递参数来填充。

8.* 和 ++ 操作

问：下面的操作会输出什么？为什么？

<span class="comment">#include<stdio.h>  </span>
<span class="keyword">int</span> main(void)
{
char <span class="variable">*ptr</span> = <span class="string">"Linux"</span>;
<span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%c</span>] \n"</span>,<span class="variable">*ptr</span>++);
<span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%c</span>] \n"</span>,<span class="variable">*ptr</span>);
<span class="keyword">return</span> <span class="number">0</span>;
}

答：输出结果应该是这样：

[L]

[i]

因为“

++

”和“

*

”的优先权一样，所以“

*ptr++

”相当于“

*(ptr++)

”。即应该先执行

ptr++

，然后才是

*ptr

，所以操作结果是“

L

”。第二个结果是“

i

”。

9.修改代码片段（或者只读代码）

问：下面的代码段有错，你能指出来吗？

<span class="comment">#include<stdio.h>  </span>
<span class="keyword">int</span> main(void)
{
char <span class="variable">*ptr</span> = <span class="string">"Linux"</span>;
<span class="variable">*ptr</span> = <span class="string">'T'</span>;
<span class="keyword">printf</span>(<span class="string">"\n [<span class="variable">%s</span>] \n"</span>, ptr);
<span class="keyword">return</span> <span class="number">0</span>;
}

答：这是因为，通过

*ptr = ‘T’

，会改变内存中代码段（只读代码）“Linux”的第一个字母。这个操作是无效的，因此会造成

seg-fault

或者崩溃。

10.会改变自己名字的进程

问：你能写出一个在运行时改变自己进程名的程序吗？

答：参见下面这段代码：

<span class="preprocessor">#include<stdio.h> </span>
<span class="keyword">int</span> main(<span class="keyword">int</span> argc, <span class="keyword">char</span> *argv[])
{
<span class="indent">  </span><span class="keyword">int</span> i = <span class="number">0</span>;
<span class="indent">  </span><span class="keyword">char</span> buff[<span class="number">100</span>];
<span class="indent">  </span>memset(buff,<span class="number">0</span>,<span class="keyword">sizeof</span>(buff));
<span class="indent">  </span>strncpy(buff, argv[<span class="number">0</span>], <span class="keyword">sizeof</span>(buff));
<span class="indent">  </span>memset(argv[<span class="number">0</span>],<span class="number">0</span>,strlen(buff));
<span class="indent">  </span>strncpy(argv[<span class="number">0</span>], <span class="string">"NewName"</span>, <span class="number">7</span>);
<span class="indent">  </span><span class="comment">// Simulate a wait. Check the process </span>
<span class="indent">  </span><span class="comment">// name at this point. </span>
<span class="indent">  </span><span class="keyword">for</span>(;i<<span class="number">0xffffffff</span>;i++);
<span class="indent">  </span><span class="keyword">return</span> <span class="number">0</span>;
}

11.返回本地变量的地址

问：下面代码有问题吗？如果有，该怎么修改？

<span class="comment">#include<stdio.h>  </span>
<span class="keyword">int</span>* inc(<span class="keyword">int</span> val)
{
<span class="keyword">int</span> a = val;
a++;
<span class="keyword">return</span> &a;
}
<span class="keyword">int</span> main(void)
{
<span class="keyword">int</span> a = <span class="number">10</span>;
<span class="keyword">int</span> <span class="variable">*val</span> = inc(a);
<span class="keyword">printf</span>(<span class="string">"\n Incremented value is equal to [<span class="variable">%d</span>] \n"</span>, <span class="variable">*val</span>);
<span class="keyword">return</span> <span class="number">0</span>;
}

答：尽管上面的程序有时候能够正常运行，但是在“

inc()

”中存在严重的漏洞。这个函数返回本地变量的地址。因为本地变量的生命周期就是“

inc()

”的生命周期，所以在

inc

结束后，使用本地变量会发生不好的结果。这可以通过将

main()

中变量“

a

”的地址来避免，这样以后还可以修改这个地址存储的值。

12.处理printf()的参数

问：下面代码会输出什么？

<span class="comment">#include<stdio.h> </span>
<span class="keyword">int</span> main(void)
{
<span class="keyword">int</span> a = <span class="number">10</span>, b = <span class="number">20</span>, c = <span class="number">30</span>;
<span class="keyword">printf</span>(<span class="string">"\n <span class="variable">%d</span>..<span class="variable">%d</span>..<span class="variable">%d</span> \n"</span>, a+b+c, (b = b<span class="variable">*2</span>), (c = c<span class="variable">*2</span>));

<span class="keyword">return</span> <span class="number">0</span>;
}

答：输出结果是：

<span class="attribute">110..40..60</span>

这是因为C语言里函数的参数默认是从右往左处理的，输出时是从左往右。