Lab: săn mười lỗi trong một tệp

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>

typedef struct {
    char ten[8];
    int  diem;
} SinhVien;

/* LOI 1 */
static char *sao_chep(const char *s) {
    char *p = malloc(strlen(s));
    strcpy(p, s);
    return p;
}

/* LOI 2 */
static int tong(const int *a, int n) {
    int t;
    for (int i = 0; i < n; ++i) t += a[i];
    return t;
}

/* LOI 3 */
static int trung_binh(const int *a, int n) {
    return tong(a, n) / n;
}

/* LOI 4 */
static void dat_ten(SinhVien *sv, const char *ten) {
    strcpy(sv->ten, ten);
}

/* LOI 5 */
static int *lon_nhat(int *a, int n) {
    int max = a[0];
    for (int i = 1; i < n; ++i) if (a[i] > max) max = a[i];
    return &max;
}

/* LOI 6 */
static int nhan_an_toan(int a, int b) {
    if (a * b < 0) return -1;
    return a * b;
}

/* LOI 7 */
static void in_nguoc(const char *s) {
    int n = (int)strlen(s);
    for (int i = n; i >= 0; --i) putchar(s[i]);
    putchar('\n');
}

/* LOI 8 */
static unsigned mat_na(int n) {
    return ~0u << n;
}

/* LOI 9 */
static void doi_cho(int *a, int *b) {
    *a = *a + *b;
    *b = *a - *b;
    *a = *a - *b;
}

/* LOI 10 */
int main(void) {
    setvbuf(stdout, NULL, _IONBF, 0);

    int a[5] = { 3, 1, 4, 1, 5 };

    char *t = sao_chep("xin chao");
    printf("chep : %s\n", t);

    printf("tong : %d\n", tong(a, 5));
    printf("tb   : %d\n", trung_binh(a, 0));

    SinhVien sv = { "", 100 };
    dat_ten(&sv, "NguyenVanA");
    printf("diem : %d\n", sv.diem);

    printf("max  : %d\n", *lon_nhat(a, 5));
    printf("nhan : %d\n", nhan_an_toan(100000, 100000));

    in_nguoc("abc");
    printf("matna: %u\n", mat_na(32));

    int x = 1, y = 2;
    doi_cho(&x, &x);
    printf("doicho: x=%d\n", x);

    free(t);
    free(t);

    return 0;
}

# Chay tren Linux hoac WSL2, vi MinGW khong co sanitizer.
# Bai 34.1 da noi ve gioi han nay.

gcc -std=c11 -g3 -O1 -fno-omit-frame-pointer \
    -fsanitize=address,undefined \
    -o bugs_san bugs.c

./bugs_san

static char *sao_chep(const char *s) {
    char *p = malloc(strlen(s) + 1);        /* +1 cho ky tu ket thuc */
    if (p == NULL) return NULL;
    strcpy(p, s);
    return p;
}

static int tong(const int *a, int n) {
    int t = 0;                              /* khoi tao */
    for (int i = 0; i < n; ++i) t += a[i];
    return t;
}

static int trung_binh(const int *a, int n) {
    if (n <= 0) return 0;                   /* chan chia cho khong */
    return tong(a, n) / n;
}

static void dat_ten(SinhVien *sv, const char *ten) {
    snprintf(sv->ten, sizeof sv->ten, "%s", ten);   /* luon ket thuc chuoi */
}

static int lon_nhat(const int *a, int n) {  /* tra ve GIA TRI, khong tra con tro */
    int max = a[0];
    for (int i = 1; i < n; ++i) if (a[i] > max) max = a[i];
    return max;
}

static int nhan_an_toan(int a, int b) {
    int r;
    if (__builtin_mul_overflow(a, b, &r)) return -1;   /* kiem tra TRUOC */
    return r;
}

static void in_nguoc(const char *s) {
    int n = (int)strlen(s);
    for (int i = n - 1; i >= 0; --i) putchar(s[i]);    /* bat dau tu n - 1 */
    putchar('\n');
}

static unsigned mat_na(int n) {
    if (n < 0)   return 0u;
    if (n >= 32) return 0u;                 /* chan dich qua do rong */
    return ~0u << n;
}

static void doi_cho(int *a, int *b) {
    if (a == b) return;                     /* chan truong hop trung */
    int t = *a; *a = *b; *b = t;            /* bien tam: ro rang va nhanh hon */
}

## Loi 4: tran bo dem tren ngan xep

**Dong:** bugs.c:32
**Loai:** stack-buffer-overflow
**Cong cu phat hien:** AddressSanitizer

**Ket xuat goc:**

    ==8123==ERROR: AddressSanitizer: stack-buffer-overflow on address
    0x7ffd3a1b40c8 at pc 0x7f2e8c4c9a1d bp 0x7ffd3a1b4090 sp 0x7ffd3a1b3838
    WRITE of size 11 at 0x7ffd3a1b40c8 thread T0
        #0 0x7f2e8c4c9a1c in strcpy
        #1 0x40130f in dat_ten bugs.c:32
        #2 0x4014a7 in main bugs.c:80

**Nguyen nhan:**

SinhVien.ten la mang 8 byte. Chuoi "NguyenVanA" dai 10 ky tu, cong
ky tu ket thuc la 11 byte. strcpy khong biet kich thuoc dich nen ghi
du 11 byte, tran 3 byte sang truong diem nam ngay sau trong bo nho.

Doc chay khong co ASan cho thay diem doi tu 100 thanh 16750, tuc
hai byte thap cua truong diem da bi ghi de boi "nA" cong ky tu ket thuc.

**Ban va:**

    - strcpy(sv->ten, ten);
    + snprintf(sv->ten, sizeof sv->ten, "%s", ten);

**Bang chung sau khi va:**

    ./bugs_va.exe        -> "diem : 100"
    ASan                 -> khong bao
    UBSan                -> khong bao
    valgrind             -> ERROR SUMMARY: 0 errors

**Kiem thu hoi quy:**

    KIEM_CHUOI(sv.ten, "NguyenV");     /* bi cat dung 7 ky tu */
    KIEM_BANG(sv.diem, 100);           /* khong bi ghi de */
    KIEM_BANG(sv.ten[7], 0);           /* CO ky tu ket thuc chuoi */