linux:valgrind使用-尊龙官方平台

linux:valgrind使用

el/2024/3/25 17:05:24

linux:valgrind使用

本着实践主义和实用主义,开始学习。

测试环境:centos 7

[test1280@localhost 20170504]$ uname -a
linux localhost.localdomain 3.10.0-327.el7.x86_64 #1 smp thu nov 19 22:10:57 utc 2015 x86_64 x86_64 x86_64 gnu/linux

valgrind的man手册是这么介绍的:

a suite of tools for debugging and profiling programs

一套用于调试和分析程序的工具

valgrind命令使用方式:

valgrind [valgrind-options][your-program][your-program-options]

下面是我们公司里一个大牛写的脚本,大家可以参考下:

文件名:valmem

#!/bin/sh
# $id$
#
if [ -z "$1" ]; thenecho "usage: `basename $0` prog"exit 1
fi
valgrind --tool=memcheck \
--leak-check=full \
--time-stamp=yes \
--show-reachable=yes \
--track-origins=yes \
--trace-children=no \
--leak-resolution=med \
--track-fds=yes \
--log-file=myvalmem.log \
"$@"

解释下各个含义:

–tool=memcheck:

--tool= [default: memcheck]
run the valgrind tool called toolname, e.g. memcheck, cachegrind, callgrind, helgrind, drd, massif, lackey, none, exp-sgcheck, exp-bbv, exp-dhat, etc.
# 默认是memcheck

–leak-check:

--leak-check= [default: summary]
when enabled, search for memory leaks when the client program finishes.
if set to summary, it says how many leaks occurred.
if set to full or yes, each individual leak will be shown in detail and/or counted as an error.
# 看得仔细一些,把每个都单独列出来。

–time-stamp:

--time-stamp= [default: no]
when enabled, each message is preceded with an indication of the elapsed wallclock time since startup, expressed as days, hours, minutes, seconds and milliseconds.
# 说白了就是个时间戳。
# 此处要注意,是自启动进程以来的时间。

–show-reachable:

--show-reachable=<yes|no> , --show-possibly-lost=<yes|no>
these options provide an alternative way to specify the leak kinds to show:
--show-reachable=no --show-possibly-lost=yes is equivalent to --show-leak-kinds=definite,possible.
--show-reachable=no --show-possibly-lost=no is equivalent to --show-leak-kinds=definite.
--show-reachable=yes is equivalent to --show-leak-kinds=all.
# 我们这里是yes,代表显示所有类型。

–track-origins:

--track-origins= [default: no]
when set to yes, memcheck keeps track of the origins of all uninitialised values.
then, when an uninitialised value error is reported, memcheck will try to show the origin of the value.
# 跟踪所有未初始化值的起始位置

–trace-children:

--trace-children= [default: no]
when enabled, valgrind will trace into sub-processes initiated via the exec system call. this is necessary for multi-process programs.
# 启用后,valgrind将跟踪通过exec系统调用启动的子进程。 这对于多进程程序是必需的。

–leak-resolution:

--leak-resolution= [default: high]

–track-fds=yes:

--track-fds= [default: no]
when enabled, valgrind will print out a list of open file descriptors on exit or on request.
# 追踪文件描述符。

–log-file:

--log-file=
specifies that valgrind should send all of its messages to the specified file.
# 后面还以一堆,有三种形式啥啥啥的。
# 这里使用的是直接写一个名字,对,就是你心里想的那样。

脚本使用方式:

[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ ll
total 24
-rwxrwxr-x. 1 test1280 test1280 8500 may  4 02:24 main
-rw-rw-r--. 1 test1280 test1280   66 may  4 02:19 main.c
-rw-r--r--. 1 test1280 test1280 1527 may  4 02:35 myvalmem.log
-rwxr-xr-x. 1 test1280 test1280  291 may  4 02:29 valmem

valmem是脚本名字;main是可执行文件。

ps:你当然可以使用命令行加上一长串的选项去使用valgrind(或alias),使用脚本只不过看起来简洁点。

下面开始各种各样的测试!


illegal read / illegal write errors

非法读写错误。

可能出现的情景:

对一个已经释放(free)的地址进行读写。

sample 1:

