c - 请用 C 解释这个 *char malloc/realloc/free 行为

Question

在 C 语言中使用链表时，我注意到了这种我不理解的行为。下面的示例代码说明了声明一个简单列表并用包含 *char 名称的节点填充的情况。 theName 字符串是通过附加_ 命令行中给定的每个参数生成的，因此charNum 比argv[i] 大2以容纳 _ 和 \0。每个 argv 元素都会生成一个节点，该节点将添加到 main 函数的 for 循环中的列表中。

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

struct node {
  char* name;
  struct node* next;
};

struct node*
nalloc(char* name)
{
  struct node* n = (struct node*) malloc(sizeof(struct node));
  if (n)
  {
    n->name = name;
    n->next = NULL;
  }
  return n;
}

struct node*
nadd(struct node* head, char* name)
{
  struct node* new = nalloc(name);
  if (new == NULL) return head;
  new->next = head;
  return new;
}

void
nprint(struct node* head)
{
  struct node* n = NULL;
  printf("List start: \n");
  for(n = head; n; n=n->next)
  {
    printf("  Node name: %s, next node: %p\n", n->name, n->next);
  }
  printf("List end. \n");
}

void
nfree(struct node* head)
{
  struct node* n = NULL;
  printf("Freeing up the list: \n");
  while (head)
  {
    n = head;
    printf("  Freeing: %s\n", head->name);
    head = head->next;
    free(n);
  }
  printf("Done.\n");
}

int
main(int argc, char** argv)
{
  struct node* list = NULL;
  char* theName = (char*) malloc(0);
  int i, charNum;
  for (i=0; i < argc; i++)
  {
    charNum = strlen(argv[i]) + 2;
    theName = (char*) realloc(NULL, sizeof (char)*charNum);
    snprintf(theName, charNum, "%s_", argv[i]);
    list = nadd(list, theName);
  }
  nprint(list);
  nfree(list);
  free(theName);
  return 0;
}

上面的代码可以正常工作:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x1dae0d0
  Node name: two_, next node: 0x1dae090
  Node name: one_, next node: 0x1dae050
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: three_
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

然而，当我修改此代码并在打印列表之前调用 free(theName) 时:

  ...
  free(theName);
  nprint(list);
  nfree(list);
  return 0;
  ...

缺少最后一个列表项的名称:

$  ./a.out one two three
List start: 
  Node name: , next node: 0x3f270d0
  Node name: two_, next node: 0x3f27090
  Node name: one_, next node: 0x3f27050
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

所以释放 theName 指针会影响使用它作为其名称的列表节点，但为什么早期的 realloc 不会影响其他节点？如果 free(theName) 破坏了最后一个节点的名称，我猜测 realloc 会做同样的事情，并且列表中的所有节点都将具有空白名称。

---

感谢大家的评论和回答。我修改了代码以删除 malloc 结果的转换，添加节点-> 名称的释放并将名称的“malloc -> multiple reallocs -> free”更改为“multiple mallocs -> free”。所以这是新代码:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

struct node {
  char* name;
  struct node* next;
};

struct node*
nalloc(char* name)
{
  struct node* n = malloc(sizeof(struct node));
  if (n)
  {
    n->name = name;
    n->next = NULL;
  }
  return n;
}

struct node*
nadd(struct node* head, char* name)
{
  struct node* new = nalloc(name);
  if (new == NULL) return head;
  new->next = head;
  return new;
}

void
nprint(struct node* head)
{
  struct node* n = NULL;
  printf("List start: \n");
  for(n = head; n; n=n->next)
  {
    printf("  Node name: %s, next node: %p\n", n->name, n->next);
  }
  printf("List end. \n");
}

void
nfree(struct node* head)
{
  struct node* n = NULL;
  printf("Freeing up the list: \n");
  while (head)
  {
    n = head;
    printf("  Freeing: %s\n", head->name);
    head = head->next;
    free(n->name);
    free(n);
  }
  printf("Done.\n");
}

int
main(int argc, char** argv)
{
  struct node* list = NULL;
  char* theName;
  int i, charNum;
  for (i=0; i < argc; i++)
  {
    charNum = strlen(argv[i]) + 2;
    theName = malloc(sizeof (char)*charNum);
    snprintf(theName, charNum, "%s_", argv[i]);
    list = nadd(list, theName);
  }
  nprint(list);
  nfree(list);
  free(theName);
  return 0;
}

以上按预期工作:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x1826c0b0
  Node name: two_, next node: 0x1826c070
  Node name: one_, next node: 0x1826c030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: three_
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

然而，当我将 free(theName); 放在 nprint(list); 之前时:

  free(theName);
  nprint(list);
  nfree(list);
  return 0;

在输出中缺少最后一个节点的名称并且 nfree(list); 抛出错误:

$  ./a.out one two three
List start: 
  Node name: , next node: 0x1cf3e0b0
  Node name: two_, next node: 0x1cf3e070
  Node name: one_, next node: 0x1cf3e030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
*** glibc detected *** ./a.out: double free or corruption (fasttop): 0x000000001cf3e0d0 ***
======= Backtrace: =========
...
======= Memory map: ========
...
Aborted

当我将 free(theName); 放在 nprint(list); 之后和 nfree(list); 之前时:

  nprint(list);
  free(theName);
  nfree(list);
  return 0;

在输出中所有节点都被正确打印，但是 nprint(list); 仍然抛出错误:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x19d160b0
  Node name: two_, next node: 0x19d16070
  Node name: one_, next node: 0x19d16030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
*** glibc detected *** ./a.out: double free or corruption (fasttop): 0x000000001cf3e0d0 ***
======= Backtrace: =========
...
======= Memory map: ========
...
Aborted

这在我脑海中提出了另一个问题:我猜测无论如何 theName 指向的内存被释放了两次:第一次作为 node->name，第二次作为 theName，所以怎么会 free(theName); 在程序末尾调用 nfree(list); 时不会引发 double-free 错误(因为它在工作代码中)？

Answer 1

当您释放 theName 时，指针仍然指向最近添加到列表中的名称部分。它不指向列表中较早的项目，因为指针由结构元素正确管理，并且 theName 已移动以指向不同的值(最近添加的)。这就是名称为 free()d 的原因。

在释放结构元素本身之前，您还因为没有正确释放每个结构元素(即名称)内的变量而导致内存泄漏。我个人建议获得 valgrind (Linux) 或 this (windows) 并通过它运行您的程序。