前置知识

在分析fread函数时，应该先明确一下输入缓冲区是怎么来的。

首先fread函数会先将数据读到输入缓冲区中，然后从输入缓冲区中执行memcpy函数，拷贝一定字节的数据到我们指定的内存地址上。而这个输入缓冲区是从哪到哪呢？由两个指针分别声明了这片区域的开始和结束，他们分别叫做_IO_read_base和_IO_read_end，他们之间的区域就是输入缓冲区。这样看起来似乎还需要一个输出缓冲区，难道需要malloc申请两个堆块来分别表示输入缓冲区和输出缓冲区么？非也，其实malloc函数自始至终只申请了一个堆块，这个堆块的区域也叫做reserve area，而_IO_buf_base和_IO_buf_end两个指针则分别声明了这个reserve area的始末。然后将 _IO_read_ptr; _IO_read_end; _IO_read_base; _IO_write_base; _IO_write_ptr; _IO_write_end;这六个指针全部初始化为了_IO_buf_base的值，现在的输入缓冲区和输出缓冲区还不存在(因为现在 _IO_read_end和 _IO_read_base的值相同)，以输入缓冲区为例，读入数据时是执行了系统调用read，而此时的数据是在reserve area中，紧接着 _IO_read_end就会加上刚刚读入的数据的个数，那么此时 _IO_read_end和 _IO_read_base的值变的不同了。而现在这二者之间的区域就成为输入缓冲区

再提一下_IO_FILE结构体中的一些指针(如下)

1
char* _IO_read_ptr;  /* Current read pointer */
2
char* _IO_read_end;  /* End of get area. */
3
char* _IO_read_base;  /* Start of putback+get area. */
4
char* _IO_write_base;  /* Start of put area. */
5
char* _IO_write_ptr;  /* Current put pointer. */
6
char* _IO_write_end;  /* End of put area. */
7
char* _IO_buf_base;  /* Start of reserve area. */
8
char* _IO_buf_end;  /* End of reserve area. */

其中_IO_buf_base 和 _IO_buf_end两个指针的作用分别是标明reserve area的始末。_IO_read_base 和 _IO_read_end两个指针的作用分别是标明输入缓冲区的始末(write那两个指针同理)，现在假设有一个30字节的flag文件，然后我连续执行两次fread函数，每次从文件中只读10字节，那么第二次执行fread函数是从哪开始读呢，很明显并不是文件的开始来读取了，而是接着上回fread函数读到的位置，继续读10字节数据。但我们怎么去记录上回fread函数读到哪了呢，这就需要用到_IO_read_ptr指针了，它是来记录下一次数据应该从输入缓冲区的哪里开始读了。也就是说_IO_read_base 和 _IO_read_ptr 之间的区域是已经使用了的输入缓冲区，而 _IO_read_ptr 和 _IO_read_end之间的区域是输入缓冲区的剩余部分(也就是还未使用部分)。

通过上面这两段文字，应该可以对刚学习IO的师傅对_IO_FILE结构体中表示缓冲区位置的指针有一些了解了。

同时这次还要提到vtable，它是_IO_FILE_plus结构体中的一个字段，也是一个虚表指针。它指向了_IO_jump_t结构体

1
struct _IO_FILE_plus
2
{
3
  _IO_FILE file;
4
  const struct _IO_jump_t *vtable;
5
};

对于_IO_jump_t结构体，我目前的理解它就是一个跳转表，这里放的都是函数指针。通过不同的偏移获取不同的函数指针，然后将其调用。

1
struct _IO_jump_t
2
{
3
    JUMP_FIELD(size_t, __dummy);
4
    JUMP_FIELD(size_t, __dummy2);
5
    JUMP_FIELD(_IO_finish_t, __finish);
6
    JUMP_FIELD(_IO_overflow_t, __overflow);
7
    JUMP_FIELD(_IO_underflow_t, __underflow);
8
    JUMP_FIELD(_IO_underflow_t, __uflow);
9
    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);
10
    /* showmany */
11
    JUMP_FIELD(_IO_xsputn_t, __xsputn);
12
    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);
13
    JUMP_FIELD(_IO_seekoff_t, __seekoff);
14
    JUMP_FIELD(_IO_seekpos_t, __seekpos);
15
    JUMP_FIELD(_IO_setbuf_t, __setbuf);
16
    JUMP_FIELD(_IO_sync_t, __sync);
17
    JUMP_FIELD(_IO_doallocate_t, __doallocate);
18
    JUMP_FIELD(_IO_read_t, __read);
19
    JUMP_FIELD(_IO_write_t, __write);
20
    JUMP_FIELD(_IO_seek_t, __seek);
21
    JUMP_FIELD(_IO_close_t, __close);
22
    JUMP_FIELD(_IO_stat_t, __stat);
23
    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);
24
    JUMP_FIELD(_IO_imbue_t, __imbue);
25
#if 0
26
    get_column;
27
    set_column;
28
#endif
29
};

