valgrind给出了未初始化的错误大小

Question

我在博客中看到的sample2.c代码用valgrind来说明未初始化的值。这是代码：sample2.c：

 1  #include <stdio.h>
 2  
 3  int main()
 4  {
 5      int a[5];
 6      int i,s;
 7      a[0]=a[1]=a[3]=a[4]=0;
 8      
 9      printf("%d\n",a[2]);
10      for(i=0;i<5;i++)
11      s += a[i];
12      
13      if(s == 377)
14      printf("sum is %d\n",s);
15      return 0;
16  }

使用gcc -g -o sample2 sample2.c

valgrind --leak-check = full --track-originins = yes ./sample2

我在下面获得了valgrind检查信息。

我不明白为什么在我的机器中由于sizeof（int）== 4而使用大小为8的未初始化值？我在x64机器上运行程序，所以这是指针吗？

==31419== Use of uninitialised value of size 8
==31419==    at 0x4E7F1CB: _itoa_word (in /usr/lib64/libc-2.17.so)
==31419==    by 0x4E83450: vfprintf (in /usr/lib64/libc-2.17.so)
==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
==31419==    by 0x400561: main (sample2.c:9)
==31419==  Uninitialised value was created by a stack allocation
==31419==    at 0x40052D: main (sample2.c:4)

完整检查信息如下：

 ==31419== Memcheck, a memory error detector
    ==31419== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
    ==31419== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
    ==31419== Command: ./sample2
    ==31419== 
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x4E81AFE: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== Use of uninitialised value of size 8
    ==31419==    at 0x4E7F1CB: _itoa_word (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E83450: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x4E7F1D5: _itoa_word (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E83450: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x4E8349F: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x4E81BCB: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x4E81C4E: vfprintf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x4E8A338: printf (in /usr/lib64/libc-2.17.so)
    ==31419==    by 0x400561: main (sample2.c:9)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    4195392
    ==31419== Conditional jump or move depends on uninitialised value(s)
    ==31419==    at 0x400588: main (sample2.c:13)
    ==31419==  Uninitialised value was created by a stack allocation
    ==31419==    at 0x40052D: main (sample2.c:4)
    ==31419== 
    ==31419== 
    ==31419== HEAP SUMMARY:
    ==31419==     in use at exit: 0 bytes in 0 blocks
    ==31419==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
    ==31419== 
    ==31419== All heap blocks were freed -- no leaks are possible
    ==31419== 
    ==31419== For counts of detected and suppressed errors, rerun with: -v

Answer 1

你有一个64位处理器。即使值本身是32位，它也会在64位寄存器中传递给printf;这来自x86-64的System-V调用约定。

然而它似乎没有触发错误，直到后来valgrind似乎只知道该值被符号扩展到64位并且最初来自你的main函数（甚至行号在那里是错误的。

---

如果你使用-m32编译它并以某种方式设法在valgrind下运行它（我需要在Ubuntu上安装其他32位软件包），你确实可以在这里看到4：

==4854== Use of uninitialised value of size 4
==4854==    at 0x48A3CAB: _itoa_word (_itoa.c:179)
==4854==    by 0x48A85C5: vfprintf (vfprintf.c:1642)
==4854==    by 0x48AF2F5: printf (printf.c:33)
==4854==    by 0x1085D0: main (sample2.c:9)
==4854== 
==4854== Conditional jump or move depends on uninitialised value(s)
==4854==    at 0x48A3CB3: _itoa_word (_itoa.c:179)
==4854==    by 0x48A85C5: vfprintf (vfprintf.c:1642)
==4854==    by 0x48AF2F5: printf (printf.c:33)
==4854==    by 0x1085D0: main (sample2.c:9)
==4854== 

---

这里需要注意的一点是int a[2]中的值是不确定的，但是没有类型为int的陷阱值，并且它的地址被采用，因此将其传递给函数时没有未定义的行为 - 但它在库函数呢。