#include 
#include void fun2()
{char *p = (char *)malloc(10);free(p);char ch = *p; 
}void fun1()
{fun2();
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ !g
gcc -o main main.c 
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 3017== memcheck, a memory error detector
==00:00:00:00.000 3017== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 3017== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 3017== command: ./main
==00:00:00:00.000 3017== parent pid: 3016
==00:00:00:00.000 3017== 
==00:00:00:00.247 3017== invalid read of size 1
==00:00:00:00.247 3017==    at 0x4005a6: fun2 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005bb: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005cb: main (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==  address 0x51f6040 is 0 bytes inside a block of size 10 free'd
==00:00:00:00.247 3017==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.247 3017==    by 0x4005a1: fun2 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005bb: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005cb: main (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==  block was alloc'd at
==00:00:00:00.247 3017==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.247 3017==    by 0x400591: fun2 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005bb: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005cb: main (in /home/test1280/20170504/main)
==00:00:00:00.247 3017== 
==00:00:00:00.267 3017== 
==00:00:00:00.267 3017== file descriptors: 4 open at exit.
==00:00:00:00.267 3017== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.268 3017==    
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== open file descriptor 2: /dev/pts/0
==00:00:00:00.268 3017==    
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== open file descriptor 1: /dev/pts/0
==00:00:00:00.268 3017==    
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== open file descriptor 0: /dev/pts/0
==00:00:00:00.268 3017==    
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== heap summary:
==00:00:00:00.268 3017==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.268 3017==   total heap usage: 1 allocs, 1 frees, 10 bytes allocated
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== all heap blocks were freed -- no leaks are possible
==00:00:00:00.268 3017== 
==00:00:00:00.268 3017== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.268 3017== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

关键是这个地方:

==00:00:00:00.247 3017== invalid read of size 1
==00:00:00:00.247 3017==    at 0x4005a6: fun2 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005bb: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005cb: main (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==  address 0x51f6040 is 0 bytes inside a block of size 10 free'd
==00:00:00:00.247 3017==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.247 3017==    by 0x4005a1: fun2 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005bb: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.247 3017==    by 0x4005cb: main (in /home/test1280/20170504/main)

use of uninitialised values

使用未初始化的值,有两种情况:

local variables in procedures which have not been initialised.

局部变量未初始化。

sample 2:

#include 
#include int main()
{int num;int result;if (num == 1)result = 1;elseresult = 2;return 0;
}
[test1280@localhost 20170504]$ !g
gcc -o main main.c 
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 3253== memcheck, a memory error detector
==00:00:00:00.000 3253== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 3253== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 3253== command: ./main
==00:00:00:00.000 3253== parent pid: 3252
==00:00:00:00.000 3253== 
==00:00:00:00.280 3253== conditional jump or move depends on uninitialised value(s)
==00:00:00:00.280 3253==    at 0x4004f8: main (in /home/test1280/20170504/main)
==00:00:00:00.280 3253==  uninitialised value was created by a stack allocation
==00:00:00:00.280 3253==    at 0x4004f0: main (in /home/test1280/20170504/main)
==00:00:00:00.280 3253== 
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== file descriptors: 4 open at exit.
==00:00:00:00.299 3253== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.299 3253==    
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== open file descriptor 2: /dev/pts/0
==00:00:00:00.299 3253==    
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== open file descriptor 1: /dev/pts/0
==00:00:00:00.299 3253==    
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== open file descriptor 0: /dev/pts/0
==00:00:00:00.299 3253==    
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== heap summary:
==00:00:00:00.299 3253==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.299 3253==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== all heap blocks were freed -- no leaks are possible
==00:00:00:00.299 3253== 
==00:00:00:00.299 3253== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.299 3253== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

关键是这个地方:

==00:00:00:00.280 3253== conditional jump or move depends on uninitialised value(s)
==00:00:00:00.280 3253==    at 0x4004f8: main (in /home/test1280/20170504/main)
==00:00:00:00.280 3253==  uninitialised value was created by a stack allocation
==00:00:00:00.280 3253==    at 0x4004f0: main (in /home/test1280/20170504/main)

the contents of heap blocks (allocated with malloc, new, or a similar function) before you (or a constructor) write something there.

