使用 valgrind 检测内存问题示例

介绍

valgrind 是一套工具集，常用于检测软件内存泄漏和分析软件性能问题。本文只记录使用 valgrind 检测内存相关问题的示例。

valgrind 使用

使用 valgrind 调用将要测试的程序，加上参数 --leak-check=full --show-leak-kinds=all, 如下面示例，检测 test 程序有没有问题。

1
valgrind --leak-check=full --show-leak-kinds=all ./test

常见内存问题

内存泄漏

1
2
3
4
5
6
7
8
void test_memory_leak(void)
{
    char *test_data = NULL;
    test_data = malloc(1024);
    memset(test_data, 0, 1024);
    sprintf(test_data, "[test]\r\nkey=123\r\n");
    printf("test_data:%s\r\n", test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==344== Memcheck, a memory error detector
==344== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==344== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==344== Command: ./build/build_out/target/test
==344==
test_data:[test]
key=123

test count:36, test passed:36, 100.00%
==344== 
==344== HEAP SUMMARY:
==344==     in use at exit: 1,024 bytes in 1 blocks
==344==   total heap usage: 181 allocs, 180 frees, 28,748 bytes allocated
==344==
==344== 1,024 bytes in 1 blocks are definitely lost in loss record 1 of 1
==344==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==344==    by 0x10A59C: test_memory_leak (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==344==    by 0x10A600: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==344==    by 0x10A61B: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==344==
==344== LEAK SUMMARY:
==344==    definitely lost: 1,024 bytes in 1 blocks
==344==    indirectly lost: 0 bytes in 0 blocks
==344==      possibly lost: 0 bytes in 0 blocks
==344==    still reachable: 0 bytes in 0 blocks
==344==         suppressed: 0 bytes in 0 blocks
==344==
==344== For lists of detected and suppressed errors, rerun with: -s
==344== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

内存越界

写越界

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
void test_memory(void)
{
    // 内存越界示例
    char *test_data = NULL;
    test_data = malloc(10);
    memset(test_data, 0, 10);
    strcpy(test_data, "test");
    test_data[10] = '\0';
    free(test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==56== Memcheck, a memory error detector
==56== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==56== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==56== Command: ./build/build_out/target/test
==56==
==56== Invalid write of size 1
==56==    at 0x10A5AD: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==    by 0x10A5D5: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==    by 0x10A5F0: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==  Address 0x4a52c3a is 0 bytes after a block of size 10 alloc'd
==56==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)       
==56==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==    by 0x10A5D5: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==    by 0x10A5F0: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==56==
test count:36, test passed:36, 100.00%
==56==
==56== HEAP SUMMARY:
==56==     in use at exit: 0 bytes in 0 blocks
==56==   total heap usage: 181 allocs, 181 frees, 27,734 bytes allocated
==56==
==56== All heap blocks were freed -- no leaks are possible
==56==
==56== For lists of detected and suppressed errors, rerun with: -s
==56== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

读越界

1
2
3
4
5
6
7
8
9
void test_memory(void)
{
    char *test_data = NULL;
    test_data = malloc(10);
    memset(test_data, 0, 10);
    strcpy(test_data, "test");
    printf("test_data:%c\r\n", test_data[10]);
    free(test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==118== Memcheck, a memory error detector
==118== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==118== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==118== Command: ./build/build_out/target/test
==118==
==118== Invalid read of size 1
==118==    at 0x10A5AD: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==    by 0x10A5EB: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==    by 0x10A606: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==  Address 0x4a52c3a is 0 bytes after a block of size 10 alloc'd
==118==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==118==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==    by 0x10A5EB: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==    by 0x10A606: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==118==
test_data:
test count:36, test passed:36, 100.00%
==118== 
==118== HEAP SUMMARY:
==118==     in use at exit: 0 bytes in 0 blocks
==118==   total heap usage: 181 allocs, 181 frees, 27,734 bytes allocated
==118==
==118== All heap blocks were freed -- no leaks are possible
==118==
==118== For lists of detected and suppressed errors, rerun with: -s
==118== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

double free

1
2
3
4
5
6
7
8
9
void test_memory(void)
{
    char *test_data = NULL;
    test_data = malloc(10);
    memset(test_data, 0, 10);
    strcpy(test_data, "test");
    free(test_data);
    free(test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==177== Memcheck, a memory error detector
==177== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==177== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==177== Command: ./build/build_out/target/test
==177==
==177== Invalid free() / delete / delete[] / realloc()
==177==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==177==    by 0x10A5BC: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5D6: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5F1: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==  Address 0x4a52c30 is 0 bytes inside a block of size 10 free'd
==177==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==177==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5D6: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5F1: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==  Block was alloc'd at
==177==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==177==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5D6: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==    by 0x10A5F1: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==177==
test count:36, test passed:36, 100.00%
==177== 
==177== HEAP SUMMARY:
==177==     in use at exit: 0 bytes in 0 blocks
==177==   total heap usage: 181 allocs, 182 frees, 27,734 bytes allocated
==177==
==177== All heap blocks were freed -- no leaks are possible
==177==
==177== For lists of detected and suppressed errors, rerun with: -s
==177== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

use after free

1
2
3
4
5
6
7
8
9
void test_memory(void)
{
    char *test_data = NULL;
    test_data = malloc(10);
    memset(test_data, 0, 10);
    strcpy(test_data, "test");
    free(test_data);
    printf("test_data:%s\r\n", test_data);
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==330== Memcheck, a memory error detector
==330== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==330== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==330== Command: ./build/build_out/target/test
==330==
==330== Invalid read of size 1
==330==    at 0x483EF46: strlen (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x48CCD14: __vfprintf_internal (vfprintf-internal.c:1688)
==330==    by 0x48B5D3E: printf (printf.c:33)
==330==    by 0x10A5C8: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Address 0x4a52c30 is 0 bytes inside a block of size 10 free'd
==330==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Block was alloc'd at
==330==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==
==330== Invalid read of size 1
==330==    at 0x483EF54: strlen (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x48CCD14: __vfprintf_internal (vfprintf-internal.c:1688)
==330==    by 0x48B5D3E: printf (printf.c:33)
==330==    by 0x10A5C8: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Address 0x4a52c31 is 1 bytes inside a block of size 10 free'd
==330==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Block was alloc'd at
==330==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==
==330== Invalid read of size 1
==330==    at 0x48E370C: _IO_new_file_xsputn (fileops.c:1219)
==330==    by 0x48E370C: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1197)
==330==    by 0x48CB0FB: __vfprintf_internal (vfprintf-internal.c:1688)
==330==    by 0x48B5D3E: printf (printf.c:33)
==330==    by 0x10A5C8: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Address 0x4a52c33 is 3 bytes inside a block of size 10 free'd
==330==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Block was alloc'd at
==330==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==
==330== Invalid read of size 1
==330==    at 0x48436A0: mempcpy (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x48E3631: _IO_new_file_xsputn (fileops.c:1236)
==330==    by 0x48E3631: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1197)
==330==    by 0x48CB0FB: __vfprintf_internal (vfprintf-internal.c:1688)
==330==    by 0x48B5D3E: printf (printf.c:33)
==330==    by 0x10A5C8: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Address 0x4a52c33 is 3 bytes inside a block of size 10 free'd
==330==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Block was alloc'd at
==330==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==
==330== Invalid read of size 1
==330==    at 0x48436B2: mempcpy (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x48E3631: _IO_new_file_xsputn (fileops.c:1236)
==330==    by 0x48E3631: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1197)
==330==    by 0x48CB0FB: __vfprintf_internal (vfprintf-internal.c:1688)
==330==    by 0x48B5D3E: printf (printf.c:33)
==330==    by 0x10A5C8: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Address 0x4a52c31 is 1 bytes inside a block of size 10 free'd
==330==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A5B0: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==  Block was alloc'd at
==330==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==330==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5E2: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==    by 0x10A5FD: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==330==
test_data:test
test count:36, test passed:36, 100.00%
==330== 
==330== HEAP SUMMARY:
==330==     in use at exit: 0 bytes in 0 blocks
==330==   total heap usage: 181 allocs, 181 frees, 27,734 bytes allocated
==330==
==330== All heap blocks were freed -- no leaks are possible
==330==
==330== For lists of detected and suppressed errors, rerun with: -s
==330== ERROR SUMMARY: 13 errors from 5 contexts (suppressed: 0 from 0)

free 不存在的地址

1
2
3
4
5
6
7
8
9
void test_memory(void)
{
    char *test_data = NULL;
    test_data = malloc(10);
    memset(test_data, 0, 10);
    strcpy(test_data, "test");
    test_data++;
    free(test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==395== Memcheck, a memory error detector
==395== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==395== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==395== Command: ./build/build_out/target/test
==395==
==395== Invalid free() / delete / delete[] / realloc()
==395==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==395==    by 0x10A5B5: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5CF: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5EA: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==  Address 0x4a52c31 is 1 bytes inside a block of size 10 alloc'd
==395==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==395==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5CF: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5EA: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==
test count:36, test passed:36, 100.00%
==395==
==395== HEAP SUMMARY:
==395==     in use at exit: 10 bytes in 1 blocks
==395==   total heap usage: 181 allocs, 181 frees, 27,734 bytes allocated
==395==
==395== 10 bytes in 1 blocks are definitely lost in loss record 1 of 1
==395==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==395==    by 0x10A57C: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5CF: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==    by 0x10A5EA: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==395==
==395== LEAK SUMMARY:
==395==    definitely lost: 10 bytes in 1 blocks
==395==    indirectly lost: 0 bytes in 0 blocks
==395==      possibly lost: 0 bytes in 0 blocks
==395==    still reachable: 0 bytes in 0 blocks
==395==         suppressed: 0 bytes in 0 blocks
==395==
==395== For lists of detected and suppressed errors, rerun with: -s
==395== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

访问非法地址

1
2
3
4
5
6
7
static void test_parser(void)
{
    test_parser_normal();
    // test abnormal
    test_parser_abnormal();
    test_memory();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==480== Memcheck, a memory error detector
==480== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==480== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==480== Command: ./build/build_out/target/test
==480==
==480== Invalid write of size 1
==480==    at 0x10A577: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==    by 0x10A593: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==    by 0x10A5AE: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==  Address 0x23444 is not stack'd, malloc'd or (recently) free'd
==480==
==480==
==480== Process terminating with default action of signal 11 (SIGSEGV)
==480==  Access not within mapped region at address 0x23444
==480==    at 0x10A577: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==    by 0x10A593: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==    by 0x10A5AE: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==480==  If you believe this happened as a result of a stack
==480==  overflow in your program's main thread (unlikely but
==480==  possible), you can try to increase the size of the
==480==  main thread stack using the --main-stacksize= flag.
==480==  The main thread stack size used in this run was 8388608.
==480== 
==480== HEAP SUMMARY:
==480==     in use at exit: 0 bytes in 0 blocks
==480==   total heap usage: 179 allocs, 179 frees, 26,700 bytes allocated
==480==
==480== All heap blocks were freed -- no leaks are possible
==480==
==480== For lists of detected and suppressed errors, rerun with: -s
==480== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
make: *** [Makefile:12: memcheck] Segmentation fault