整体流程

Pasted image 20260409222325 Pasted image 20260409215903

Pasted image 20260409215924

源码解析

实际fread进入的是_IO_fread

1
#include "libioP.h"
2

3
size_t
4
_IO_fread (void *buf, size_t size, size_t count, FILE *fp)
5
{
6
  size_t bytes_requested = size * count;
7
  size_t bytes_read;
8
  CHECK_FILE (fp, 0);
9
  if (bytes_requested == 0)
10
  return 0;
11
  _IO_acquire_lock (fp);
12
  bytes_read = _IO_sgetn (fp, (char *) buf, bytes_requested);
13
  _IO_release_lock (fp);
14
  return bytes_requested == bytes_read ? count : bytes_read / size;
15
}
16
libc_hidden_def (_IO_fread)
17
weak_alias (_IO_fread, fread)
18

19
# ifndef _IO_MTSAFE_IO
20
strong_alias (_IO_fread, __fread_unlocked)
21
libc_hidden_def (__fread_unlocked)
22
weak_alias (_IO_fread, fread_unlocked)
23
# endif

Pasted image 20260408104521

进入_IO_sgetn

1
size_t
2
_IO_sgetn (FILE *fp, void *data, size_t n)
3
{
4
  /* FIXME handle putback buffer here! */
5
  return _IO_XSGETN (fp, data, n);
6
}
7
libc_hidden_def (_IO_sgetn)

IO_JUMPS_FUNC(THIS)返回的是_IO_jump_t地址,对应FILE结构体的vtable字段,由于JUMP2第一个参数就是__xsgetn，所以->FUNC访问的就是_IO_jump_t结构体中__xsgetn,采用的是vtable + offset的形式(借此可以伪造vtable,实现任意合法执行)

1
#define _IO_XSGETN(FP, DATA, N) JUMP2 (__xsgetn, FP, DATA, N)
2
#define JUMP2(FUNC, THIS, X1, X2) (_IO_JUMPS_FUNC(THIS)->FUNC) (THIS, X1, X2)
3
# define _IO_JUMPS_FUNC(THIS) (IO_validate_vtable (_IO_JUMPS_FILE_plus (THIS)))
4
static inline const struct _IO_jump_t *
5
IO_validate_vtable (const struct _IO_jump_t *vtable)
6
{
7
  uintptr_t ptr = (uintptr_t) vtable;
8
  uintptr_t offset = ptr - (uintptr_t) &__io_vtables;
9
  if (__glibc_unlikely (offset >= IO_VTABLES_LEN))
10
  /* The vtable pointer is not in the expected section. Use the
11
  slow path, which will terminate the process if necessary. */
12
  _IO_vtable_check ();
13
  return vtable;
14
}

1
void attribute_hidden
2
_IO_vtable_check (void)
3
{
4
#ifdef SHARED
5
  /* Honor the compatibility flag. */
6
  void (*flag) (void) = atomic_load_relaxed (&IO_accept_foreign_vtables);
7
  PTR_DEMANGLE (flag);
8
  if (flag == &_IO_vtable_check)
9
  return;
10

11
/* In case this libc copy is in a non-default namespace, we always
12
need to accept foreign vtables because there is always a
13
possibility that FILE * objects are passed across the linking
14
boundary. */
15
  {
16
    Dl_info di;
17
    struct link_map *l;
18
    if (!rtld_active ()
19
    || (_dl_addr (_IO_vtable_check, &di, &l, NULL) != 0
20
    && l->l_ns != LM_ID_BASE))
21
    return;
22
  }
23

24

25
#else /* !SHARED */
26
  /* We cannot perform vtable validation in the static dlopen case
27
  because FILE * handles might be passed back and forth across the
28
  boundary. Therefore, we disable checking in this case. */
29
  if (__dlopen != NULL)
30
    return;
31
#endif
32

33
__libc_fatal ("Fatal error: glibc detected an invalid stdio handle\n");
34

35
}

1
0x7ffff7e26661 <_IO_sgetn+33>              jmp    qword ptr [rax + 0x40]      <__GI__IO_file_xsgetn>