动态malloc/new出来的空间,没有向里面写入数据直接读取也会出现这个log。

sample 3:

#include 
#include int main()
{int *pnum = (int *)malloc(sizeof(int));int result;if (*pnum == 1)result = 1;elseresult = 0;free(pnum);return 0;
}
[test1280@localhost 20170504]$ !g
gcc -o main main.c 
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 3438== memcheck, a memory error detector
==00:00:00:00.000 3438== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 3438== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 3438== command: ./main
==00:00:00:00.000 3438== parent pid: 3437
==00:00:00:00.000 3438== 
==00:00:00:00.228 3438== conditional jump or move depends on uninitialised value(s)
==00:00:00:00.228 3438==    at 0x40059f: main (in /home/test1280/20170504/main)
==00:00:00:00.228 3438==  uninitialised value was created by a heap allocation
==00:00:00:00.228 3438==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.228 3438==    by 0x400591: main (in /home/test1280/20170504/main)
==00:00:00:00.228 3438== 
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== file descriptors: 4 open at exit.
==00:00:00:00.247 3438== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.247 3438==    
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== open file descriptor 2: /dev/pts/0
==00:00:00:00.247 3438==    
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== open file descriptor 1: /dev/pts/0
==00:00:00:00.247 3438==    
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== open file descriptor 0: /dev/pts/0
==00:00:00:00.247 3438==    
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== heap summary:
==00:00:00:00.247 3438==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.247 3438==   total heap usage: 1 allocs, 1 frees, 4 bytes allocated
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== all heap blocks were freed -- no leaks are possible
==00:00:00:00.247 3438== 
==00:00:00:00.247 3438== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.247 3438== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

to see information on the sources of uninitialised data in your program, use the –track-origins=yes option. this makes memcheck run more slowly, but can make it much easier to track down the root causes of uninitialised value errors.

可以使用–track-origins=yes来追踪根源(未初始化值)。


use of uninitialised or unaddressable values in system calls

在系统调用中使用未初始化或不可寻址的值。

sample 4:

#include 
#include 
#include int main()
{char* arr  = malloc(10);int*  arr2 = malloc(sizeof(int));write( 1 /* stdout */, arr, 10 );exit(arr2[0]);
}
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 3750== memcheck, a memory error detector
==00:00:00:00.000 3750== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 3750== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 3750== command: ./main
==00:00:00:00.000 3750== parent pid: 3749
==00:00:00:00.000 3750== 
==00:00:00:00.242 3750== syscall param write(buf) points to uninitialised byte(s)
==00:00:00:00.242 3750==    at 0x4f1ca30: __write_nocancel (in /usr/lib64/libc-2.17.so)
==00:00:00:00.242 3750==    by 0x4005f9: main (in /home/test1280/20170504/main)
==00:00:00:00.242 3750==  address 0x51f6040 is 0 bytes inside a block of size 10 alloc'd
==00:00:00:00.242 3750==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.242 3750==    by 0x4005d1: main (in /home/test1280/20170504/main)
==00:00:00:00.242 3750==  uninitialised value was created by a heap allocation
==00:00:00:00.242 3750==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.242 3750==    by 0x4005d1: main (in /home/test1280/20170504/main)
==00:00:00:00.242 3750== 
==00:00:00:00.250 3750== syscall param exit_group(status) contains uninitialised byte(s)
==00:00:00:00.250 3750==    at 0x4ef2789: _exit (in /usr/lib64/libc-2.17.so)
==00:00:00:00.250 3750==    by 0x4e6de2a: __run_exit_handlers (in /usr/lib64/libc-2.17.so)
==00:00:00:00.250 3750==    by 0x4e6deb4: exit (in /usr/lib64/libc-2.17.so)
==00:00:00:00.250 3750==    by 0x400606: main (in /home/test1280/20170504/main)
==00:00:00:00.250 3750==  uninitialised value was created by a heap allocation
==00:00:00:00.250 3750==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.250 3750==    by 0x4005df: main (in /home/test1280/20170504/main)
==00:00:00:00.250 3750== 
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== file descriptors: 4 open at exit.
==00:00:00:00.262 3750== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.262 3750==    
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== open file descriptor 2: /dev/pts/0
==00:00:00:00.262 3750==    
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== open file descriptor 1: /dev/pts/0
==00:00:00:00.262 3750==    
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== open file descriptor 0: /dev/pts/0
==00:00:00:00.262 3750==    
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== heap summary:
==00:00:00:00.262 3750==     in use at exit: 14 bytes in 2 blocks
==00:00:00:00.262 3750==   total heap usage: 2 allocs, 0 frees, 14 bytes allocated
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== 4 bytes in 1 blocks are still reachable in loss record 1 of 2
==00:00:00:00.262 3750==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.262 3750==    by 0x4005df: main (in /home/test1280/20170504/main)
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== 10 bytes in 1 blocks are still reachable in loss record 2 of 2
==00:00:00:00.262 3750==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.262 3750==    by 0x4005d1: main (in /home/test1280/20170504/main)
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== leak summary:
==00:00:00:00.262 3750==    definitely lost: 0 bytes in 0 blocks
==00:00:00:00.262 3750==    indirectly lost: 0 bytes in 0 blocks
==00:00:00:00.262 3750==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.262 3750==    still reachable: 14 bytes in 2 blocks
==00:00:00:00.262 3750==         suppressed: 0 bytes in 0 blocks
==00:00:00:00.262 3750== 
==00:00:00:00.262 3750== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.262 3750== error summary: 2 errors from 2 contexts (suppressed: 0 from 0)

