C了解valgrind，堆栈粉碎错误

Question

我做了一个程序，有时它会抛出一堆粉碎检测到的错误。它可以在99％的时间内工作，但是对于某些文件，它会抛出错误。我使用valgrind来尝试识别错误，但我无法理解日志文件。所以这里是：

==3797== Memcheck, a memory error detector
==3797== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==3797== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
==3797== Command: ./pargrep de nuevo.txt
==3797== Parent PID: 2367
==3797== 
==3797== 
==3797== HEAP SUMMARY:
==3797==     in use at exit: 33,339 bytes in 5 blocks
==3797==   total heap usage: 12 allocs, 7 frees, 35,025 bytes allocated
==3797== 
==3797== 4 bytes in 1 blocks are still reachable in loss record 1 of 5
==3797==    at 0x4026864: malloc (vg_replace_malloc.c:236)
==3797==    by 0x8048FDB: maestro (padre.c:39)
==3797==    by 0x8048ABF: main (main.c:62)
==3797== 
==3797== 55 bytes in 1 blocks are still reachable in loss record 2 of 5
==3797==    at 0x4026864: malloc (vg_replace_malloc.c:236)
==3797==    by 0x40B878B: __libc_message (libc_fatal.c:138)
==3797==    by 0x413D09F: __fortify_fail (fortify_fail.c:32)
==3797==    by 0x413D049: __stack_chk_fail (stack_chk_fail.c:29)
==3797==    by 0x8049665: contar_palabra (funcion.c:51)
==3797==    by 0x80494C5: hilos_hijos (hilos.c:90)
==3797==    by 0x4041E98: start_thread (pthread_create.c:304)
==3797==    by 0x41279ED: clone (clone.S:130)
==3797== 
==3797== 136 bytes in 1 blocks are possibly lost in loss record 3 of 5
==3797==    at 0x4025315: calloc (vg_replace_malloc.c:467)
==3797==    by 0x4010CD7: allocate_dtv (dl-tls.c:300)
==3797==    by 0x401146B: _dl_allocate_tls (dl-tls.c:464)
==3797==    by 0x40425C6: pthread_create@@GLIBC_2.1 (allocatestack.c:570)
==3797==    by 0x80490E1: maestro (padre.c:84)
==3797==    by 0x8048ABF: main (main.c:62)
==3797== 
==3797== 352 bytes in 1 blocks are still reachable in loss record 4 of 5
==3797==    at 0x4026864: malloc (vg_replace_malloc.c:236)
==3797==    by 0x40B3537: __fopen_internal (iofopen.c:76)
==3797==    by 0x40B360B: fopen@@GLIBC_2.1 (iofopen.c:107)
==3797==    by 0x804907D: maestro (padre.c:66)
==3797==    by 0x8048ABF: main (main.c:62)
==3797== 
==3797== 32,792 bytes in 1 blocks are still reachable in loss record 5 of 5
==3797==    at 0x4026864: malloc (vg_replace_malloc.c:236)
==3797==    by 0x40EBA18: __alloc_dir (opendir.c:186)
==3797==    by 0x40EBB49: opendir (opendir.c:141)
==3797==    by 0x8049013: maestro (padre.c:53)
==3797==    by 0x8048ABF: main (main.c:62)
==3797== 
==3797== LEAK SUMMARY:
==3797==    definitely lost: 0 bytes in 0 blocks
==3797==    indirectly lost: 0 bytes in 0 blocks
==3797==      possibly lost: 136 bytes in 1 blocks
==3797==    still reachable: 33,203 bytes in 4 blocks
==3797==         suppressed: 0 bytes in 0 blocks
==3797== 
==3797== For counts of detected and suppressed errors, rerun with: -v
==3797== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 15 from 8)

我真的不明白什么是错误。我很感激帮助。

Answer 1

你需要区分堆栈粉碎和堆内存错误。

Valgrind告诉你，有些记忆没有被释放，有些记忆可能会丢失。但这可能与你的真正问题无关：堆栈粉碎。

stack意味着：局部变量（通常是char数组），任何其他未分配的数组等。

heap：用malloc，calloc，realloc等分配的任何东西。

因此，如果你得到一个堆栈粉碎，很可能很高，你在某个地方写一个数组的末尾。首先检查strcpy，memcpy和数组访问（在那里写入未分配的内存）。

Answer 2

使用Valgrind 3.7.0，您可以尝试使用实验工具exp-sgcheck来查找堆栈和全局溢出。如上所述，这是一个实验工具，因此可能没有memcheck和其他非实验性Valgrind工具那么高的质量。 （例如，可能会给出假阳性和/或假阴性）。然而，exp-sgcheck帮助我找到了一个讨厌的数组溢出错误。

Answer 3

有了这些消息，Valgrind告诉你已经分配了内存（并显示了对malloc调用的堆栈跟踪），但这些分配的内存从未被释放。

更多信息可以在http://valgrind.org/docs/manual/mc-manual.html#mc-manual.leaks找到

Answer 4

valgrind没有检测到array overruns，这可能是你观察到的堆栈粉碎的原因。