replace word in string

Question

this is an example of what I wanna do I have the following list

[token]
[token1]
[token22]
[token99]
[8token]
[3token3]

and I wanna remove "[" and "]" then replace the word token with my own word. so I have the following code:

char *getToken(char *repl, char *mysrc)
{
    const char *p1 = strstr(mysrc,"[")+1;
    const char *p2 = strstr(p1,"]");
    size_t len = p2-p1;
    char *src = (char*)malloc(sizeof(char)*(len+1));
    strncpy(src,p1,len);
    src[len] = '\0';

    char *find = "token";
    char *found;
    if(strcmp(src,find) == 0)
        return src;
    char *res = malloc(strlen(src) + strlen(repl) + 1);
    if (res == NULL)
        return src;
    found = strstr(src, find);
    /* Search string not found, return the whole of the source */
    if (found == NULL){
        strcpy(res, src);
        return res;
    }
    /* Paste the replacement string in */
    strncpy(res, src, (size_t)(found - src));
    strcat(res, repl);
    strcat(res, found + strlen(find));
    free(src);
    return res;
}

which is working fine except that in some situations I get an X or H in front of the result. like this: Xtest22 instead of test22

Did I do something wrong with strlen? I can't seem to find out where I'm doing wrong.

FYI, that last early return is leaking memory (`src`). Also, `strnlen` is much safer than `strlen`. — pattivacek, Aug 19 '13 at 13:12
You don't have to cast the return value of malloc and you don't have to use sizeof(char) — Alexis, Aug 19 '13 at 13:19
could leaking memory be a reason ? how can I avoid leaking memory ? — Sam Reina, Aug 19 '13 at 13:19

score 4 · Accepted Answer · answered Aug 19 '13 at 13:19

This could happen when the "token" string ends up at the beginning of the string after the removal of the square brackets: in this case, (size_t)(found - src) evaluates to zero, so the call of

strncpy(res, src, (size_t)(found - src));

does not change the res string at all, leaving whatever junk that was there for the following call of strcat to skip before appending. You get lucky that the junk in the res happens to be a short null-terminated string, such as an "X" or an "H". Otherwise, you could get a much longer string of arbitrary characters.

In addition to fixing the above undefined behavior, you should fix a few more things:

Your code does not check the return value of the first malloc.
Your code miscalculates the length of the result: you should subtractl the length of the word "token", because you replace it with the content of repl, i.e. it should be malloc(strlen(src) + strlen(repl) - strlen(find) + 1)
You do not need to cast the return value of malloc in C
You do not need to multiply the length by sizeof(char) (only one of your two mallocs does that)
Your second early return leaks memory.

I assume that you understand how to fix the undefined behavior: all you need is to set `res[0]` to `'\0'` before calling `strncpy`. — Sergey Kalinichenko, Aug 19 '13 at 13:28
it is working perfectly now. thank you! can you give me a hint please about how to avoid memory leak on second return ? — Sam Reina, Aug 19 '13 at 15:07
@SamReina One way to avoid the memory leak would be to `free(res)` and `return src` inside the `if (found == NULL)` conditional. — Sergey Kalinichenko, Aug 19 '13 at 15:20

replace word in string

1 Answers1