because the program has (a) written uninitialised junk from the heap block to the standard output, and (b) passed an uninitialised value to exit.

从未初始化的块中读数据(然后写到标准输出);传递一个未初始化的值到exit系统调用。


illegal frees

非法的释放。

sample 5:

#include 
#include 
#include void fun1()
{char *p = (char *)malloc(10);free(p);free(p);p = null;
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ !g
gcc -o main main.c 
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 3894== memcheck, a memory error detector
==00:00:00:00.000 3894== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 3894== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 3894== command: ./main
==00:00:00:00.000 3894== parent pid: 3893
==00:00:00:00.000 3894== 
==00:00:00:00.263 3894== invalid free() / delete / delete[] / realloc()
==00:00:00:00.263 3894==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.263 3894==    by 0x4005ad: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==  address 0x51f6040 is 0 bytes inside a block of size 10 free'd
==00:00:00:00.263 3894==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.263 3894==    by 0x4005a1: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==  block was alloc'd at
==00:00:00:00.263 3894==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.263 3894==    by 0x400591: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)
==00:00:00:00.263 3894== 
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== file descriptors: 4 open at exit.
==00:00:00:00.282 3894== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.282 3894==    
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== open file descriptor 2: /dev/pts/0
==00:00:00:00.282 3894==    
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== open file descriptor 1: /dev/pts/0
==00:00:00:00.282 3894==    
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== open file descriptor 0: /dev/pts/0
==00:00:00:00.282 3894==    
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== heap summary:
==00:00:00:00.282 3894==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.282 3894==   total heap usage: 1 allocs, 2 frees, 10 bytes allocated
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== all heap blocks were freed -- no leaks are possible
==00:00:00:00.282 3894== 
==00:00:00:00.282 3894== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.282 3894== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

关键是这个地方:

==00:00:00:00.263 3894== invalid free() / delete / delete[] / realloc()
==00:00:00:00.263 3894==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.263 3894==    by 0x4005ad: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==  address 0x51f6040 is 0 bytes inside a block of size 10 free'd
==00:00:00:00.263 3894==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.263 3894==    by 0x4005a1: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==  block was alloc'd at
==00:00:00:00.263 3894==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.263 3894==    by 0x400591: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.263 3894==    by 0x4005c5: main (in /home/test1280/20170504/main)

我有一个新malloc出来的地址空间,假设我不释放首地址(free的是被移动过的指针):

sample 6:

#include 
#include 
#include void fun1()
{char *p = (char *)malloc(10);p  = 6;free(p);p = null;
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ !g
gcc -o main main.c 
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 4055== memcheck, a memory error detector
==00:00:00:00.000 4055== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 4055== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 4055== command: ./main
==00:00:00:00.000 4055== parent pid: 4054
==00:00:00:00.000 4055== 
==00:00:00:00.234 4055== invalid free() / delete / delete[] / realloc()
==00:00:00:00.234 4055==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.234 4055==    by 0x4005a6: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.234 4055==    by 0x4005be: main (in /home/test1280/20170504/main)
==00:00:00:00.234 4055==  address 0x51f6046 is 6 bytes inside a block of size 10 alloc'd
==00:00:00:00.234 4055==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.234 4055==    by 0x400591: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.234 4055==    by 0x4005be: main (in /home/test1280/20170504/main)
==00:00:00:00.234 4055== 
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== file descriptors: 4 open at exit.
==00:00:00:00.254 4055== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.254 4055==    
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== open file descriptor 2: /dev/pts/0
==00:00:00:00.254 4055==    
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== open file descriptor 1: /dev/pts/0
==00:00:00:00.254 4055==    
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== open file descriptor 0: /dev/pts/0
==00:00:00:00.254 4055==    
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== heap summary:
==00:00:00:00.254 4055==     in use at exit: 10 bytes in 1 blocks
==00:00:00:00.254 4055==   total heap usage: 1 allocs, 1 frees, 10 bytes allocated
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== 10 bytes in 1 blocks are definitely lost in loss record 1 of 1
==00:00:00:00.254 4055==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.254 4055==    by 0x400591: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.254 4055==    by 0x4005be: main (in /home/test1280/20170504/main)
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== leak summary:
==00:00:00:00.254 4055==    definitely lost: 10 bytes in 1 blocks
==00:00:00:00.254 4055==    indirectly lost: 0 bytes in 0 blocks
==00:00:00:00.254 4055==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.254 4055==    still reachable: 0 bytes in 0 blocks
==00:00:00:00.254 4055==         suppressed: 0 bytes in 0 blocks
==00:00:00:00.254 4055== 
==00:00:00:00.254 4055== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.254 4055== error summary: 2 errors from 2 contexts (suppressed: 0 from 0)

关键部分:

==00:00:00:00.234 4055== invalid free() / delete / delete[] / realloc()
==00:00:00:00.234 4055==    at 0x4c2acdd: free (vg_replace_malloc.c:530)
==00:00:00:00.234 4055==    by 0x4005a6: fun1 (in /home/test1280/20170504/main)
==00:00:00:00.234 4055==    by 0x4005be: main (in /home/test1280/20170504/main)
==00:00:00:00.234 4055==  address 0x51f6046 is 6 bytes inside a block of size 10 alloc'd

可见实际上是空间没有被释放。


when a heap block is freed with an inappropriate deallocation function

申请和释放的函数不匹配。

in c it’s important to deallocate memory in a way compatible with how it was allocated.

  1. if allocated with malloc, calloc, realloc, valloc or memalign, you must deallocate with free.
  2. if allocated with new, you must deallocate with delete.
  3. if allocated with new[], you must deallocate with delete[].

the worst thing is that on linux apparently it doesn’t matter if you do mix these up, but the same program may then crash on a different platform, solaris for example.

so it’s best to fix it properly.

in some c implementations, delete[] must be used for objects allocated by new[] because the compiler stores the size of the array and the pointer-to-member to the destructor of the array’s content just before the pointer actually returned.

delete doesn’t account for this and will get confused, possibly corrupting the heap.

sample 7:

#include 
#include 
#include void fun1()
{char *p = (char *)malloc(10);delete p;
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ g   -o main main.c
[test1280@localhost 20170504]$ ./valmem ./main
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 4194== memcheck, a memory error detector
==00:00:00:00.000 4194== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 4194== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 4194== command: ./main
==00:00:00:00.000 4194== parent pid: 4193
==00:00:00:00.000 4194== 
==00:00:00:00.351 4194== mismatched free() / delete / delete []
==00:00:00:00.352 4194==    at 0x4c2b18d: operator delete(void*) (vg_replace_malloc.c:576)
==00:00:00:00.352 4194==    by 0x400691: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==    by 0x40069c: main (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==  address 0x5a17040 is 0 bytes inside a block of size 10 alloc'd
==00:00:00:00.352 4194==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.352 4194==    by 0x400681: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==    by 0x40069c: main (in /home/test1280/20170504/main)
==00:00:00:00.352 4194== 
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== file descriptors: 4 open at exit.
==00:00:00:00.374 4194== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.374 4194==    
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== open file descriptor 2: /dev/pts/0
==00:00:00:00.374 4194==    
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== open file descriptor 1: /dev/pts/0
==00:00:00:00.374 4194==    
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== open file descriptor 0: /dev/pts/0
==00:00:00:00.374 4194==    
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== heap summary:
==00:00:00:00.374 4194==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.374 4194==   total heap usage: 1 allocs, 1 frees, 10 bytes allocated
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== all heap blocks were freed -- no leaks are possible
==00:00:00:00.374 4194== 
==00:00:00:00.374 4194== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.374 4194== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

关键是:

==00:00:00:00.351 4194== mismatched free() / delete / delete []
==00:00:00:00.352 4194==    at 0x4c2b18d: operator delete(void*) (vg_replace_malloc.c:576)
==00:00:00:00.352 4194==    by 0x400691: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==    by 0x40069c: main (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==  address 0x5a17040 is 0 bytes inside a block of size 10 alloc'd
==00:00:00:00.352 4194==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.352 4194==    by 0x400681: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.352 4194==    by 0x40069c: main (in /home/test1280/20170504/main)

overlapping source and destination blocks

源地址块和目的地址块重叠。

the following c library functions copy some data from one memory block to another (or something similar): memcpy, strcpy, strncpy, strcat, strncat.

the blocks pointed to by their src and dst pointers aren’t allowed to overlap.

the posix standards have wording along the lines “if copying takes place between objects that overlap, the behavior is undefined.” therefore, memcheck checks for this.

for example, the obvious way to implement memcpy is by copying from the first byte to the last.

很明显的一种方式是从头开始拷贝,直到结尾。

however, the optimisation guides of some architectures recommend copying from the last byte down to the first.

但实际有可能从最后开始向前拷贝。

also, some implementations of memcpy zero dst before copying, because zeroing the destination’s cache line(s) can improve performance.

也有可能某个实现直接把dest指向的块先清零了,这样可能提高一些效率。


fishy argument values

参数是一个fishy值。

sample 8:

#include 
#include 
#include 
#include void fun1()
{int m = -1; size_t i = m;void *p = malloc(i);printf("%u\n", i); 
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ !g
g   -o main main.c
[test1280@localhost 20170504]$ ./valmem ./main
4294967295
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 4804== memcheck, a memory error detector
==00:00:00:00.000 4804== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 4804== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 4804== command: ./main
==00:00:00:00.000 4804== parent pid: 4803
==00:00:00:00.000 4804== 
==00:00:00:00.288 4804== argument 'size' of function malloc has a fishy (possibly negative) value: -1
==00:00:00:00.288 4804==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.288 4804==    by 0x400663: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.288 4804==    by 0x400688: main (in /home/test1280/20170504/main)
==00:00:00:00.288 4804== 
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== file descriptors: 4 open at exit.
==00:00:00:00.323 4804== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.323 4804==    
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== open file descriptor 2: /dev/pts/0
==00:00:00:00.323 4804==    
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== open file descriptor 1: /dev/pts/0
==00:00:00:00.323 4804==    
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== open file descriptor 0: /dev/pts/0
==00:00:00:00.323 4804==    
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== heap summary:
==00:00:00:00.323 4804==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.323 4804==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== all heap blocks were freed -- no leaks are possible
==00:00:00:00.323 4804== 
==00:00:00:00.323 4804== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.323 4804== error summary: 1 errors from 1 contexts (suppressed: 0 from 0)

关键是:

==00:00:00:00.288 4804== argument 'size' of function malloc has a fishy (possibly negative) value: -1
==00:00:00:00.288 4804==    at 0x4c29be3: malloc (vg_replace_malloc.c:299)
==00:00:00:00.288 4804==    by 0x400663: fun1() (in /home/test1280/20170504/main)
==00:00:00:00.288 4804==    by 0x400688: main (in /home/test1280/20170504/main)

注意,实际上没有分配内存!

当我们把数字减小一倍(哈哈,纯属好奇):

sample 9:

