user-0 提问: 这样处理字符串是否安全，请大神看看！！！！

回复:
user: user-1
content: str = dfpath; free(dfpath); return str; ------------------- 这么狗血的代码，竟然谁都没看到？？？？

user: user-2
content: 不应该在函数体内free，要在函数体外。

user: user-0
content: 最近被指针搞的有点头大。。感谢各位的回复，都跟给力！！！！

user: user-3
content: 不安全，有字符串溢出的隐患

user: user-4
content: 这段代码功能不能算实现，可靠性也不好。 1、这段代码说达到效果很牵强，字符串在申请的内存空间，但该空间被你free了，其它进程可以使用，那么里面的内容就是未知的了，可能是原来的你要的字符串（如果运气好没被修改的话），也可能是别的内容，所以最后打印出来的东西是未知的。 2、里面用到的指针人为的认为不为空，没做可靠的检验。

user: user-5
content: 你这个scp_make_file写的那是相当的不安全啊。

user: user-6
content: 没有绝对的安全，只有相对更安全。

user: user-6
content: #include <stdio.h> #include <stdlib.h> #include <string.h>   char* scp_make_file(char *dpath, char *localfile) {     char *p;     static char dfpath[_MAX_PATH];     p = (char *)strrchr(localfile, '/');     strncpy(dfpath, dpath,_MAX_PATH-1);dfpath[_MAX_PATH-1]=0;     if (p!=NULL) strncat(dfpath, p,_MAX_PATH-1-strlen(p));     return dfpath; }  int main() {     char *dpath = "/tmp";     char *localfile = "/home/nisp/test.c";     char *p;     p = scp_make_file(dpath, localfile);     printf("%s\n", p);     return 0; }  没有绝对的安全，只用相对更安全。

user: user-0
content: 但我放到程序中，，怎么就不行了！！！！！ #include <libssh2.h> #include <libssh2_sftp.h>  #include <sys/socket.h> #include <netinet/in.h> #include <unistd.h> #include <arpa/inet.h>  #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <errno.h> #include <ctype.h> #include <zlib.h>  #include "scp.h"    char* scp_make_file(char *dpath, char *localfile);  UserInfo *scp_create(char *ip, char *uname, char *passwd, char *dparh) {     UserInfo *userinfo = (UserInfo *)malloc(sizeof(UserInfo));     if(userinfo)     {         userinfo->ip = ip;         userinfo->uname = uname;         userinfo->passwd = passwd;         userinfo->dpath = dparh;     }      return userinfo; }  int scp_upload(UserInfo *userinfo, char *localfile) {     unsigned long hostaddr;     int sock, i;     struct sockaddr_in sin;     const char *fingerprint;     LIBSSH2_SESSION *session;     LIBSSH2_CHANNEL *channel;     FILE *local;     int rc;     char mem[1024];     size_t nread;     char *ptr;     char *scppath;     struct stat fileinfo;      hostaddr = inet_addr(userinfo->ip);      rc = libssh2_init(0);     if(rc != 0)     {         fprintf(stderr, "libssh2 initialization failed (%d)!\n", rc);         return 1;     }      local = fopen(localfile, "rb");     if(!local)     {         fprintf(stderr, "can not open local file %s\n", localfile);         return 1;     }      sock = socket(AF_INET, SOCK_STREAM ,0);     if(-1 == sock)     {         fprintf(stderr, "failed to create socket!\n");         return 1;     }      sin.sin_family = AF_INET;     sin.sin_port = htons(22);     sin.sin_addr.s_addr = hostaddr;     if(connect(sock, (struct sockaddr*)(&sin), sizeof(struct sockaddr_in)) != 0)     {         fprintf(stderr, "failed to connect!\n");         return 1;     }      session = libssh2_session_init();     if(!session)     {         return 1;     }      rc = libssh2_session_startup(session, sock);     if(rc)     {         fprintf(stderr, "Failure establishing SSH session :%d\n", rc);         return 1;     }      fingerprint = libssh2_hostkey_hash(session, LIBSSH2_HOSTKEY_HASH_SHA1);      if(libssh2_userauth_password(session, userinfo->uname, userinfo->passwd))     {         fprintf(stderr, "Authentication by password failed.\n");         goto shutdown;     }      stat(localfile, &fileinfo);      printf("%s\n", userinfo->dpath);     printf("%s\n", localfile);     scppath = scp_make_file(userinfo->dpath, localfile);     printf("%s\n", scppath);     channel = libssh2_scp_send(session, scppath, fileinfo.st_mode & 0777,                               (unsigned long)fileinfo.st_size);      if(!channel)     {         char *errmsg;         int errlen;         int err = libssh2_session_last_error(session, &errmsg, &errlen, 0);         fprintf(stderr, "Unable to open a session: (%d) %s\n", err, errmsg);         goto shutdown;     }           do{         nread = fread(mem, 1, sizeof(mem), local);         if(nread <= 0)         {             break;         }         ptr = mem;          do{             rc = libssh2_channel_write(channel, ptr, nread);             if(rc < 0)             {                 fprintf(stderr, "ERROR %d\n", rc);                 break;             }             else             {                 ptr += rc;                 nread -= rc;             }         }while(nread);     }while(1);      fprintf(stderr, "Sending EOF\n");     libssh2_channel_send_eof(channel);      fprintf(stderr, "Waiting for EOF\n");     libssh2_channel_wait_eof(channel);      fprintf(stderr, "Waiting for channel to close\n");     libssh2_channel_wait_closed(channel);      libssh2_channel_free(channel);     channel = NULL;      fprintf(stderr, "[%s] has been upload to [%s]\n", localfile, scppath);  shutdown:     if(session)     {         libssh2_session_disconnect(session, "Normal Shutdown ,Thank you for playing");         libssh2_session_free(session);     }       close(sock);     if(local)     {         fclose(local);     }     libssh2_exit();      return 0; }   char* scp_make_file(char *dpath, char *localfile) {     char *p, *str;     char *dfpath = (char *)malloc(128);     p = (char *)strrchr(localfile, '/');     strcpy(dfpath, dpath);     dfpath = strcat(dfpath, p);     str = dfpath;     free(dfpath);     return str; }  void scp_destroy(UserInfo **userinfo) {     if(*userinfo)     {         free(*userinfo);         *userinfo = NULL;     } }   int main() {     UserInfo *userinfo;     userinfo = scp_create("10.8.1.122", "root", "123456", "/tmp");     scp_upload(userinfo, "/home/ssh2/test.c");     scp_destroy(&userinfo);     return 0; }  [root@gnos-x64-dev ssh2]# gcc -o scp scp_.c libssh2.a -lcrypto -lz [root@gnos-x64-dev ssh2]# ./scp  /tmp /home/ssh2/test.c ??A Sending EOF Waiting for EOF Waiting for channel to close [/home/ssh2/test.c] has been upload to [0¤b]

user: user-7
content: 要安全，还要使用_s类型的函数，比如strcat_s, strcpy_s, 内存分配好要判断是否成功。

user: user-8
content: 1，char *p, *str;要初始化。 2，char *dfpath = (char *)malloc(128);确定能分配成功，假如为null了怎么办？ 3，strcpy这个库函数不安全，会溢出，但是使用的时候却不警告，你能保证没有问题了么？ ....