大小为8的非法写入,C Valgrind,字符串数组

8

我一直在使用valgrind和gdb,但我无法确定问题出在哪里。在gdb中,跟踪它的过程太复杂了,而在valgrind中,我又没有足够的信息。下面是我的makeargv函数,它将strtok()函数输出的字符串放入数组中,makeargv函数被下面的parse函数调用。我不知道哪里出错了。如果能得到帮助,我会非常感激。

顺便提一句,我对malloc函数很陌生,也不太理解这个概念。我不确定具体什么时候需要malloc。我感觉由于我主要设置常量值,因此不需要使用malloc,但我想知道为什么它不起作用。

makeargv函数:

int makeargv(const char *string, char **argvp) {
    int i = 0;
    int numtokens = 0;
    const char *copy;
    char *buffer = malloc(160*sizeof(char));

    if ((string == NULL) || (delims == NULL) || (argvp == NULL)) {
      return -1;
    }

    argvp = NULL;
    copy = string + strspn(string, delims);
    if ((buffer = malloc(strlen(copy) + 1)) == NULL) {
      return -1;
    }
    strcpy(buffer, copy);
    numtokens = 0;
    if (strtok(buffer, delims) != NULL) {
      for (numtokens = 1; strtok(NULL, delims) != NULL; numtokens++);
    }

    if ((argvp = malloc((numtokens + 2)*sizeof(int))) == NULL) {
      free(buffer);
      return -1;
    }

    if (numtokens == 0) {
      free(buffer);
    }
    else {
      strcpy(buffer, copy);
      *argvp = malloc(16);
      *argvp = strtok(buffer, delims);

      for (i = 2; i < (numtokens*2); i += 2) {
      *(argvp + i) = strtok(NULL, delims);
      //printf("%s\n", strtok(NULL, delims)); /*When I run this the tokens come out
      correctly so I know it isn't a problem with strtok */
  }
}

//  *((argvp) + numtokens) = NULL;
free(buffer);
return numtokens;
}

解析函数
void parse_file(char* filename) {
    char* line = malloc(160*sizeof(char));
    FILE* fp = file_open(filename);
    int i = 0;

    while((line = file_getline(line, fp)) != NULL) {
      char** results = malloc(16*10*sizeof(char));

      if (strlen(line) == 1){
        continue;
      }

      if ((i = makeargv(line, results)) == -1){
        printf("ERROR SOMEWHERE IN MAKEARGV");
        continue;
      } 
    }

    fclose(fp);
    free(line);
}

Valgrind输出

==7309== Memcheck, a memory error detector
==7309== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==7309== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==7309== Command: ./custmake
==7309== 
==7309== Invalid write of size 8
==7309==    at 0x400C23: makeargv (main.c:62)
==7309==    by 0x400CD4: parse_file (main.c:120)
==7309==    by 0x400DFF: main (main.c:172)
==7309==  Address 0x51f25c0 is 16 bytes inside a block of size 20 alloc'd
==7309==    at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x400B76: makeargv (main.c:49)
==7309==    by 0x400CD4: parse_file (main.c:120)
==7309==    by 0x400DFF: main (main.c:172)
==7309== 
==7309== Use of uninitialised value of size 8
==7309==    at 0x4C2BFC2: __GI_strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x4EA2CEB: puts (ioputs.c:37)
==7309==    by 0x400D09: parse_file (main.c:128)
==7309==    by 0x400DFF: main (main.c:172)
==7309== 
==7309== Invalid read of size 1
==7309==    at 0x4C2BFC2: __GI_strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x4EA2CEB: puts (ioputs.c:37)
==7309==    by 0x400D09: parse_file (main.c:128)
==7309==    by 0x400DFF: main (main.c:172)
==7309==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==7309== 
==7309== 
==7309== Process terminating with default action of signal 11 (SIGSEGV)
==7309==  Access not within mapped region at address 0x0
==7309==    at 0x4C2BFC2: __GI_strlen (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x4EA2CEB: puts (ioputs.c:37)
==7309==    by 0x400D09: parse_file (main.c:128)
==7309==    by 0x400DFF: main (main.c:172)
==7309==  If you believe this happened as a result of a stack
==7309==  overflow in your program's main thread (unlikely but
==7309==  possible), you can try to increase the size of the
==7309==  main thread stack using the --main-stacksize= flag.
==7309==  The main thread stack size used in this run was 8388608.
==7309== 
==7309== HEAP SUMMARY:
==7309==     in use at exit: 1,084 bytes in 6 blocks
==7309==   total heap usage: 7 allocs, 1 frees, 1,100 bytes allocated
==7309== 
==7309== 16 bytes in 1 blocks are definitely lost in loss record 1 of 6
==7309==    at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x400BCB: makeargv (main.c:59)
==7309==    by 0x400CD4: parse_file (main.c:120)
==7309==    by 0x400DFF: main (main.c:172)
==7309== 
==7309== 20 bytes in 1 blocks are definitely lost in loss record 2 of 6
==7309==    at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x400B76: makeargv (main.c:49)
==7309==    by 0x400CD4: parse_file (main.c:120)
==7309==    by 0x400DFF: main (main.c:172)
==7309== 
==7309== 160 bytes in 1 blocks are definitely lost in loss record 5 of 6
==7309==    at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7309==    by 0x400A6E: makeargv (main.c:32)
==7309==    by 0x400CD4: parse_file (main.c:120)
==7309==    by 0x400DFF: main (main.c:172)
==7309== 
==7309== LEAK SUMMARY:
==7309==    definitely lost: 196 bytes in 3 blocks
==7309==    indirectly lost: 0 bytes in 0 blocks
==7309==      possibly lost: 0 bytes in 0 blocks
==7309==    still reachable: 888 bytes in 3 blocks
==7309==         suppressed: 0 bytes in 0 blocks
==7309== Reachable blocks (those to which a pointer was found) are not shown.
==7309== To see them, rerun with: --leak-check=full --show-reachable=yes
==7309== 
==7309== For counts of detected and suppressed errors, rerun with: -v
==7309== Use --track-origins=yes to see where uninitialised values come from
==7309== ERROR SUMMARY: 7 errors from 6 contexts (suppressed: 2 from 2)
Segmentation fault (core dumped)

https://dev59.com/33I-5IYBdhLWcg3wN1hD - Suvarna Pattayil
注意:在那个函数中你有一个非常严重的内存泄漏问题。你将会极其浪费地泄露160个字符的分配空间。 - WhozCraig
是的,我计划修复很多内存泄漏问题。我看到有很多东西可以释放,但我只是确保每件事情都在之前分配了一些东西,因为当我不这样做时,它似乎会出现奇怪的问题。我只想知道为什么即使所有东西都有充足和丰富的内存,它也找不到任何空间。 - user3321556
1个回答

17

makeargv 函数中的 argvp 变量是一个指针数组,但是当你为它分配内存时,你使用了 sizeof(int),这只会在 64 位系统上占用四个字节,而指针将占用 8 个字节。

结果你写入了数组末尾以外的部分 - 这就是为什么它报告你在一个 20 字节块的偏移量为 16 的位置写入了 8 个字节,因此重叠了该块的末尾 4 个字节。

在分配 argvp 数组时,请使用 sizeof(char*) 来获取指针的正确大小。


网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接