linux C 内存泄漏

/*
使用未初始化的内存 ;
内存泄露；
使用野指针；
重复释放同一块内存；
动态内存越界；
不匹配的使用malloc/new/new[] 和 free/delete/delete[]
*/
#include <stdio.h>
#include <stdlib.h>
void fun( )
{
    int *p = (int *)malloc(10*sizeof(int));
    p[10] = 0;
}

int main(void)
{
    fun();
    return 0;
}

1.内存非法写入
2.内存泄漏，没有释放
3.申请内存所在代码行、源码位置
6574 Memcheck, a memory error detector
6574 Copyright © 2002-2017, and GNU GPL’d, by Julian Seward et al.
6574 Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
6574 Command: ./sample
6574
6574 Invalid write of size 4
6574 at 0x8048427: fun (in /home/src/valgrind/sample)
6574 by 0x8048445: main (in /home/src/valgrind/sample)
6574 Address 0x4209050 is 0 bytes after a block of size 40 alloc’d
6574 at 0x402C4AB: malloc (vg_replace_malloc.c:299)
6574 by 0x804841A: fun (in /home/src/valgrind/sample)
6574 by 0x8048445: main (in /home/src/valgrind/sample)
6574
6574
6574 HEAP SUMMARY:
6574 in use at exit: 40 bytes in 1 blocks
6574 total heap usage: 1 allocs, 0 frees, 40 bytes allocated
6574
6574 LEAK SUMMARY:
6574 definitely lost: 40 bytes in 1 blocks
6574 indirectly lost: 0 bytes in 0 blocks
6574 possibly lost: 0 bytes in 0 blocks
6574 still reachable: 0 bytes in 0 blocks
6574 suppressed: 0 bytes in 0 blocks
6574 Rerun with --leak-check=full to see details of leaked memory
6574
6574 For counts of detected and suppressed errors, rerun with: -v
6574 ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

#include <stdio.h>

int main(void)
{
    int a[5];
    int i, s;
    a[0] = a[1] = a[2] = a[3] = a[4] = 0;
    for (i = 0; i < 5; i++)
    {
        s += a[i];
    }
    if (s == 377)
    {
        printf("sum is %d\n", s);
    }
    return 0;
}

1.程序的跳转依赖一个未初始化的变量；
6982 Memcheck, a memory error detector
6982 Copyright © 2002-2017, and GNU GPL’d, by Julian Seward et al.
6982 Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
6982 Command: ./no_init
6982
6982 Conditional jump or move depends on uninitialised value(s)
6982 at 0x80484CA: main (in /home/zhangyue/zhangyue/src/valgrind/no_init)
6982
6982
6982 HEAP SUMMARY:
6982 in use at exit: 0 bytes in 0 blocks
6982 total heap usage: 0 allocs, 0 frees, 0 bytes allocated
6982
6982 All heap blocks were freed – no leaks are possible
6982
6982 For counts of detected and suppressed errors, rerun with: -v
6982 Use --track-origins=yes to see where uninitialised values come from
6982 ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

valgrind参数使用
valgrind --log-file=./valgrind_report.log --leak-check=full --show-leak-kinds=all --show-reachable=no --track-origins=yes ./执行程序
-log-file
指定报告输出文件
-track-origins=yes
是否显示未定义的变量，在堆、栈中被定义没有被 initialised 的变量都被定义成
origins。默认是关闭这个 option 的
-show-leak-kinds=all
这里可以支持的选项有[definite|possible]， 一般只需要去关注 definite（明确的），
possible 是可能会存在。
-leak-check=full
当服务器退出时是否收集输出内存泄漏，选项有[no|summary|full]这个地方我们将
其设置成全输出，默认将会使用 summary 方式

使用gcc 自带内存检查工具-fsanitize=address

// cat leap.c
#include <stdio.h>

int main(){
 char a[5]={0};
 a[5]= 'd';

 return 0;
}

gcc -g leap.c -o leap -fsanitize=address

160ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffe4065ea5 at pc 0x7ff147c3d31f bp 0x7fffe4065e70 sp 0x7fffe4065e60
WRITE of size 1 at 0x7fffe4065ea5 thread T0
#0 0x7ff147c3d31e in main /home/yuezhang/demo/leap.c:5
#1 0x7ff146ff9d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
#2 0x7ff146ff9e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
#3 0x7ff147c3d124 in _start (/home/yuezhang/demo/leap+0x1124)

Address 0x7fffe4065ea5 is located in stack of thread T0 at offset 37 in frame
#0 0x7ff147c3d1f8 in main /home/yuezhang/demo/leap.c:3

This frame has 1 object(s):
[32, 37) ‘a’ (line 4) <== Memory access at offset 37 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/yuezhang/demo/leap.c:5 in main
Shadow bytes around the buggy address:
0x10007c804b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007c804bd0: f1 f1 f1 f1[05]f3 f3 f3 00 00 00 00 00 00 00 00
0x10007c804be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007c804c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
160ABORTING