Pasted image 20260408150628 Pasted image 20260408150513

进入__GI__IO_file_xsgetn

1
size_t
2
_IO_file_xsgetn (FILE *fp, void *data, size_t n)
3
{
4
  size_t want, have;
5
  ssize_t count;
6
  char *s = data;
7
  want = n;
8

9

10
  /*第一部分*/
11
  //如果没有申请buf,_IO_doallocbuf内部malloc一个
12
  if (fp->_IO_buf_base == NULL)
13
  {
14
  /* Maybe we already have a push back pointer. */
15
    if (fp->_IO_save_base != NULL)
16
    {
17
      _IO_free_backup_buf (fp, fp->_IO_save_base);
18
      fp->_flags &= ~_IO_IN_BACKUP;
19
    }
20
  _IO_doallocbuf (fp);
21
  }
22

23
  while (want > 0)
24
  {   /*第二部分*/
25
    have = fp->_IO_read_end - fp->_IO_read_ptr;
26
    if (want <= have)
27
    {
28
      memcpy (s, fp->_IO_read_ptr, want);
29
      fp->_IO_read_ptr += want;
30
      want = 0;
31
    }
32
    else
33
    {
34
      if (have > 0)
35
      {
36
        s = __mempcpy (s, fp->_IO_read_ptr, have);
37
        want -= have;
38
        fp->_IO_read_ptr += have;
39
      }
40

41
      /*第三部分*/
42
      /* Check for backup and repeat */
43
      if (_IO_in_backup (fp))
44
      {
45
        _IO_switch_to_main_get_area (fp);
46
        continue;
47
      }
48

49

50
      /* If we now want less than a buffer, underflow and repeat
51
      the copy. Otherwise, _IO_SYSREAD directly to
52
      the user buffer. */
53
      /*第四部分*/
54
      if (fp->_IO_buf_base
55
      && want < (size_t) (fp->_IO_buf_end - fp->_IO_buf_base))
56
      {
57
        if (__underflow (fp) == EOF)
58
        break;
59
        continue;
60
      }
61

62
      /* These must be set before the sysread as we might longjmp out
63
      waiting for input. */
64
      _IO_setg (fp, fp->_IO_buf_base, fp->_IO_buf_base, fp->_IO_buf_base);
65
      _IO_setp (fp, fp->_IO_buf_base, fp->_IO_buf_base);
66

67
      /* Try to maintain alignment: read a whole number of blocks. */
68
      count = want;
69
      if (fp->_IO_buf_base)
70
      {
71
        size_t block_size = fp->_IO_buf_end - fp->_IO_buf_base;
72
        if (block_size >= 128)
73
        count -= want % block_size;
74
      }
75

76
      count = _IO_SYSREAD (fp, s, count);
77
      if (count <= 0)
78
      {
79
        if (count == 0)
80
          fp->_flags |= _IO_EOF_SEEN;
81
        else
82
          fp->_flags |= _IO_ERR_SEEN;
83
        break;
84
      }
85

86
      s += count;
87
      want -= count;
88
      if (fp->_offset != _IO_pos_BAD)
89
        _IO_pos_adjust (fp->_offset, count);
90
    }
91
  }
92

93
  return n - want;
94
}
95
libc_hidden_def (_IO_file_xsgetn)

第一部分 3.1 进入_IO_doallocbuf Pasted image 20260409222749

1
void
2
_IO_doallocbuf (FILE *fp)
3
{
4
  if (fp->_IO_buf_base)
5
  return;
6
  if (!(fp->_flags & _IO_UNBUFFERED) || fp->_mode > 0)
7
  if (_IO_DOALLOCATE (fp) != EOF)
8
  return;
9
  _IO_setb (fp, fp->_shortbuf, fp->_shortbuf+1, 0);
10
}
11
libc_hidden_def (_IO_doallocbuf)

3.2通过vtable进入_IO_file_doallocate Pasted image 20260409223643 3.3进入vtable中的_IO_file_stat函数，也是通过vtable+offset Pasted image 20260408145106 3.4调用fstat64，这个系统调用是来获取文件状态，并且初始化st结构体的 Pasted image 20260408145224 可以看到此时的st_blksize为4096 Pasted image 20260408150041 3.5而这个st_blksize也就是接下来malloc申请的内存大小 Pasted image 20260408150213 3.6调用_IO_setb ,这个函数主要就是对_IO_buf_base和_IO_buf_end指针进行赋值

1
void
2
_IO_setb (FILE *f, char *b, char *eb, int a)
3
{
4
  if (f->_IO_buf_base && !(f->_flags & _IO_USER_BUF))
5
    free (f->_IO_buf_base);
6
  f->_IO_buf_base = b;
7
  f->_IO_buf_end = eb;
8
  if (a)
9
    f->_flags &= ~_IO_USER_BUF;
10
  else
11
    f->_flags |= _IO_USER_BUF;
12
}
13
libc_hidden_def (_IO_setb)

执行前 Pasted image 20260408151353 执行后 Pasted image 20260408155610 第二部分 have是剩余的缓冲区大小,want是需要读入的大小如果want小于等于have直接memcpy 如果have还有剩余但是want大于have，把能读的先读完

1
    have = fp->_IO_read_end - fp->_IO_read_ptr;
2
    if (want <= have)
3
    {
4
      memcpy (s, fp->_IO_read_ptr, want);
5
      fp->_IO_read_ptr += want;
6
      want = 0;
7
    }
8
    else
9
    {
10
      if (have > 0)
11
      {
12
        s = __mempcpy (s, fp->_IO_read_ptr, have);
13
        want -= have;
14
        fp->_IO_read_ptr += have;
15
      }

第三部分

如果当前处于备用的缓冲区，切换为主缓冲区

1
  /* Check for backup and repeat */
2
      if (_IO_in_backup (fp))
3
      {
4
        _IO_switch_to_main_get_area (fp);
5
        continue;
6
      }

1
#define _IO_in_backup(fp) ((fp)->_flags & _IO_IN_BACKUP)

1
void
2
_IO_switch_to_main_get_area (FILE *fp)
3
{
4
  char *tmp;
5
  fp->_flags &= ~_IO_IN_BACKUP;
6
  /* Swap _IO_read_end and _IO_save_end. */
7
  tmp = fp->_IO_read_end;
8
  fp->_IO_read_end = fp->_IO_save_end;
9
  fp->_IO_save_end= tmp;
10
  /* Swap _IO_read_base and _IO_save_base. */
11
  tmp = fp->_IO_read_base;
12
  fp->_IO_read_base = fp->_IO_save_base;
13
  fp->_IO_save_base = tmp;
14
  /* Set _IO_read_ptr. */
15
  fp->_IO_read_ptr = fp->_IO_read_base;
16
}

第四部分 __underflow 它先是经过一些检查后，去调用了vtable中的_IO_file_underflow函数

1
int
2
__underflow (FILE *fp)
3
{
4
  if (_IO_vtable_offset (fp) == 0 && _IO_fwide (fp, -1) != -1)
5
    return EOF;
6
  if (fp->_mode == 0)
7
    _IO_fwide (fp, -1);
8
  if (_IO_in_put_mode (fp))
9
    if (_IO_switch_to_get_mode (fp) == EOF)
10
      return EOF;
11
  if (fp->_IO_read_ptr < fp->_IO_read_end)
12
    return *(unsigned char *) fp->_IO_read_ptr;
13
  if (_IO_in_backup (fp))
14
  {
15
    _IO_switch_to_main_get_area (fp);
16
    if (fp->_IO_read_ptr < fp->_IO_read_end)
17
      return *(unsigned char *) fp->_IO_read_ptr;
18
    }
19
  if (_IO_have_markers (fp))
20
  {
21
    if (save_for_backup (fp, fp->_IO_read_end))
22
      return EOF;
23
  }
24
  else if (_IO_have_backup (fp))
25
    _IO_free_backup_area (fp);
26
  return _IO_UNDERFLOW (fp);
27
}
28
libc_hidden_def (__underflow)

在最后_IO_UNDERFLOW，通过vtable调用了_IO_file_underflow函数 Pasted image 20260408211800

1
int
2
_IO_new_file_underflow (FILE *fp)
3
{
4
  ssize_t count;
5
  /* C99 requires EOF to be "sticky". */
6
  if (fp->_flags & _IO_EOF_SEEN)
7
    return EOF;
8
  if (fp->_flags & _IO_NO_READS)
9
  {
10
    fp->_flags |= _IO_ERR_SEEN;
11
    __set_errno (EBADF);
12
    return EOF;
13
  }
14
  if (fp->_IO_read_ptr < fp->_IO_read_end)
15
    return *(unsigned char *) fp->_IO_read_ptr;
16
  if (fp->_IO_buf_base == NULL)
17
  {
18
    /* Maybe we already have a push back pointer. */
19
    if (fp->_IO_save_base != NULL)
20
    {
21
      _IO_free_backup_buf (fp, fp->_IO_save_base);
22
      fp->_flags &= ~_IO_IN_BACKUP;
23
    }
24
    _IO_doallocbuf (fp);
25
  }
26
  /* FIXME This can/should be moved to genops ?? */
27
  if (fp->_flags & (_IO_LINE_BUF|_IO_UNBUFFERED))
28
  {
29