#include 
#include 
#include 
#include void fun1()
{int m = -1; size_t i = m;void *p = malloc(i/2);printf("%u\n", i); 
}int main()
{fun1();return 0;
}
[test1280@localhost 20170504]$ cat valmem.log 
==00:00:00:00.000 5052== memcheck, a memory error detector
==00:00:00:00.000 5052== 尊龙凯时官方 copyright (c) 2002-2015, and gnu gpl'd, by julian seward et al.
==00:00:00:00.000 5052== using valgrind-3.11.0 and libvex; rerun with -h for 尊龙凯时官方 copyright info
==00:00:00:00.000 5052== command: ./main
==00:00:00:00.000 5052== parent pid: 5051
==00:00:00:00.000 5052== 
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== file descriptors: 4 open at exit.
==00:00:00:00.326 5052== open file descriptor 3: /home/test1280/20170504/valmem.log
==00:00:00:00.326 5052==    
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== open file descriptor 2: /dev/pts/0
==00:00:00:00.326 5052==    
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== open file descriptor 1: /dev/pts/0
==00:00:00:00.326 5052==    
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== open file descriptor 0: /dev/pts/0
==00:00:00:00.326 5052==    
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== heap summary:
==00:00:00:00.326 5052==     in use at exit: 0 bytes in 0 blocks
==00:00:00:00.326 5052==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== all heap blocks were freed -- no leaks are possible
==00:00:00:00.326 5052== 
==00:00:00:00.326 5052== for counts of detected and suppressed errors, rerun with: -v
==00:00:00:00.326 5052== error summary: 0 errors from 0 contexts (suppressed: 0 from 0)

看到了吗?没有分配出来,也没有报fishy值参数。


下面介绍definitely lost、indirectly lost、possibly lost以及still reachable。

首先官方的图:

case (1):

#include 
#include 
#include int main()
{char *p = malloc(sizeof(int));exit(0);
}
==00:00:00:00.283 6424== leak summary:
==00:00:00:00.283 6424==    definitely lost: 0 bytes in 0 blocks
==00:00:00:00.283 6424==    indirectly lost: 0 bytes in 0 blocks
==00:00:00:00.283 6424==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.283 6424==    still reachable: 4 bytes in 1 blocks
==00:00:00:00.283 6424==         suppressed: 0 bytes in 0 blocks

p指向的空间直接可达

case (2):

#include 
#include 
#include int main()
{char **p;p = malloc(sizeof(void *));*p = malloc(256);exit(0);
}
==00:00:00:00.253 6489== leak summary:
==00:00:00:00.253 6489==    definitely lost: 0 bytes in 0 blocks
==00:00:00:00.253 6489==    indirectly lost: 0 bytes in 0 blocks
==00:00:00:00.253 6489==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.253 6489==    still reachable: 264 bytes in 2 blocks
==00:00:00:00.253 6489==         suppressed: 0 bytes in 0 blocks

p指向的空间是直接可达,*p指向的空间是间接可达可达空间包括直接可达和间接可达

为什么是264呢?

因为p指向的空间是动态malloc出来的,我实际试验了一下,在我的机器上一个void *占8字节;
*p指向的空间也是动态malloc出来的,大小是256字节。

所以:一共是256 8=264b.

case (3):

#include 
#include 
#include int main()
{char *p = malloc(10);p = null;exit(0);
}
==00:00:00:00.248 6709== leak summary:
==00:00:00:00.248 6709==    definitely lost: 10 bytes in 1 blocks
==00:00:00:00.248 6709==    indirectly lost: 0 bytes in 0 blocks
==00:00:00:00.248 6709==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.248 6709==    still reachable: 0 bytes in 0 blocks
==00:00:00:00.248 6709==         suppressed: 0 bytes in 0 blocks

p指向的空间直接丢失了,也就是我们从heap上malloc出来的那10个字节。

case (4):

#include 
#include 
#include int main()
{char **p = malloc(sizeof(void *));*p = malloc(100);p = null;exit(0);
}
==00:00:00:00.259 6856== leak summary:
==00:00:00:00.259 6856==    definitely lost: 8 bytes in 1 blocks
==00:00:00:00.259 6856==    indirectly lost: 100 bytes in 1 blocks
==00:00:00:00.259 6856==      possibly lost: 0 bytes in 0 blocks
==00:00:00:00.259 6856==    still reachable: 0 bytes in 0 blocks
==00:00:00:00.259 6856==         suppressed: 0 bytes in 0 blocks

p指向的空间是从heap上malloc出来的,在程序退出时已经找不到p指向的空间了,所以*p是直接丢失的(8b);
*p指向的空间也是从heap上malloc出来的,在程序退出时*p显然是不可访问的,所以*p指向的空间是间接丢失的(100b)。

其余的情况(4 to 9)涉及到“interior-pointer”:

there are two ways a block can be reached. the first is with a “start-pointer”, i.e. a pointer to the start of the block. the second is with an “interior-pointer”, i.e. a pointer to the middle of the block.

