Question

出于某种原因，我的程序有时会正常工作，有时只会以段错误结束。我正在尝试创建malloc的实现。如果我以5000的大小开始，我做malloc(1000)，我希望剩余的内存大小为3984（由于内存条目的大小）。 / p>

当我输出剩余的printf内存时，它有时会打印3984，有时会在分段错误中结束。任何帮助将不胜感激。

#include "malloc-free-impl.h"

static char memArr[5000];
static char* memArrPtr = &memArr;
static MemEntryPtr head = NULL;

void* custom_malloc(int size) {
    if (head == NULL) {
        head = (MemEntryPtr) memArrPtr;
        head->prev = NULL;
        head->next = NULL;
        head->isFree = 1;
        head->size = sizeof(memArr) - sizeof(head);
    }

    MemEntryPtr curr = head;
    while (curr->isFree != 1 && curr->size > size + sizeof(struct MemEntry)) {
        curr = curr->next;
    }

    if ((curr->size - (size)) > sizeof(struct MemEntry)) {
        MemEntryPtr newMemEntry = (MemEntryPtr) (&curr + sizeof(struct MemEntry) + size);
        newMemEntry->prev = curr;
        newMemEntry->next = NULL;
        newMemEntry->isFree = 1;
        newMemEntry->size = curr->size - (size + sizeof(newMemEntry));

        printf("%d\n", newMemEntry->size);

        curr->isFree = 0;
        curr->next = newMemEntry;

        return newMemEntry;
    }

    return NULL;
}

void* custom_free(MemEntryPtr memBlock) {
    memBlock->isFree = 1;
    return NULL;
}

int main(int argc, char** argv) {
    MemEntryPtr node = (MemEntryPtr) custom_malloc(1000);
    return 1;
}

Answer 1

malloc-free-impl.h （复制问题的最小存根）

#ifndef _malloc_free_impl_
#define _malloc_free_impl_

struct MemEntry
{
    struct MemEntry *prev, *next;
      int isFree, size;
};

typedef struct MemEntry * MemEntryPtr;

#endif

valgrind说什么

$ gcc -g test.c -o test
test.c:8:26: warning: initialization from incompatible pointer type [enabled by default]
 static char* memArrPtr = &memArr;
                          ^
$ valgrind ./test
==30474== Memcheck, a memory error detector
==30474== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==30474== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==30474== Command: ./test
==30474== 
==30474== Invalid write of size 8
==30474==    at 0x4005FF: custom_malloc (test.c:27)
==30474==    by 0x4006A3: main (test.c:49)
==30474==  Address 0xfff001f90 is not stack'd, malloc'd or (recently) free'd
==30474== 
==30474== 
==30474== Process terminating with default action of signal 11 (SIGSEGV)
==30474==  Access not within mapped region at address 0xFFF001F90
==30474==    at 0x4005FF: custom_malloc (test.c:27)
==30474==    by 0x4006A3: main (test.c:49)
==30474==  If you believe this happened as a result of a stack
==30474==  overflow in your program's main thread (unlikely but
==30474==  possible), you can try to increase the size of the
==30474==  main thread stack using the --main-stacksize= flag.
==30474==  The main thread stack size used in this run was 8388608.
==30474== 
==30474== HEAP SUMMARY:
==30474==     in use at exit: 0 bytes in 0 blocks
==30474==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==30474== 
==30474== All heap blocks were freed -- no leaks are possible
==30474== 
==30474== For counts of detected and suppressed errors, rerun with: -v
==30474== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault (core dumped)

valgrind反对第27行的无效写：

25   if ((curr->size - (size)) > sizeof(struct MemEntry)) {
26     MemEntryPtr newMemEntry = (MemEntryPtr) (&curr + sizeof(struct MemEntry) + size);
27     newMemEntry->prev = curr;

特别是，它说内存地址newMemEntry-＆gt; prev无效。

回溯，只要newMemEntry是有效的MemEntryPtr地址，该内存地址应该有效。

但是newMemEntry的分配是


添加与sizeof char对齐的尺寸

将此指针算法应用于类型的基指针（MemEntryPtr *）而不是char *以匹配字符串对齐的尺寸

更改代码以对基本char *执行指针运算，因为所有sizeofs都是为此而写的，我们得到：

25   if ((curr->size - (size)) > sizeof(struct MemEntry)) {
26     MemEntryPtr newMemEntry = (MemEntryPtr) ((char *)curr + sizeof(struct MemEntry) + size);
27     newMemEntry->prev = curr;

并使用valgrind检查此更改：

valgrind recheck

$ gcc -g test.c -o test
test.c:8:26: warning: initialization from incompatible pointer type [enabled by default]
 static char* memArrPtr = &memArr;
                          ^
$ valgrind ./test
==1212== Memcheck, a memory error detector
==1212== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==1212== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==1212== Command: ./test
==1212== 
3984
==1212== 
==1212== HEAP SUMMARY:
==1212==     in use at exit: 0 bytes in 0 blocks
==1212==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==1212== 
==1212== All heap blocks were freed -- no leaks are possible
==1212== 
==1212== For counts of detected and suppressed errors, rerun with: -v
==1212== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

内存使用现在没问题 - 并且没有段错误

C程序有时会给出段错误

1 个答案: