Linux C/C++内存泄漏检测工具:Valgrind

Valgrind 是一款 Linux下(支持 x86、x86_64和ppc32)程序的内存调试工具，它可以对编译后的二进制程序进行内存使用监测(C语言中的malloc和free，以及C++中的new和delete)，找出内存泄漏问题。

　　Valgrind 中包含的 Memcheck 工具可以检查以下的程序错误：

　　使用未初始化的内存 (Use of uninitialised memory)
　　使用已经释放了的内存 (Reading/writing memory after it has been free’d)
　　使用超过malloc分配的内存空间(Reading/writing off the end of malloc’d blocks)
　　对堆栈的非法访问 (Reading/writing inappropriate areas on the stack)
　　申请的空间是否有释放 (Memory leaks - where pointers to malloc’d blocks are lost forever)
　　malloc/free/new/delete申请和释放内存的匹配(Mismatched use of malloc/new/new [] vs free/delete/delete [])
　　src和dst的重叠(Overlapping src and dst pointers in memcpy() and related functions)
　　重复free

　　1、编译安装 Valgrind：

        wget  http://valgrind.org/downloads/valgrind-3.12.0.tar.bz2
        tar xvf valgrind-3.12.0.tar.bz2
       cd valgrind-3.12.0/
      ./configure --prefix=/usr/local/valgrind
       make
      make install

　　2、使用示例：对“ls”程序进程检查，返回结果中的“definitely lost: 0 bytes in 0 blocks.”表示没有内存泄漏。

 [test@gitserver test]$ /usr/local/valgrind/bin/valgrind --tool=memcheck --leak-check=full ls 
==17850== Memcheck, a memory error detector
==17850== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==17850== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==17850== Command: ls
==17850==
core.17834  core.3150  dump  hello    helloDump  test.c    testmem    testmemDump
core.3140   core.3385  he    hello.c  test       testDump  testmem.c
==17850==
==17850== HEAP SUMMARY:
==17850==     in use at exit: 15,420 bytes in 21 blocks
==17850==   total heap usage: 56 allocs, 35 frees, 50,691 bytes allocated
==17850==
==17850== LEAK SUMMARY:
==17850==    definitely lost: 0 bytes in 0 blocks
==17850==    indirectly lost: 0 bytes in 0 blocks
==17850==      possibly lost: 0 bytes in 0 blocks
==17850==    still reachable: 15,420 bytes in 21 blocks
==17850==         suppressed: 0 bytes in 0 blocks
==17850== Reachable blocks (those to which a pointer was found) are not shown.
==17850== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==17850==
==17850== For counts of detected and suppressed errors, rerun with: -v
==17850== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 27 from 8)

　　3、使用示例：编写的“testmem”程序进程检查，返回结果中的“definitely lost: 512 bytes in 1 blocks.”表示发生内存泄漏。

[test@gitserver test]$ /usr/local/valgrind/bin/valgrind --tool=memcheck --leak-check=full ./testmem
==17882== Memcheck, a memory error detector
==17882== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==17882== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==17882== Command: ./testmem
==17882==
==17882== Invalid free() / delete / delete[] / realloc()
==17882==    at 0x40273B2: free (vg_replace_malloc.c:529)
==17882==    by 0x8048433: test (in /home/test/test/testmem)
==17882==    by 0x8048445: main (in /home/test/test/testmem)
==17882==  Address 0x41d5028 is 0 bytes inside a block of size 512 free'd
==17882==    at 0x40273B2: free (vg_replace_malloc.c:529)
==17882==    by 0x8048428: test (in /home/test/test/testmem)
==17882==    by 0x8048445: main (in /home/test/test/testmem)
==17882==  Block was alloc'd at
==17882==    at 0x40279C5: malloc (vg_replace_malloc.c:298)
==17882==    by 0x8048405: test (in /home/test/test/testmem)
==17882==    by 0x8048445: main (in /home/test/test/testmem)
==17882==
==17882==
==17882== HEAP SUMMARY:
==17882==     in use at exit: 512 bytes in 1 blocks
==17882==   total heap usage: 2 allocs, 2 frees, 1,024 bytes allocated
==17882==
==17882== 512 bytes in 1 blocks are definitely lost in loss record 1 of 1
==17882==    at 0x40279C5: malloc (vg_replace_malloc.c:298)
==17882==    by 0x8048414: test (in /home/test/test/testmem)
==17882==    by 0x8048445: main (in /home/test/test/testmem)
==17882==
==17882== LEAK SUMMARY:
==17882==    definitely lost: 512 bytes in 1 blocks
==17882==    indirectly lost: 0 bytes in 0 blocks
==17882==      possibly lost: 0 bytes in 0 blocks
==17882==    still reachable: 0 bytes in 0 blocks
==17882==         suppressed: 0 bytes in 0 blocks
==17882==
==17882== For counts of detected and suppressed errors, rerun with: -v
==17882== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 13 from 8)

       通过objdump -d ./testmem > testmemDump 反汇编部分内容：
080483f4 <test>:
 80483f4:       55                                      push   %ebp
 80483f5:       89 e5                                mov    %esp,%ebp
 80483f7:       83 ec 28                           sub    $0x28,%esp
 80483fa:       c7 04 24 00 02 00 00    movl   $0x200,(%esp)
 8048401:       e8 1e ff ff ff                      call   8048324 <malloc@plt>
 8048406:       89 45 f0                           mov    %eax,-0x10(%ebp)
 8048409:       c7 04 24 00 02 00 00   movl   $0x200,(%esp)
 8048410:       e8 0f ff ff ff                       call   8048324 <malloc@plt>
 8048415:       89 45 f4                          mov    %eax,-0xc(%ebp)
 8048418:       8b 45 f0                          mov    -0x10(%ebp),%eax
 804841b:       89 45 f4                          mov    %eax,-0xc(%ebp)
 804841e:       8b 45 f4                          mov    -0xc(%ebp),%eax
 8048421:       89 04 24                         mov    %eax,(%esp)
 8048424:       e8 eb fe ff ff                     call   8048314 <free@plt>
 8048429:       8b 45 f0                          mov    -0x10(%ebp),%eax
 804842c:       89 04 24                         mov    %eax,(%esp)
 804842f:       e8 e0 fe ff ff                     call   8048314 <free@plt>
 8048434:       b8 00 00 00 00             mov    $0x0,%eax
 8048439:       c9                                    leave
 804843a:       c3                                    ret

0804843b <main>:
 804843b:       55                                  push   %ebp
 804843c:       89 e5                            mov    %esp,%ebp
 804843e:       83 e4 f0                       and    $0xfffffff0,%esp
 8048441:       e8 ae ff ff ff                  call   80483f4 <test>
 8048446:       b8 00 00 00 00          mov    $0x0,%eax
 804844b:       89 ec                           mov    %ebp,%esp
 804844d:       5d                                pop    %ebp
 804844e:       c3                                ret
 804844f:       90                                 nop

　　检查testmem程序，发现有一处“ ptr2 = malloc(512);;”中的“ptr2”没有被free，修改程序后，再使用Valgrind检查，结果已经是“definitely lost: 0 bytes in 0 blocks.”。