其中比较常见的一个是:

the pointer might have originally been a start-pointer and have been moved along deliberately (or not deliberately) by the program. in particular, this can happen if your program uses tagged pointers, i.e. if it uses the bottom one, two or three bits of a pointer, which are normally always zero due to alignment, in order to store extra information.

网上对于“interior-pointer”的介绍是这样子的:

所谓的interior-pointer是指向block内的指针,也就是我们常说的野指针。

所以很多possible lost并不是真正的memory leak。

例如(尊龙官方平台官网的一个对的解释):

it might be a pointer to the inner char array of a c std::string. for example, some compilers add 3 words at the beginning of the std::string to store the length, the capacity and a reference count before the memory containing the array of characters. they return a pointer just after these 3 words, pointing at the char array.

其实大家可以多试试,就能知道各种各样的情况(泄露的情形)。

资料来源:

0.http://valgrind.org/docs/manual/manual.html
1.https://www.ibm.com/developerworks/cn/linux/l-cn-valgrind/
3.http://zhenhua2000.blog.51cto.com/3167594/768342
4.http://blog.csdn.net/byrsongqq/article/details/5881375


http://www.ngui.cc/el/5127166.html

相关文章

约瑟夫环(josephproblem)

约瑟夫环(josephproblem) 题目: 有41个人围坐成一圈玩游戏,编号分别是0,1,2,…,39,40. 从1开始,每次数到3的人就退出游戏,下个人再次从1开始。 请问最后剩下的人的编号? 约瑟夫环有很多解题…

c/c :使用数组模拟链表

c/c:使用数组模拟链表 链表中每一个node都由两部分组成: 1.真实的数据; 2.下一个数据的位置; 通常的实现可以使用指针作为指示下一个数据的位置的方式,当没有一个合法的数据存在,就将指针部分置为null&…

c/c :全排列问题

c/c:全排列问题 啥叫全排列? 从n个不同元素中任取m(m≤n)个元素,按照一定的顺序排列起来,叫做从n个不同元素中取出m个元素的一个排列。 当mn时所有的排列情况叫全排列。 假设现在有三个数字:…

杭电-pid1181-变形课

杭电-pid1181-变形课 problem description 呃......变形课上harry碰到了一点小麻烦,因为他并不像hermione那样能够记住所有的咒语而随意的将一个棒球变成刺猬什么的,但是他发现了变形咒语的一个统一规律:如果咒语是以a开头b结尾的一个单词,那么它的作用就恰好是使a物体变成b物…

杭电-pid1008-elevator

杭电-pid1008-elevator 好吧,其实这道题是水过去的。。 problem description the highest building in our city has only one elevator. a request list is made up with n positive numbers. the numbers denote at which floors the elevator will stop, in s…

杭电-pid1012-u calculate e

杭电-pid1012-u calculate e #include #include int main() {printf("n e\n- -----------\n0 1\n1 2\n2 2.5\n");double num 2.5;double base 2;int i 3;while (i < 10){base base * i;num num 1 / base;printf("%d %…

杭电-pid1013-digital roots

杭电-pid1013-digital roots 九余数定理 #include using namespace std;int main() {string s;while (cin>>s){if (s[0] 0){break;}int sum 0, i;for (i 0; i < s.length(); i){sum sum s[i] - 0;}if (sum % 9 0){cout<<"9"<…

linux:curl的使用

linux:curl的使用 curl is a tool to transfer data from or to a server, using one of the supported protocols (http, https, ftp, ftps, tftp, dict, telnet, ldap or file). the command is designed to work without user interaction. curl支持多种协…

c/c :类型转换

c:dynamic_cast、static_cast 实验环境: [test1280localhost ~]$ uname -a linux localhost.localdomain 2.6.18-371.el5 #1 smp thu sep 5 21:21:44 edt 2013 x86_64 x86_64 x86_64 gnu/linux …… gcc 版本 4.1.2 20080704 (red hat 4.1.2-54) c/c中…

lua:ipairs/pairs

lua:ipairs/pairs lua中有两个很类似的函数:ipairs以及pairs。 实验环境: [test1280localhost 20170531]$ uname -a linux localhost.localdomain 2.6.18-371.el5 #1 smp thu sep 5 21:21:44 edt 2013 x86_64 x86_64 x86_64 gnu/linux [te…
网站地图