c - Valgrind 中大小为 4 的读/写无效

Question

我目前正在研究一个 C 程序来调试 Valgrind 报告错误的地方。

我已经将一些代码剥离到一个小项目中来测试我认为问题出在哪里，并且我相信我已经几乎重现了这个问题。

下面是我的主要功能

int main(int argc, char** argv) {

    FILE *csvFile = NULL;
    csvFile = fopen("test.txt", "wb");
    int arraySize = 10;
    int i = 0;

    targetsStruct *targets;
    targetSummaryResultStruct *targetSummaryResult;
    targets = malloc(arraySize + 10 * sizeof(targets));
    targetSummaryResult = malloc(arraySize + 10 * sizeof(targetSummaryResultStruct));

    for (i = 0; i < arraySize; i++)
    {
        asprintf(&targets[i].target, "TargetStruct: %i", i);
        targets[i].rowID = i;
    }


    for (i = 0; i < arraySize; i++)
    {
        asprintf(&targetSummaryResult[i].target, "Target: %s", targets[i].target);
        free(targets[i].target);
        printf("%s\n", targetSummaryResult[i].target);
        targetSummaryResult[i].callAttempts = i * 10;

       fprintf(csvFile, "%s = %i\n", targetSummaryResult[i].target, targetSummaryResult[i].callAttempts);
       free(targetSummaryResult[i].target);
    }
    fclose(csvFile);
    printf("Structure completed");
    free(targetSummaryResult);
    free(targets);

    return (EXIT_SUCCESS);
}

我正在 malloc'ing 内存，目的是说它的 arraySize + 10。原因是我试图调试的程序分配了比实际需要更多的数组元素，所以我正在测试这是否是一个潜在的问题，所以尽管数组大了 10 个元素，但我实际上只将 0 填充到 arraySize，剩下的 10 个元素。

下面是我的结构是如何定义的

typedef struct TargetSummaryResultStruct
{
    char * target;
    int callAttempts;
} targetSummaryResultStruct;

typedef struct TargetsStruct
{
    char * target;
    int rowID;
} targetsStruct;

下面是我的 valgrind 报告:

==10244== HEAP SUMMARY:
==10244==     in use at exit: 0 bytes in 0 blocks
==10244==   total heap usage: 43 allocs, 43 frees, 2,892 bytes allocated
==10244==
==10244== All heap blocks were freed -- no leaks are possible
==10244==
==10244== ERROR SUMMARY: 20 errors from 5 contexts (suppressed: 12 from 8)
==10244==
==10244== 4 errors in context 1 of 5:
==10244== Invalid read of size 4
==10244==    at 0x8048619: main (main.c:48)
==10244==  Address 0x40181e8 is 48 bytes inside a block of size 50 alloc'd
==10244==    at 0x40072D5: malloc (vg_replace_malloc.c:291)
==10244==    by 0x804856D: main (main.c:35)
==10244==
==10244==
==10244== 4 errors in context 2 of 5:
==10244== Invalid read of size 4
==10244==    at 0x80485EC: main (main.c:47)
==10244==  Address 0x40181e8 is 48 bytes inside a block of size 50 alloc'd
==10244==    at 0x40072D5: malloc (vg_replace_malloc.c:291)
==10244==    by 0x804856D: main (main.c:35)
==10244==
==10244==
==10244== 4 errors in context 3 of 5:
==10244== Invalid write of size 4
==10244==    at 0x80485C2: main (main.c:41)
==10244==  Address 0x40181ec is 2 bytes after a block of size 50 alloc'd
==10244==    at 0x40072D5: malloc (vg_replace_malloc.c:291)
==10244==    by 0x804856D: main (main.c:35)
==10244==
==10244==
==10244== 4 errors in context 4 of 5:
==10244== Invalid read of size 4
==10244==    at 0xAF770B: vasprintf (in /lib/libc-2.12.so)
==10244==    by 0xAD956A: asprintf (in /lib/libc-2.12.so)
==10244==    by 0x80485B2: main (main.c:40)
==10244==  Address 0x40181e8 is 48 bytes inside a block of size 50 alloc'd
==10244==    at 0x40072D5: malloc (vg_replace_malloc.c:291)
==10244==    by 0x804856D: main (main.c:35)
==10244==
==10244==
==10244== 4 errors in context 5 of 5:
==10244== Invalid write of size 4
==10244==    at 0xAF76DD: vasprintf (in /lib/libc-2.12.so)
==10244==    by 0xAD956A: asprintf (in /lib/libc-2.12.so)
==10244==    by 0x80485B2: main (main.c:40)
==10244==  Address 0x40181e8 is 48 bytes inside a block of size 50 alloc'd
==10244==    at 0x40072D5: malloc (vg_replace_malloc.c:291)
==10244==    by 0x804856D: main (main.c:35)
==10244==
--10244--
--10244-- used_suppression:     12 U1004-ARM-_dl_relocate_object /usr/local/lib/valgrind/default.supp:1391
==10244==
==10244== ERROR SUMMARY: 20 errors from 5 contexts (suppressed: 12 from 8)

我不确定如何修复这些错误，我对无效读取的理解是我正在尝试访问一些可能已经释放但部分内存未释放的内存一些原因。

我是 C 的新手。

Answer 1

有一个算术优先级错误。 * 在 + 之前计算，因此您得到一个大小错误的内存块。同样在开始 malloc 时，您正在分配内存以保存 targetsStruct 的指针，而不是结构本身。

targets = malloc((arraySize + 10) * sizeof(targetsStruct)); //change targets to targetsStruct
targetSummaryResult = malloc((arraySize + 10) * sizeof(targetSummaryResultStruct));