c - Valgrind 报告 "conditional jump depends on uninitialized value"；教授说应该检查字符串

Question

当 valgrind 运行这个程序(实现一种简单类型的数据压缩)时，它会报告“条件跳转取决于未初始化的值”。它偶尔也会出现段错误。问题是，我似乎无法确定哪个变量未初始化。我的 CS 教授提到“您的代码无法确保字符串正确地以 null 结尾”，但我看不到哪里。

https://gist.github.com/anonymous/9f6c87fb33985606a297

(编辑 - 在此处添加实际代码:)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define WORDLIM 128
#define REPEAT for(;;)
struct word {
    char *cont;
    char *wsp;  
    int ctr;
}; 

char peekchar(void)
{
    char c;
    c = getchar();
    if(c != EOF) 
        ungetc(c, stdin);

    /* puts it back */    
    return c;
} 

struct word *getword()
{
    char cont[WORDLIM];
    char wsp[WORDLIM];
    cont[0] = '\0';
    wsp[0] = '\0';
    if (peekchar() == EOF) 
    {
        return NULL;
    }

    REPEAT{
        char c = getchar();
        char buf[2];
        buf[0]=c;
        buf[1]='\0';
        if (c == '\n' || c == ' ' || c == EOF)
        {
            if (c != EOF)
                strcat(wsp, buf);
            if (peekchar() != '\n' && peekchar() != ' ')
            {
                struct word *toret;
                toret = malloc(sizeof(struct word));
                toret->cont = malloc(strlen(cont) + 1);
                strcpy(toret->cont, cont);
                toret->wsp = malloc(strlen(wsp) + 1);
                strcpy(toret->wsp, wsp);
                toret->ctr = -1;
                return toret;
            }
            continue;
        }
        else {
            strcat(cont, buf);
            continue;
        }
    }
    printf("PANIC PANIC PANIC THIS IS GOING WROOOOONG!!!!!\n");
}

void numbrify(struct word **wordlist)
{
    int oc = 0;
    int roc = oc;
    struct word *w;
    while ((w = wordlist[oc]) != NULL){
        int ic;
        if (w->ctr == -1){
            for (ic = oc + 1; wordlist[ic] != NULL; ic++){
                if (!strcmp(wordlist[ic]->cont, w->cont)){
                    //printf("**found match between %s and %s**\n", wordlist[ic]->cont, w->cont);
                    wordlist[ic]->ctr = roc;
                }
            }
            if (w->cont[0]!='\0')
        roc++;
        }
        oc++;
    }
} 

int main(void){
    struct word *wlist[4096];
    int i = 0;
    struct word *w;
    for (i = 0; (w = getword()) != NULL; i++){
        wlist[i]=w;
    }

    wlist[i+1] = NULL;
    numbrify(wlist);
    i = 0;
    for (i = 0; wlist[i]!=NULL; i++){
        if (wlist[i]->ctr == -1) 
            printf("%s%s", wlist[i]->cont, wlist[i]->wsp);
        else 
            printf("%d%s", wlist[i]->ctr, wlist[i]->wsp);
            //printf("'%s'\t'%s'\t%d\n", wlist[i]->cont, wlist[i]->wsp, wlist[i]->ctr);
    }

    return 0;
}

Answer 1

在程序的第 85 行:

wlist[i+1] = NULL;

i 已经指向数组中未使用的条目，因此将 NULL 分配给 wlist[i+1] 会在之前留下未定义的值结束。

我通过运行 Clang static analyzer 来确定这一点*，它在前两个诊断中确定了这个问题(以及与第三个诊断无关的无害错误):

14968829.c:62:12: warning: Assigned value is garbage or undefined
        while ((w = wordlist[oc]) != NULL){
                  ^ ~~~~~~~~~~~~
14968829.c:65:35: warning: The left operand of '!=' is a garbage value
                        for (ic = oc + 1; wordlist[ic] != NULL; ic++){
                                          ~~~~~~~~~~~~ ^
14968829.c:87:2: warning: Value stored to 'i' is never read
        i = 0;
        ^   ~

更正问题(通过将 wlist[i+1] 更改为 wlist[i])导致两个 Clang 诊断以及 Valgrind 错误消失。

*:命令行:clang --analyze -Wall 14968829.c -o 14968829