局部变量越界

写越界

1
2
3
4
5
6
void test_memory(void)
{
    char test_data[10] = {0};
    sprintf(test_data, "test333333333333333333");
    printf ("%s\r\n", test_data);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==527== Memcheck, a memory error detector
==527== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==527== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==527== Command: ./build/build_out/target/test
==527==
test333333333333333333
*** stack smashing detected ***: terminated
==527==
==527== Process terminating with default action of signal 6 (SIGABRT)
==527==    at 0x489700B: raise (raise.c:51)
==527==    by 0x4876858: abort (abort.c:79)
==527==    by 0x48E126D: __libc_message (libc_fatal.c:155)
==527==    by 0x4983AB9: __fortify_fail (fortify_fail.c:26)
==527==    by 0x4983A85: __stack_chk_fail (stack_chk_fail.c:24)
==527==    by 0x10A5EC: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==527==    by 0x10A605: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==527==    by 0x1FFEFFFE4F: ???
==527==    by 0x10A620: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==527==
==527== HEAP SUMMARY:
==527==     in use at exit: 0 bytes in 0 blocks
==527==   total heap usage: 180 allocs, 180 frees, 27,724 bytes allocated
==527==
==527== All heap blocks were freed -- no leaks are possible
==527==
==527== For lists of detected and suppressed errors, rerun with: -s
==527== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

读越界

1
2
3
4
5
6
void test_memory(void)
{
    char test_data[100] = {0};
    sprintf(test_data, "test333333333333333333");
    printf ("%c\r\n", test_data[100]);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
valgrind --leak-check=full --show-leak-kinds=all ./build/build_out/target/test
==571== Memcheck, a memory error detector
==571== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==571== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==571== Command: ./build/build_out/target/test
==571==
==571== Conditional jump or move depends on uninitialised value(s)
==571==    at 0x48E4DDD: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:783)
==571==    by 0x48CD8ED: __vfprintf_internal (vfprintf-internal.c:1688)
==571==    by 0x48B5D3E: printf (printf.c:33)
==571==    by 0x10A632: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A660: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A67B: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==
==571== Syscall param write(buf) points to uninitialised byte(s)
==571==    at 0x4962077: write (write.c:26)
==571==    by 0x48E2E8C: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1181)
==571==    by 0x48E4950: new_do_write (fileops.c:449)
==571==    by 0x48E4950: _IO_new_do_write (fileops.c:426)
==571==    by 0x48E4950: _IO_do_write@@GLIBC_2.2.5 (fileops.c:423)
==571==    by 0x48E36B4: _IO_new_file_xsputn (fileops.c:1244)
==571==    by 0x48E36B4: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1197)
==571==    by 0x48CAFE5: __vfprintf_internal (vfprintf-internal.c:1719)
==571==    by 0x48B5D3E: printf (printf.c:33)
==571==    by 0x10A632: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A660: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A67B: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==  Address 0x4a52c30 is 0 bytes inside a block of size 1,024 alloc'd
==571==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==571==    by 0x48D5D03: _IO_file_doallocate (filedoalloc.c:101)
==571==    by 0x48E5ECF: _IO_doallocbuf (genops.c:347)
==571==    by 0x48E4F2F: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:745)
==571==    by 0x48CD8ED: __vfprintf_internal (vfprintf-internal.c:1688)
==571==    by 0x48B5D3E: printf (printf.c:33)
==571==    by 0x10A632: test_memory (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A660: test_parser (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==    by 0x10A67B: main (in /mnt/d/workspace/lwiniparser/build/build_out/target/test)
==571==

test count:36, test passed:36, 100.00%
==571== 
==571== HEAP SUMMARY:
==571==     in use at exit: 0 bytes in 0 blocks
==571==   total heap usage: 180 allocs, 180 frees, 27,724 bytes allocated
==571==
==571== All heap blocks were freed -- no leaks are possible
==571==
==571== Use --track-origins=yes to see where uninitialised values come from
==571== For lists of detected and suppressed errors, rerun with: -s
==571== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

介绍#

valgrind 使用#

常见内存问题#

介绍

valgrind 使用

常见内存问题