实例介绍利用valgrind定位内存非法访问问题

       本文继续介绍 valgind的使用， 看程序：

#include <stdio.h>

int main()
{
int a[100];
a[10000] = 0;

return 0;
}       用valgrind分析：
[root@xxx ~/valgrind-3.8.1/bin]# ./valgrind --tool=memcheck --leak-check=yes --show-reachable=yes ./a.out
==27955== Memcheck, a memory error detector
==27955== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==27955== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==27955== Command: ./a.out
==27955==
==27955== Invalid write of size 4
==27955== at 0x40055F: main (test.cpp:6)
==27955== Address 0x7ff009f90 is not stack'd, malloc'd or (recently) free'd
==27955==
==27955==
==27955== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==27955== Access not within mapped region at address 0x7FF009F90
==27955== at 0x40055F: main (test.cpp:6)
==27955== If you believe this happened as a result of a stack
==27955== overflow in your program's main thread (unlikely but
==27955== possible), you can try to increase the size of the
==27955== main thread stack using the --main-stacksize= flag.
==27955== The main thread stack size used in this run was 8388608.
==27955==
==27955== HEAP SUMMARY:
==27955== in use at exit: 0 bytes in 0 blocks
==27955== total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==27955==
==27955== All heap blocks were freed -- no leaks are possible
==27955==
==27955== For counts of detected and suppressed errors, rerun with: -v
==27955== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 6 from 6)
Segmentation fault
[root@xxx ~/valgrind-3.8.1/bin]#        可以看到，  第6行有内存非法访问， 程序core dump了。 当然， 除了用valgrind, 我们还可以用其他方法来查出这个内存异常访问导致的core dump问题， 之前介绍过很多次了， 故不再赘述。
       要注意的是， 如果写成a[100] = 0； 实际发现， 并没有core dump, 但这也是非常危险的操作， 应该避免。 至于是否真的core dump, 那就要看你的运气了。 总之， 不要依赖于此类undefined behavior.

      

      类似的非法内存访问还有：

#include <stdio.h>

int main()
{
char *p;
*p = 'a';

return 0;
}     valgrind分析结果如下：
[root@xxx ~/valgrind-3.8.1/bin]# g++ -g test.cpp
[root@xxx ~/valgrind-3.8.1/bin]#
[root@xxx ~/valgrind-3.8.1/bin]# ./valgrind --tool=memcheck --leak-check=yes --show-reachable=yes ./a.out
==31774== Memcheck, a memory error detector
==31774== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==31774== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==31774== Command: ./a.out
==31774==
==31774== Use of uninitialised value of size 8
==31774== at 0x40055C: main (test.cpp:6)
==31774==
==31774== Invalid write of size 1
==31774== at 0x40055C: main (test.cpp:6)
==31774== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==31774==
==31774==
==31774== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==31774== Access not within mapped region at address 0x0
==31774== at 0x40055C: main (test.cpp:6)
==31774== If you believe this happened as a result of a stack
==31774== overflow in your program's main thread (unlikely but
==31774== possible), you can try to increase the size of the
==31774== main thread stack using the --main-stacksize= flag.
==31774== The main thread stack size used in this run was 8388608.
==31774==
==31774== HEAP SUMMARY:
==31774== in use at exit: 0 bytes in 0 blocks
==31774== total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==31774==
==31774== All heap blocks were freed -- no leaks are possible
==31774==
==31774== For counts of detected and suppressed errors, rerun with: -v
==31774== Use --track-origins=yes to see where uninitialised values come from
==31774== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 6 from 6)
Segmentation fault
[root@xxx ~/valgrind-3.8.1/bin]#  
      再比如：

#include <stdio.h>
#include <stdlib.h>
#include <memory.h>

int main()
{
char *p = (char *)malloc(30);
p[31] = 'a';

return 0;
}
       valgrind分析结果如下：

[root@xxx ~/valgrind-3.8.1/bin]# ./valgrind --tool=memcheck --leak-check=yes --show-reachable=yes ./a.out
==32673== Memcheck, a memory error detector
==32673== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==32673== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==32673== Command: ./a.out
==32673==
==32673== Invalid write of size 1
==32673== at 0x4005C2: main (test.cpp:8)
==32673== Address 0x5d8405f is 1 bytes after a block of size 30 alloc'd
==32673== at 0x4C278FE: malloc (vg_replace_malloc.c:270)
==32673== by 0x4005B5: main (test.cpp:7)
==32673==
==32673==
==32673== HEAP SUMMARY:
==32673== in use at exit: 30 bytes in 1 blocks
==32673== total heap usage: 1 allocs, 0 frees, 30 bytes allocated
==32673==
==32673== 30 bytes in 1 blocks are definitely lost in loss record 1 of 1
==32673== at 0x4C278FE: malloc (vg_replace_malloc.c:270)
==32673== by 0x4005B5: main (test.cpp:7)
==32673==
==32673== LEAK SUMMARY:
==32673== definitely lost: 30 bytes in 1 blocks
==32673== indirectly lost: 0 bytes in 0 blocks
==32673== possibly lost: 0 bytes in 0 blocks
==32673== still reachable: 0 bytes in 0 blocks
==32673== suppressed: 0 bytes in 0 blocks
==32673==
==32673== For counts of detected and suppressed errors, rerun with: -v
==32673== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 6 from 6)
[root@xxx ~/valgrind-3.8.1/bin]#

      OK,  先说这么多。