Question

似乎我在libc中遇到了一个可能的错误。我有以下代码：

#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <unistd.h>

struct bla
{
    int a,b,c,d;
};

pthread_t tid;

void print (const char *s, const struct bla *fp);

void * thr_fn1 ( void * arg);

int main()
{
    struct bla *bla_main;

    pthread_create (&tid,NULL,thr_fn1,NULL);
    pthread_join (tid, (void *)  &bla_main);
    print ("Old thread: \n",bla_main);
    return 0;
}

void print (const char *s, const struct bla *bla_print)
{
    printf ("%s\n",s);
    printf ("Struct address: %p\n",bla_print);
    printf ("fp.a = %d\n",bla_print->a);
    printf ("fp.b = %d\n",bla_print->b);
    printf ("fp.c = %d\n",bla_print->c);
    printf ("fp.d = %d\n",bla_print->d);
}

void * thr_fn1 ( void * arg)
{
    struct bla *bla_thr;

    bla_thr=  malloc(1);
    bla_thr->a=1;
    bla_thr->b=2;
    bla_thr->c=3;
    bla_thr->d=4;
    print ("Thread 1:\n",bla_thr);
    pthread_exit ((void *) bla_thr);
}

使用gcc -Wall -pthread file.c进行编译，不会产生错误/警告。但是，当我尝试在我的Raspberry Pi（32位）上运行它时，我得到以下输出：

[alex@ArchPi code]$ ./a.out 
Thread 1:

Struct address: 0xb6500468
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4
a.out: malloc.c:2365: sysmalloc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted (core dumped)

[alex@ArchPi code]$ file a.out 
a.out: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.27, BuildID[sha1]=33e5d87872f0b40924a709fe266d47f9f011a06c, not stripped

我注意到当我尝试在英特尔处理器上运行它时，使用编译步骤的-m32选项生成32位可执行文件时，会发生同样的事情。

alex@debian:~/code$ ./a.out 
Thread 1:

Struct address: 0x804e098
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4

a.out: malloc.c:3096: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted


alex@debian:~/code$ file a.out 
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x9966b205f3f6cd3d3a544ea010608e11346f6f9a, not stripped

但是，在英特尔上运行程序的64位可执行文件时不会发生这种情况。

alex@debian:~/code$ ./a.out 
Thread 1:

Struct address: 0xb42130
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4

Old thread: 

Struct address: 0xb42130
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4
alex@debian:~/code$ file a.out 
a.out: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x4bb04ef61287bfe750a37427bb41b8b1578d74e1, not stripped

那么，这是libc / malloc（）中的错误，还是我做错了什么？如果您需要更多详细信息，请告诉我。

由于

Answer 1

您为4 int s分配1个字节：

bla_thr=  malloc(1);

bla_thr->a=1;
bla_thr->b=2;
bla_thr->c=3;
bla_thr->d=4;

这会调用未定义的行为，因此任何事情都可能发生。错误在你的代码中，而不是libc。如果您使用以下内容分配足够的空间：

bla_thr = malloc(sizeof *bla_thr); // == sizeof(struct bla);

它应该有用。事后不要忘记free()记忆！

不同的行为取决于架构

1 个答案: