COM報錯Run-Time Check Failure，爲什麽？

[kingmax54212008]

我寫的一個COM組件調用一個rf_card_pro.dll裏的fnReadCardMsg接口，接口調用和返回都正確的，但是在我處理數據*bstrUser = cstrUser.AllocSysString(); 報出：Run-Time Check Failure #2 - Stack around the variable 'Card_id' was corrupted.


軟代碼片斷如下：


STDMETHODIMP CrfcardWapper::fn_rf_ReadCardMsg(INT incom, BSTR* bstrUser)
{
AFX_MANAGE_STATE(AfxGetStaticModuleState());
try
{
CString cstrUser = _T("");
CString tmpstr;
LPCTSTR lpszModuleName = _T("rf_card_pro.dll");
HINSTANCE hInstLib = AfxLoadLibrary(lpszModuleName);
Pfn_ReadCardMsg *fnReadCardMsg = NULL;
fnReadCardMsg = (Pfn_ReadCardMsg *)GetProcAddress(hInstLib,(LPCSTR)("ReadCardMsg"));
CHAR Card_id[9];
CHAR Card_no[11];
CHAR limit_money[11];
// hard code for the user id and key
int code = fnReadCardMsg(1,"12345678","1234567876578918",Card_id,Card_no,limit_money);
if( code > 0 )
{
// if return code large than 0, the code is the left money
// Card_id, Card_no, left_money
tmpstr = Card_id;
cstrUser.Append(L"");
cstrUser.Append(L"Card_id=");
cstrUser.Append(tmpstr);
cstrUser.Append(L";");
tmpstr = Card_no;
cstrUser.Append(L"Card_no=");
cstrUser.Append(tmpstr);
cstrUser.Append(L";");
tmpstr.Format(L"%d",code);
cstrUser.Append(L"Left_money=");
cstrUser.Append(tmpstr);
}
*bstrUser = cstrUser.AllocSysString(); // 報錯的地方
}
catch(CException* ex)
{
ex->Delete();
}
return S_OK;
}

[kingmax54212008]

調試CString的cstrUser的數據為Card_id=3000144803;Card_no=00000051;Left_money=11932，具體如下：

- cstrUser "Card_id=3000144803;Card_no=00000051;Left_money=11932" ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t> > >
- ATL::CSimpleStringT<wchar_t,1> "Card_id=3000144803;Card_no=00000051;Left_money=11932" ATL::CSimpleStringT<wchar_t,1>
- m_pszData 0x03aebe68 "Card_id=3000144803;Card_no=00000051;Left_money=11932" wchar_t *

[Yofoo]

Card_id=3000144803;

明显变量 Card_id 有10个字符, 你定义的是 CHAR Card_id[9];

越界了

[oyljerry]

Card_id 数组是否有越界

[kingmax54212008]

Perfect! Very Good, that's right answer!

[Quote=引用 2 楼 zzz3265 的回复:]
Card_id=3000144803;

明显变量 Card_id 有10个字符, 你定义的是 CHAR Card_id[9];

越界了

[/Quote]