开始尝试使用valgrind

10/09/09 10:14:23 PM
Magic

刚刚看到csdn上面有个帖子在推荐里面，标题和地址如下:
一段小代码，是否出现了野指针？ 请大家发表一下对野指针理解！（希望能Show出代码）
http://topic.csdn.net/u/20090208/20/122a108f-b8a0-4dfc-bdea-3206804b0ffb.html?87197如下

于是我在自己的机器上面测试了一下
我的机器配置如下：
Target: i486-linux-gnu
Thread model: posix
gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4)
valgrind 3.4.1
gnu make 3.81

/*******************************************************************************
 *  /file    wildpointer.cc
 *  /brief   ref the url below
 *  http://topic.csdn.net/u/20090208/20/122a108f-b8a0-4dfc-bdea-3206804b0ffb.html?87197
 *  /date    10/09/2009 08:37:59 PM
 *  /author  Magic(CHD-ZYP), magicpang@gmail.com
 *  /company SECRET
 ******************************************************************************/


#include    <cstdlib>
#include    <cstdio>

void  son_fun(int &num, float **p)
{
    *p = new float[num];
}

void mo_fun(int &num, float **pm, float *pn)
{
    float *m_ptemp;

    *pm = new float[num];
//    *pm = new float[5]; 
    son_fun(num, &m_ptemp);

    for(int k = 0; k < num; k++)
    {
        *pm[k] = m_ptemp[k];
    }
    delete []m_ptemp;    
}


int main ( int argc, char *argv[] )
{
    int     num = 5;
    float   *pf;
    float   *nothing = NULL;

    mo_fun(num, &pf, nothing);

    return EXIT_SUCCESS;
}

Makefile如下

CPP = g++

FLAG = -g -Wall
VALFLAG = --leak-check=full --show-reachable=yes


TARGET = wildpointer


$(TARGET): wildpointer.o
    $(CPP) wildpointer.o -o $(TARGET)

wildpointer.o: wildpointer.cc
    $(CPP) $(FLAG) -c wildpointer.cc


.PHONY: clean

clean:
    @find . -type f -executable | xargs rm
    @rm -f *.o

run: $(TARGET)
    ./$(TARGET)

check: $(TARGET)
    valgrind $(VALFLAG) ./$(TARGET)

运行make check
valgrind给的输出如下
为了把这个输出加到下面用了下面的方法
使用valgrind的选项--log-file=<fname>
cat <fname> >> wildpointer.txt

valgrind --leak-check=full --show-reachable=yes ./wildpointer
==30832== Memcheck, a memory error detector.
==30832== Copyright (C) 2002-2008, and GNU GPL'd, by Julian Seward et al.
==30832== Using LibVEX rev 1884, a library for dynamic binary translation.
==30832== Copyright (C) 2004-2008, and GNU GPL'd, by OpenWorks LLP.
==30832== Using valgrind-3.4.1-Debian, a dynamic binary instrumentation framework.
==30832== Copyright (C) 2000-2008, and GNU GPL'd, by Julian Seward et al.
==30832== For more details, rerun with: -v
==30832==
==30832== My PID = 30832, parent PID = 28002.  Prog and args are:
==30832==    ./wildpointer
==30832==
==30832== Invalid write of size 4
==30832==    at 0x8048564: mo_fun(int&, float**, float*) (wildpointer.cc:29)
==30832==    by 0x80485BF: main (wildpointer.cc:41)
==30832==  Address 0x5 is not stack'd, malloc'd or (recently) free'd
==30832==
==30832== Process terminating with default action of signal 11 (SIGSEGV)
==30832==  Access not within mapped region at address 0x5
==30832==    at 0x8048564: mo_fun(int&, float**, float*) (wildpointer.cc:29)
==30832==    by 0x80485BF: main (wildpointer.cc:41)
==30832==  If you believe this happened as a result of a stack overflow in your
==30832==  program's main thread (unlikely but possible), you can try to increase
==30832==  the size of the main thread stack using the --main-stacksize= flag.
==30832==  The main thread stack size used in this run was 8388608.
==30832==
==30832== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==30832== malloc/free: in use at exit: 40 bytes in 2 blocks.
==30832== malloc/free: 2 allocs, 0 frees, 40 bytes allocated.
==30832== For counts of detected errors, rerun with: -v
==30832== searching for pointers to 2 not-freed blocks.
==30832== checked 93,252 bytes.
==30832==
==30832==
==30832== 20 bytes in 1 blocks are still reachable in loss record 1 of 2
==30832==    at 0x402630E: operator new[](unsigned int) (vg_replace_malloc.c:268)
==30832==    by 0x8048509: son_fun(int&, float**) (wildpointer.cc:16)
==30832==    by 0x8048541: mo_fun(int&, float**, float*) (wildpointer.cc:25)
==30832==    by 0x80485BF: main (wildpointer.cc:41)
==30832==
==30832==
==30832== 20 bytes in 1 blocks are still reachable in loss record 2 of 2
==30832==    at 0x402630E: operator new[](unsigned int) (vg_replace_malloc.c:268)
==30832==    by 0x8048528: mo_fun(int&, float**, float*) (wildpointer.cc:23)
==30832==    by 0x80485BF: main (wildpointer.cc:41)
==30832==
==30832== LEAK SUMMARY:
==30832==    definitely lost: 0 bytes in 0 blocks.
==30832==      possibly lost: 0 bytes in 0 blocks.
==30832==    still reachable: 40 bytes in 2 blocks.
==30832==         suppressed: 0 bytes in 0 blocks.


第一个错误
==30832== Invalid write of size 4
==30832==    at 0x8048564: mo_fun(int&, float**, float*) (wildpointer.cc:29)
==30832==    by 0x80485BF: main (wildpointer.cc:41)
==30832==  Address 0x5 is not stack'd, malloc'd or (recently) free'd
在文档中对这种错误的描述是
This happens when your program reads or writes memory at a place which Memcheck reckons it shouldn't
memcheck可以检测程序读写不属于程序的内存
对应的wildpointer.cc:29
        *pm[k] = m_ptemp[k];
这个就是要理解“指针的指针”,以及＊和［］的优先级了
猜测这个代码的本意是(*pm)[k] = m_ptemp[k]或者写成*(*pm + k) = m_ptemp[k];

修补了上面这个错误之后，再次运行make check,只有一个错误
|| ==31459== 20 bytes in 1 blocks are definitely lost in loss record 1 of 1
|| ==31459==    at 0x402630E: operator new[](unsigned int) (vg_replace_malloc.c:268)
|| ==31459==    by 0x8048528: mo_fun(int&, float**, float*) (wildpointer.cc:23)
|| ==31459==    by 0x80485C2: main (wildpointer.cc:41)

这种错误就是malloc/new之后却没有对应的释放了。