30
  /* We used to flush all line-buffered stream. This really isn't
31
  required by any standard. My recollection is that
32
  traditional Unix systems did this for stdout. stderr better
33
  not be line buffered. So we do just that here
34
  explicitly. --drepper */
35

36
    _IO_acquire_lock (stdout);
37
    if ((stdout->_flags & (_IO_LINKED | _IO_NO_WRITES | _IO_LINE_BUF))
38
    == (_IO_LINKED | _IO_LINE_BUF))
39
      _IO_OVERFLOW (stdout, EOF);
40
    _IO_release_lock (stdout);
41
  }
42

43
  _IO_switch_to_get_mode (fp);
44

45
  /* This is very tricky. We have to adjust those
46
  pointers before we call _IO_SYSREAD () since
47
  we may longjump () out while waiting for
48
  input. Those pointers may be screwed up. H.J. */
49

50
  fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_buf_base;
51
  fp->_IO_read_end = fp->_IO_buf_base;
52
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end
53
  = fp->_IO_buf_base;
54

55
  count = _IO_SYSREAD (fp, fp->_IO_buf_base,
56
  fp->_IO_buf_end - fp->_IO_buf_base);
57
  if (count <= 0)
58
  {
59
    if (count == 0)
60
      fp->_flags |= _IO_EOF_SEEN;
61
    else
62
      fp->_flags |= _IO_ERR_SEEN, count = 0;
63
  }
64
  fp->_IO_read_end += count;
65
  if (count == 0)
66
  {
67

68
  /* If a stream is read to EOF, the calling application may switch active
69
  handles. As a result, our offset cache would no longer be valid, so
70
  unset it. */
71

72
    fp->_offset = _IO_pos_BAD;
73
    return EOF;
74
  }
75
  if (fp->_offset != _IO_pos_BAD)
76
    _IO_pos_adjust (fp->_offset, count);
77
  return *(unsigned char *) fp->_IO_read_ptr;
78
}
79

80
libc_hidden_ver (_IO_new_file_underflow, _IO_file_underflow)

上来就是很多检查，不过根据程序当前的状态，直接跳过了前面的检查。先去执行了_IO_switch_to_get_mode 函数可以看到是给_IO_read_base赋值，其他也赋值了不过都是0

1
int
2
_IO_switch_to_get_mode (FILE *fp)
3
{
4
  if (fp->_IO_write_ptr > fp->_IO_write_base)
5
    if (_IO_OVERFLOW (fp, EOF) == EOF)
6
      return EOF;
7
  if (_IO_in_backup (fp))
8
    fp->_IO_read_base = fp->_IO_backup_base;
9
  else
10
  {
11
    fp->_IO_read_base = fp->_IO_buf_base;
12
    if (fp->_IO_write_ptr > fp->_IO_read_end)
13
      fp->_IO_read_end = fp->_IO_write_ptr;
14
  }
15
  fp->_IO_read_ptr = fp->_IO_write_ptr;
16

17
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end = fp->_IO_read_ptr;
18

19
  fp->_flags &= ~_IO_CURRENTLY_PUTTING;
20
  return 0;
21
}
22

23
libc_hidden_def (_IO_switch_to_get_mode)

执行前 Pasted image 20260408213537 执行后 Pasted image 20260408214114

接下来就是赋值

1
fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_buf_base;
2
  fp->_IO_read_end = fp->_IO_buf_base;
3
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end
4
  = fp->_IO_buf_base;

执行后 Pasted image 20260408214358 然后是执行，通过vtavle进入_IO_file_read Pasted image 20260408214540

1
count = _IO_SYSREAD (fp, fp->_IO_buf_base,

内部调用了read，读入_IO_read_ptr Pasted image 20260408214735 读入后，现在_IO_read_end没有变 Pasted image 20260408214909 执行到

1
fp->_IO_read_end += count;

的时候才被改变 Pasted image 20260408215248 之后再次循环，不断改变_IO_read_ptr的值 Pasted image 20260408215408 直到结束，退出

Thanks for reading!

fread源码解析

周四 4月 09 2026

2567 字 · 20 分钟

Pwn IO