Valgrind消息：地址XXX在r-x映射的文件中 段

Question

我正在学习C以获取与自定义结构相关的malloc和可用堆内存。

我遇到的问题

对于下面的代码，我不断得到segment fault。使用valgrind进行分析显示：

==12999==  Address 0x108b4b is in a r-x mapped file <folder_path> segment
==12999==

完整输出：

Name : Amy 
Date of Birth: 1989 9 21
Name : echo 
Date of Birth: 1989 9 21
Name : echo 
Date of Birth: 1989 9 21
Name : echo Address 0x5580be70e270
Date of Birth: 1989 9 21
Their address : 0x5580be70e260 0x5580be70e264 0x5580be70e268
Name : echo Address 0x5580be70e270
Date of Birth: 1989 9 21
Their address : 0x5580be70e260 0x5580be70e264 0x5580be70e268
free p->name 
Segmentation fault (core dumped)

我所做的分析

我使用valgrind尝试查找结果在哪里：valgrind --tool=memcheck --leak-check=full ./person2输出显示为：

Their address : 0x522d040 0x522d044 0x522d048
Name : echo Address 0x522d050
Date of Birth: 1989 9 21
Their address : 0x522d040 0x522d044 0x522d048
free p->name 
==12999== Invalid free() / delete / delete[] / realloc()
==12999==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12999==    by 0x108894: Person_destruct (person2.c:33)
==12999==    by 0x108A2F: main (person2.c:74)
==12999==  Address 0x108b4b is in a r-x mapped file /folder/path segment
==12999== 
freed p->name 
free p 
freed p 
==12999== 
==12999== HEAP SUMMARY:
==12999==     in use at exit: 4 bytes in 1 blocks
==12999==   total heap usage: 3 allocs, 3 frees, 1,052 bytes allocated
==12999== 
==12999== 4 bytes in 1 blocks are definitely lost in loss record 1 of 1
==12999==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==12999==    by 0x108817: Person_construct (person2.c:16)
==12999==    by 0x1089CC: main (person2.c:64)
==12999== 
==12999== LEAK SUMMARY:
==12999==    definitely lost: 4 bytes in 1 blocks
==12999==    indirectly lost: 0 bytes in 0 blocks
==12999==      possibly lost: 0 bytes in 0 blocks
==12999==    still reachable: 0 bytes in 0 blocks
==12999==         suppressed: 0 bytes in 0 blocks
==12999== 
==12999== For counts of detected and suppressed errors, rerun with: -v
==12999== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

[我了解的是，*p3指向与p1完全相同的内存块（这由Person_address_print()证明，因此我只明确地销毁p1，以避免两次销毁同一堆内存。）我还尝试让p3->name = "ada";确保分配的字符串仍在先前的长度（3）内，或在调用p3 == NULL之前显式设置Person_destruct(p1)；出现相同的段故障错误：（

代码

这里是代码。该代码基本上可以做到：一种。自定义结构Personb。 （在main中）为Person构造对象，销毁它们并打印相关属性。

//  person.h
#ifndef PERSON_H
#define PERSON_H
typedef struct
{
    int year;
    int month;
    int date;
    char * name; // name is a ponter b/c name length is unknown
} Person;
Person * Person_construct(int y, int m, int d, char * n);
void Person_destruct(Person *p);
void Person_print(Person * p);
#endif

#include "person.h"
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
Person *Person_construct(int y, int m, int d, char *n)
{
    Person *p = NULL;
    p = malloc(sizeof (Person));
    if (p == NULL) // malloc failed
    {
        return NULL;
    }
    p->year= y;
    p->month = m;
    p->date = d;
    p->name = malloc(sizeof(char) * (strlen(n) + 1));
    // + 1 for the neding char '\0'
    if ((p->name) == NULL)// malloc failed, just return
    {
        free(p); 
        return NULL;
    }
    strcpy(p->name, n);
    return p;
}

void Person_destruct(Person *p)
{
    // p->name must be freed befoer p is freed
    if (p->name != NULL)
    {
        printf("free p->name \n");
        free(p->name);
        printf("freed p->name \n");
    }

    if (p != NULL)
    {
        printf("free p \n");
        free(p);
        printf("freed p \n");
    }
}

void Person_print(Person *p)
{
    printf("Name : %s \n", p->name);
    printf("Date of Birth: %d %d %d\n", 
        p->year, p->month, p->date);
}


void Person_address_print(Person *p)
{
    printf("Name : %s Address %p\n", p->name, &(p->name));
    printf("Date of Birth: %d %d %d\n", 
        p->year, p->month, p->date);
    printf("Their address : %p %p %p\n", 
        &(p->year), &(p->month), &(p->date));
}

int main(int argc, char ** argv)
{
    Person * p1 = Person_construct(1989,9, 21, "Amy");
    Person_print(p1);

    Person * p3 = p1;
    p3->name = "echo";
    Person_print(p3);
    Person_print(p1); // p1's name should have changed to "echo".
    Person_address_print(p1);
    Person_address_print(p3);


    Person_destruct(p1);
    // p3 is pointing to the same memory of p1, should not destruct(p3)

    return EXIT_SUCCESS;

}

我正在运行的环境

gcc（Ubuntu 7.4.0-1ubuntu1〜18.04.1）7.4.0valgrind-3.13.0

非常感谢您提供任何线索！

Answer 1

@@ kaylum的回答启发了我。我忘记了C的字符串文字概念，在这种情况下，如果我执行p3->name = "echo"，则手动让p3->name指向字符串文字，并且它先前指向的char数组（在堆内存中为malloc）将丢失。这是当free(p->name);]失败时的原因

感谢@kaylum！