LeetCode报错信息：==22==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000100 at pc 0x5

错误情况（一）

报错信息

在重刷37.解数独时，写了如下代码，

class Solution {
public:
    // 根据题意，需要三个状态数组
    bool row[9][9] = {};
    bool column[9][9] = {};
    bool matrix[3][3][9] = {};
    bool dfs(vector<vector<char>>& board, int x, int y){
        if(board[x][y] != '.'){
            if(dfs(board, x, y + 1)) return true;
            return false;
        }
        if(y == 9){
            x += 1;
            y = 0;
        }
        
        if(x >= 9) return true;
        
        // 原本就有数字
        
        // 没数字，需要填充
        for(char ch = '1'; ch <= '9'; ++ ch){
            if(row[x][ch - '1'] || column[y][ch - '1'] || matrix[x / 3][y / 3][ch - '1']) continue;
            board[x][y] = ch;
            row[x][ch - '1'] = column[y][ch - '1'] = matrix[x / 3][y / 3][ch - '1'] = true;

            if(dfs(board, x, y + 1)) return true;
            // 恢复现场
            row[x][ch - '1'] = column[y][ch - '1'] = matrix[x / 3][y / 3][ch - '1'] = false;
            board[x][y] = '.';
        }
        
        return false;
    }
    void solveSudoku(vector<vector<char>>& board) {
        // 先初始化状态数组
        for(int i = 0;i < board.size(); ++ i){
            for(int j = 0;j < board[0].size(); ++ j){
                if(board[i][j] != '.'){
                    row[i][board[i][j] - '1'] = true;
                    column[j][board[i][j] - '1'] = true;
                    matrix[i / 3][j / 3][board[i][j] - '1'] = true;
                }
            }
        }
        
        //cout << row[0][4] << endl;
        dfs(board, 0, 0);

        return;
    }
};

报了如下错误信息：

=================================================================
==22==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000100 at pc 0x5598aee890b0 bp 0x7ffc233852f0 sp 0x7ffc233852e8
READ of size 1 at 0x502000000100 thread T0
    #8 0x7f65bbb2cd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
    #9 0x7f65bbb2ce3f  (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
0x502000000100 is located 0 bytes after 16-byte region [0x5020000000f0,0x502000000100)
allocated by thread T0 here:
    #7 0x7f65bbb2cd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: c289da5071a3399de893d2af81d6a30c62646e1e)
Shadow bytes around the buggy address:
  0x501ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x502000000000: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x502000000080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00
=>0x502000000100:[fa]fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x502000000180: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fa
  0x502000000200: fa fa fd fa fa fa 00 00 fa fa fd fa fa fa fd fa
  0x502000000280: fa fa fd fa fa fa fd fa fa fa 00 00 fa fa fd fa
  0x502000000300: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00
  0x502000000380: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22==ABORTING

错误定位

通过注释代码的方法，定位到问题出现在

if(board[x][y] != '.'){
            if(dfs(board, x, y + 1)) return true;
            return false;
        }

错误原因

在递归时，x和y的值可能会超出数组的范围，从而出现上述错误信息。换言之，若数组的索引超过了数组的边界，可能会出现上述错误。