就像标题说我真的需要理解的帮助，为什么这个代码在我的系统（linux mint 19，GCC-8.0.1，valgrind-3.13.0，c17）上被视为非有效代码：
#include <stdio.h>
#include <string.h>
void printThis( const char *const ptr );
int main( void) {
char a[10] = "asds";
char b[10] = "1234567890";
strcpy ( a, b );
printThis( a );
}
void printThis( const char *const ptr ){
printf("Copy completed! : %s\n", ptr );
}
Valgrind在这里报告问题：
==6973== Memcheck, a memory error detector ==6973== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==6973== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==6973== Command: /home/michi/Templates/Cprogram/bin/Debug/Cprogram ==6973== ==6973== Source and destination overlap in strcpy(0x1ffefffd14, 0x1ffefffd1e) ==6973== at 0x4C32E97: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==6973== by 0x108724: main (main.c:12) ==6973== Copy completed! : 1234567890 ==6973== ==6973== HEAP SUMMARY: ==6973== in use at exit: 0 bytes in 0 blocks ==6973== total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated ==6973== ==6973== All heap blocks were freed -- no leaks are possible ==6973== ==6973== For counts of detected and suppressed errors, rerun with: -v ==6973== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
这个作为有效代码：
#include <stdio.h>
void strcpy2(char *s, char *t);
void printThis( const char *const ptr );
int main( void) {
char a[10] = "asds";
char b[10] = "1234567890";
strcpy2( a, b );
printThis( a );
}
void strcpy2(char *s, char *t) {
while ( ( *(s++) = *(t++) ) );
}
void printThis( const char *const ptr ){
printf("Copy completed! : %s\n", ptr );
}
Valgrind输出：
==7025== Memcheck, a memory error detector ==7025== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==7025== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==7025== Command: /home/michi/Templates/Cprogram/bin/Debug/Cprogram ==7025== Copy completed! : 1234567890 ==7025== ==7025== HEAP SUMMARY: ==7025== in use at exit: 0 bytes in 0 blocks ==7025== total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated ==7025== ==7025== All heap blocks were freed -- no leaks are possible ==7025== ==7025== For counts of detected and suppressed errors, rerun with: -v ==7025== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
编译与O0，O1，O2和O3和GCC标志：
-Wpedantic -std=c17 -Wall -Wextra -Werror -Wstrict-prototypes -Wmissing-prototypes -Wmisleading-indentation -Wduplicated-cond -Wold-style-definition -Wconversion -Wshadow -Winit-self -Wfloat-equal -Wwrite-strings -O0 -g
Valgrind只能捕获某些类型的错误。它不能检测堆栈，因此它不会看到你的strcpy2错误。 OTOH strcpy被一个版本取代，它检查源和目的地是否重叠 - 它只能因为编译程序中的a + 10 == b而捕获这个！
要捕获这种错误，请使用GCC的-fsanitize=address：
% ./a.out
=================================================================
==3368==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff13832a2a at pc 0x557f05344da8 bp 0x7fff13832990 sp 0x7fff13832980
READ of size 1 at 0x7fff13832a2a thread T0
#0 0x557f05344da7 in strcpy2 (/a.out+0xda7)
#1 0x557f05344cca in main (/a.out+0xcca)
#2 0x7f2d400e5b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
#3 0x557f05344a49 in _start (/a.out+0xa49)
Address 0x7fff13832a2a is located in stack of thread T0 at offset 106 in frame
#0 0x557f05344b39 in main (/a.out+0xb39)
This frame has 2 object(s):
[32, 42) 'a'
[96, 106) 'b' <== Memory access at offset 106 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
[ ... many more lines follow ... ]
我已经更新了标题，以便更准确地使用Valgrind工具。
Valgrind可以检测到这种错误，但正如已经指出的那样，不是memcheck。
如果我用Valgrind exp-sgcheck运行这个示例代码（exp = experimental，sgcheck = stack和globals check）
valgrind --tool=exp-sgcheck ./so19
然后我明白了
== 25056 ==读取大小为1无效 == 25056 ==在0x40059D：strcpy2（so19.c：23） == 25056 == by 0x400564：main（so19.c：18） == 25056 ==地址0x1ffeffed1a预期vs实际： == 25056 ==预期：从这里开始在第1帧中堆叠大小为10的数组“b”
== 25056 ==实际：未知 == 25056 ==实际：在预期后为0 == == 25056 == 25056 ==写入大小为1无效 == 25056 ==在0x4005A0：strcpy2（so19.c：23） == 25056 == by 0x400564：main（so19.c：18） == 25056 ==地址0x1ffeffed2a预期vs实际： == 25056 ==预期：从这里开始在第1帧中堆叠大小为10的数组“a”
== 25056 ==实际：未知 == 25056 ==实际：在预期后为0 == == 25056 == 25056 ==读取大小为1无效 == 25056 ==在0x4005A2：strcpy2（so19.c：23） == 25056 == by 0x400564：main（so19.c：18） == 25056 ==地址0x1ffeffed2a预期vs实际： == 25056 ==预期：从这里开始在第1帧中堆叠大小为10的数组“a”
== 25056 ==实际：未知 == 25056 ==实际：在预期后为0 == == 25056 == 25056 ==读取大小为1无效 == 25056 ==在0x4E74C9C：vfprintf（在/lib64/libc-2.12.so中） == 25056 == by 0x4E7BFF9：printf（在/lib64/libc-2.12.so中） == 25056 == by 0x4005CD：printThis（so19.c：27） == 25056 == by 0x400570：main（so19.c：19） == 25056 ==地址0x1ffeffed2a预期vs实际： == 25056 ==预期：从第3帧开始堆叠数组“a”，大小为10
== 25056 ==实际：未知 == 25056 ==实际：在预期后为0 == == 25056 == 25056 ==读取大小为1无效 == 25056 ==在0x4E9E7C0：_IO_file_xsputn @@ GLIBC_2.2.5（在/lib64/libc-2.12.so中）
== 25056 == by 0x4E74FFF：vfprintf（在/lib64/libc-2.12.so中） == 25056 == by 0x4E7BFF9：printf（在/lib64/libc-2.12.so中） == 25056 == by 0x4005CD：printThis（so19.c：27） == 25056 == by 0x400570：main（so19.c：19） == 25056 ==地址0x1ffeffed2a预期vs实际： == 25056 ==预期：从第4帧开始堆叠数组“a”，大小为10
== 25056 ==实际：未知 == 25056 ==实际：在预期后为0
这是在使用调试信息（-g）编译时。使用优化的构建，不会检测到错误。