Question

就像标题所说的那样，我真的需要理解，为什么在我的系统（linux mint 19，GCC-8.0.1，valgrind-3.13.0，c17）上将此代码视为无效代码：

#include <stdio.h>
#include <string.h>

void printThis( const char *const ptr );

int main( void) {

    char a[10] = "asds";
    char b[10] = "1234567890";

    strcpy ( a, b );
    printThis( a );
}

void printThis( const char *const ptr ){
    printf("Copy completed! : %s\n", ptr );
}

Valgrind在这里报告问题：

==6973== Memcheck, a memory error detector
==6973== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==6973== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==6973== Command: /home/michi/Templates/Cprogram/bin/Debug/Cprogram
==6973== 
==6973== Source and destination overlap in strcpy(0x1ffefffd14, 0x1ffefffd1e)
==6973==    at 0x4C32E97: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==6973==    by 0x108724: main (main.c:12)
==6973== 
Copy completed! : 1234567890
==6973== 
==6973== HEAP SUMMARY:
==6973==     in use at exit: 0 bytes in 0 blocks
==6973==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==6973== 
==6973== All heap blocks were freed -- no leaks are possible
==6973== 
==6973== For counts of detected and suppressed errors, rerun with: -v
==6973== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

，此为有效代码：

#include <stdio.h>

void strcpy2(char *s, char *t);
void printThis( const char *const ptr );

int main( void) {

    char a[10] = "asds";
    char b[10] = "1234567890";

    strcpy2( a, b );
    printThis( a );
}

void strcpy2(char *s, char *t) {
    while ( ( *(s++) = *(t++) ) );
}

void printThis( const char *const ptr ){
    printf("Copy completed! : %s\n", ptr );
}

Valgrind输出：

==7025== Memcheck, a memory error detector
==7025== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==7025== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==7025== Command: /home/michi/Templates/Cprogram/bin/Debug/Cprogram
==7025== 
Copy completed! : 1234567890
==7025== 
==7025== HEAP SUMMARY:
==7025==     in use at exit: 0 bytes in 0 blocks
==7025==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==7025== 
==7025== All heap blocks were freed -- no leaks are possible
==7025== 
==7025== For counts of detected and suppressed errors, rerun with: -v
==7025== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

已与O0，O1，O2和O3以及GCC标志一起编译：

-Wpedantic -std=c17 -Wall -Wextra -Werror -Wstrict-prototypes -Wmissing-prototypes -Wmisleading-indentation -Wduplicated-cond -Wold-style-definition -Wconversion -Wshadow -Winit-self -Wfloat-equal -Wwrite-strings -O0 -g

Answer 1

Valgrind只能捕获某些错误。它无法检测堆栈，因此不会看到strcpy2的错误。 OTOH strcpy替换为确实检查源和目标是否重叠的版本-它可能仅捕获，因为{strong>您的中的a + 10 == b已编译程序！

要捕获此类错误，请使用GCC的-fsanitize=address：

% ./a.out 
=================================================================
==3368==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff13832a2a at pc 0x557f05344da8 bp 0x7fff13832990 sp 0x7fff13832980
READ of size 1 at 0x7fff13832a2a thread T0
    #0 0x557f05344da7 in strcpy2 (/a.out+0xda7)
    #1 0x557f05344cca in main (/a.out+0xcca)
    #2 0x7f2d400e5b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #3 0x557f05344a49 in _start (/a.out+0xa49)

Address 0x7fff13832a2a is located in stack of thread T0 at offset 106 in frame
    #0 0x557f05344b39 in main (/a.out+0xb39)

  This frame has 2 object(s):
    [32, 42) 'a'
    [96, 106) 'b' <== Memory access at offset 106 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
[ ... many more lines follow ... ]

Answer 2

我已更新标题，以使使用的Valgrind工具更准确。

Valgrind 可以检测到这种错误，但是如上所述，memcheck不能。

如果我使用Valgrind exp-sgcheck运行此示例代码（exp =实验性，sgcheck =堆栈和全局检查）

valgrind --tool=exp-sgcheck ./so19

然后我得到

== 25056 ==大小为1的无效读取
  == 25056 == at 0x40059D：strcpy2（so19.c：23）
  == 25056 ==通过0x400564：主（so19.c：18）
  == 25056 ==地址0x1ffeffed1a预期值与实际值：
  == 25056 ==预期：从此处返回的第1帧中大小为10的堆栈数组“ b”

== 25056 ==实际：未知
  == 25056 ==实际：在期望值之后为0
  == 25056 ==
  == 25056 ==大小为1的无效写入
  == 25056 == at 0x4005A0：strcpy2（so19.c：23）
  == 25056 ==通过0x400564：主（so19.c：18）
  == 25056 ==地址0x1ffeffed2a预期值与实际值：
  == 25056 ==预期：从此处返回
的第1帧中大小为10的堆栈数组“ a”
== 25056 ==实际：未知
  == 25056 ==实际：在期望值之后为0
  == 25056 ==
  == 25056 ==读取的大小为1无效
  == 25056 == at 0x4005A2：strcpy2（so19.c：23）
  == 25056 ==通过0x400564：主（so19.c：18）
  == 25056 ==地址0x1ffeffed2a预期值与实际值：
  == 25056 ==预期：从此处返回
的第1帧中大小为10的堆栈数组“ a”
== 25056 ==实际：未知
  == 25056 ==实际：在期望值之后为0
  == 25056 ==
  == 25056 ==读取的大小为1无效
  == 25056 ==在0x4E74C9C：vfprintf（在/lib64/libc-2.12.so中）
  == 25056 ==通过0x4E7BFF9：printf（在/lib64/libc-2.12.so中）
  == 25056 ==通过0x4005CD：printThis（so19.c：27）
  == 25056 ==通过0x400570：主（so19.c：19）
  == 25056 ==地址0x1ffeffed2a预期值与实际值：
  == 25056 ==预期：从此处返回
的第3帧中大小为10的堆栈数组“ a”
== 25056 ==实际：未知
  == 25056 ==实际：在期望值之后为0
  == 25056 ==
  == 25056 ==读取的大小为1无效
  == 25056 ==在0x4E9E7C0处：_IO_file_xsputn @@ GLIBC_2.2.5（在/lib64/libc-2.12.so中）

== 25056 ==通过0x4E74FFF：vfprintf（在/lib64/libc-2.12.so中）
  == 25056 ==通过0x4E7BFF9：printf（在/lib64/libc-2.12.so中）
  == 25056 ==通过0x4005CD：printThis（so19.c：27）
  == 25056 ==通过0x400570：主（so19.c：19）
  == 25056 ==地址0x1ffeffed2a预期值与实际值：
  == 25056 ==预期：从此处返回
的第4帧中大小为10的堆栈数组“ a”
== 25056 ==实际：未知
  == 25056 ==实际：比预期高出0

这是在使用调试信息（-g）进行编译时。通过优化的构建，不会检测到错误。

Valgrind memcheck为什么不赶上这个UB？

2 个答案: