为什么realloc()在某些神秘的输入上失败?

时间:2018-10-07 22:12:43

标签: c memory realloc

我已经花了数小时试图弄清楚为什么我的程序在此输入上失败,但是对我来说仍然是一个谜。首先,这里是重现此错误的相关详细信息。

使用下面同一目录中列出的文件,使用gcc -O0 -g main.c ArrayList.c进行编译(注意:gcc --version输出7.3.0)。然后,运行./a.out $((10**9))。您应该收到以下错误:

a.out: malloc.c:2868: mremap_chunk: Assertion `((size + offset) & (GLRO (dl_pagesize) - 1)) == 0' failed.
Aborted (core dumped)

我已经尝试通过此方法进行调试,但问题似乎不是我的代码,即错误似乎是在realloc的代码中引发的,但老实说我不知道​​。如果我使用./a.out $((10**10)),则程序不会失败,这对我来说是个谜。问题似乎是这一行:

arraylist->data = realloc(arraylist->data, sizeof(uint64_t) * (arraylist->capacity));

我已经通读了手册页,以获取有关我是否错误地调用realloc的线索,但没有任何提示。程序要尝试做的所有事情就是使用修改过的eratosthenes筛子筛除小于sqrt(n)的非素数。有人可以帮我吗?谢谢!


main.c:

// main.c
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <math.h>
#include "ArrayList.h"

// Segment addressing.
#define BYTE_IDX(i) i >> 4
#define BIT_IDX(i) (i >> 1) % 8

// Bit manipulation.
#define IS_PRIME(i) ~(S[BYTE_IDX(i)] >> BIT_IDX(i)) & 1U
#define SET_BIT(i) S[BYTE_IDX(i)] |= (1U << BIT_IDX(i))

uint64_t primepi(uint64_t n)
{
    uint64_t sqrtn = (uint64_t)sqrt((double)n);
    uint8_t *S = calloc((sqrtn + 1) / 16, sizeof(uint8_t));

    ArrayList arraylist;
    arraylist_init(&arraylist);

    for (uint64_t i = 3; i * i <= n; i += 2)
        if (IS_PRIME(i))
        {
            arraylist_append(&arraylist, i);
            for (uint64_t j = i * i; j * j <= n; j += 2 * i)
                SET_BIT(j);

        }

    free(S);
    arraylist_free(&arraylist);
    return (uint64_t)0;
}

int main(int argc, char **argv)
{
    uint64_t n = primepi(atoll(argv[1]));
    printf("n = %lu\n", n);
    return 0;
}

ArrayList.h:

/**
 * ArrayList.h
 *
 * Summary:
 *  Provides a specification of the ArrayList data structure.
 */

#define ARRAYLIST_INITIAL_CAPACITY 128

typedef struct {
    uint64_t size;
    uint64_t capacity;
    uint64_t *data;
} ArrayList;

void arraylist_init(ArrayList *arraylist);

void arraylist_append(ArrayList *arraylist, uint64_t value);

uint64_t arraylist_get(ArrayList *arraylist, uint64_t index);

void arraylist_double_capacity_if_full(ArrayList *arraylist);

void arraylist_free(ArrayList *arraylist);

ArrayList.c:

/**
 * ArrayList.c
 *
 * Summary:
 *  Provides an implementation of the ArrayList data structure.
 */

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include "ArrayList.h"

void arraylist_init(ArrayList *arraylist)
{
    // Initialize size and capacity.
    arraylist->size = (uint64_t)0;
    arraylist->capacity = ARRAYLIST_INITIAL_CAPACITY;

    // Allocate memory of the arraylist->data.
    arraylist->data = calloc(arraylist->capacity, sizeof(uint64_t));
}

void arraylist_append(ArrayList *arraylist, uint64_t value)
{
    // Double ArrayList if it is full.
    arraylist_double_capacity_if_full(arraylist);

    // Append the value and increment the size.
    arraylist->data[arraylist->size++] = value;
}

uint64_t arraylist_get(ArrayList *arraylist, uint64_t index)
{
    if (index >= arraylist->size || index < (uint64_t)0)
    {
        printf("Index %lu out of bounds for ArrayList of size %lu\n", index, arraylist->size);
        exit(1);
    }
    return arraylist->data[index];
}

void arraylist_double_capacity_if_full(ArrayList *arraylist)
{
    if (arraylist->size >= arraylist->capacity)
    {
        arraylist->capacity *= (uint64_t)2;
        arraylist->data = realloc(arraylist->data, sizeof(uint64_t) * (arraylist->capacity));
    }
}

void arraylist_free(ArrayList *arraylist)
{
    free(arraylist->data);
}

编辑:

运行valgrind --tool=memcheck ./a.out $((10**9))的输出:

==31666== Memcheck, a memory error detector
==31666== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==31666== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==31666== Command: ./a.out 1000000000
==31666== 
==31666== Invalid read of size 1
==31666==    at 0x1089E7: primepi (main.c:29)
==31666==    by 0x108AA7: main (main.c:40)
==31666==  Address 0x55cb7f8 is 0 bytes after a block of size 1,976 alloc'd
==31666==    at 0x4C31B25: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31666==    by 0x108952: primepi (main.c:19)
==31666==    by 0x108AA7: main (main.c:40)
==31666== 
==31666== Invalid write of size 1
==31666==    at 0x108A17: primepi (main.c:29)
==31666==    by 0x108AA7: main (main.c:40)
==31666==  Address 0x55cb7f8 is 0 bytes after a block of size 1,976 alloc'd
==31666==    at 0x4C31B25: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31666==    by 0x108952: primepi (main.c:19)
==31666==    by 0x108AA7: main (main.c:40)
==31666== 
==31666== Invalid read of size 1
==31666==    at 0x108982: primepi (main.c:25)
==31666==    by 0x108AA7: main (main.c:40)
==31666==  Address 0x55cb7f8 is 0 bytes after a block of size 1,976 alloc'd
==31666==    at 0x4C31B25: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31666==    by 0x108952: primepi (main.c:19)
==31666==    by 0x108AA7: main (main.c:40)
==31666== 
n = 0
==31666== 
==31666== HEAP SUMMARY:
==31666==     in use at exit: 0 bytes in 0 blocks
==31666==   total heap usage: 8 allocs, 8 frees, 70,584 bytes allocated
==31666== 
==31666== All heap blocks were freed -- no leaks are possible
==31666==
==31666== For counts of detected and suppressed errors, rerun with: -v
==31666== ERROR SUMMARY: 9 errors from 3 contexts (suppressed: 0 from 0)

1 个答案:

答案 0 :(得分:4)

问题出在您的SET_BIT宏上:

#define SET_BIT(i) S[BYTE_IDX(i)] |= (1U << BIT_IDX(i))

或者在您的BYTE_IDX宏中:

#define BYTE_IDX(i) i >> 4

或者可能在此循环中:

for (uint64_t j = i * i; j * j <= n; j += 2 * i)
            SET_BIT(j);

它访问S数组的边界。

何时:

  • argv [1] =“ 1000000000”
  • n = 1000000000
  • sqrtn = 31622
  • DYNAMIC_ARRAY_SIZE(S)=(sqrtn + 1)/ 16 * sizoef(uint8_t)= 1976

S的最大索引为1975。将SET_BIT宏设置为:

#define SET_BIT(i)  do{ \
    size_t _a = BYTE_IDX(i); \
    if (_a > 1975)  \
        fprintf(stderr, "Setting byte %ld\n", _a); \
    S[_a] |= (1U << BIT_IDX(i)); \
}while(0)

我们可以在输出中看到:

Setting byte 1976 

您正在为S数组写越界,该数组将覆盖* alloc数据-它会引发一个断言。

可通过onlinedbg获得实时代码。

输入您的代码:

  • 在宏外部使用任何参数都是不好的。如果在宏中使用S,则可以将其作为参数(可能带有size参数)传递,这样您可以编写断言。您刚刚发现了IS_PRIMESET_BIT宏为什么不好的原因。我非常喜欢您的非常索引位域的想法-只需为此编写一个合适的库,就像arraylist一样。
  • size_t是用于存储大小的类型。对ArrayList.sizeArrayList.capacity使用size_t。使用uint64_t arraylist_get(ArrayList *arraylist, size_t index);。当您处理大数时,检查乘法是否溢出也可能很好,表达式arraylist->capacity *= (uint64_t)2;sizeof(uint64_t) * (arraylist->capacity)可能会溢出。