c - Valgrind:条件跳转或移动取决于未初始化的值(指针的指针)

Question

我有一个小程序，可以读取带有 IP 的文件(每行一个)并将其保存在内存中。程序运行得很好，但 valgrind 给了我一个错误。我使用了指针的指针，但我看不出问题所在。我认为它可能来自第二个 malloc，但我尝试初始化它，但没有任何改变。

char file_IP[] = "file";
char **IP = NULL;

int loadIP(){

  int lines = 0, i = 0;
  char line[16] = "";
  FILE *contr = fopen(file_IP, "r");

  if (contr == NULL){
    printf("***ERROR: Something went wrong while opening file %s\n", file_IP);
    return -1;
  }
  while (fgets(line, sizeof(line), contr) != NULL) {
    lines++;
  }

   IP = (char **)malloc((sizeof(char *)*lines)+1);
   memset(IP, 0x00, lines+1);
   rewind(contr);

   while (fgets(line, sizeof(line), contr) != NULL) {
     IP[i] = malloc((sizeof(char))*strlen(line));
     line[strlen(line)-1] = '\0';
     strncpy(IP[i], line, strlen(line)+1);
     i++;
   }

   fclose(contr);
   return 0;
   }

   int main(){

   clock_t begin = clock();

   int i = 0;

   if (loadIP() == -1){
     printf("ERROR: While loading IP, something failed!");
     return -1;
   }

   while(IP[i] != NULL){
    free(IP[i]);
    IP[i] = NULL;
    i++;
   }

   free(IP);
   IP = NULL;

   clock_t end = clock();
   double time_spent = (double)(end - begin) / CLOCKS_PER_SEC;
   printf("The program took %f seconds to run.\n", time_spent);

   return 1;

   }

这是 valgrind 的结果:

$valgrind --leak-check=full --track-origins=yes --show-leak-kinds=all -v ./anteater
==32203== Memcheck, a memory error detector
==32203== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==32203== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==32203== Command: ./anteater
==32203==
--32203-- Valgrind options:
--32203--    --leak-check=full
--32203--    --track-origins=yes
--32203--    --show-leak-kinds=all
--32203--    -v
--32203--
--32203-- Arch and hwcaps: AMD64, LittleEndian, amd64-cx16-rdtscp-sse3-avx
--32203-- Page sizes: currently 4096, max supported 4096
--32203-- Valgrind library directory: /usr/lib64/valgrind
--32203-- Reading syms from /anteater
--32203-- Reading syms from /usr/lib64/ld-2.17.so
--32203-- Reading syms from /usr/lib64/valgrind/memcheck-amd64-linux
--32203--    object doesn't have a symbol table
--32203--    object doesn't have a dynamic symbol table
--32203-- Scheduler: using generic scheduler lock implementation.
--32203-- Reading suppressions file: /usr/lib64/valgrind/default.supp
==32203== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-32203-
==32203== embedded gdbserver: writing to   /tmp/vgdb-pipe-to-vgdb-from-32203-
==32203== embedded gdbserver: shared mem   /tmp/vgdb-pipe-shared-mem-vgdb-32203-
==32203==
==32203== TO CONTROL THIS PROCESS USING vgdb (which you probably
==32203== don't want to do, unless you know exactly what you're doing,
==32203== or are doing some strange experiment):
==32203==   /usr/lib64/valgrind/../../bin/vgdb --pid=32203 ...command...
==32203==
==32203== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==32203==   /path/to/gdb ./anteater
==32203== and then give GDB the following command
==32203==   target remote | /usr/lib64/valgrind/../../bin/vgdb --pid=32203
==32203== --pid is optional if only one valgrind process is running
==32203==
--32203-- REDIR: 0x4018b90 (ld-linux-x86-64.so.2:strlen) redirected to 0x38058d51 (???)
--32203-- REDIR: 0x4018a90 (ld-linux-x86-64.so.2:index) redirected to 0x38058d6b (???)
--32203-- Reading syms from /usr/lib64/valgrind/vgpreload_core-amd64-linux.so
--32203-- Reading syms from /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so
==32203== WARNING: new redirection conflicts with existing -- ignoring it
--32203--     old: 0x04018b90 (strlen              ) R-> (0000.0) 0x38058d51 ???
--32203--     new: 0x04018b90 (strlen              ) R-> (2007.0) 0x04c2ca90 strlen
--32203-- REDIR: 0x4018b10 (ld-linux-x86-64.so.2:strcmp) redirected to 0x4c2dbe0 (strcmp)
--32203-- REDIR: 0x4019c40 (ld-linux-x86-64.so.2:mempcpy) redirected to 0x4c30c60 (mempcpy)
--32203-- Reading syms from /usr/lib64/libc-2.17.so
--32203-- REDIR: 0x4ec0060 (libc.so.6:strcasecmp) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ebc410 (libc.so.6:strnlen) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ec2330 (libc.so.6:strncasecmp) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ebee70 (libc.so.6:memset) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ebee20 (libc.so.6:memcpy@GLIBC_2.2.5) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ebde00 (libc.so.6:__GI_strrchr) redirected to 0x4c2c450 (__GI_strrchr)
--32203-- REDIR: 0x4ebc330 (libc.so.6:__GI_strlen) redirected to 0x4c2c9f0 (__GI_strlen)
***WARNING: Debug is active!
--32203-- REDIR: 0x4eb5890 (libc.so.6:malloc) redirected to 0x4c29b5c (malloc)
--32203-- REDIR: 0x4ed42b0 (libc.so.6:__GI_strstr) redirected to 0x4c30ef0 (__strstr_sse2)
--32203-- REDIR: 0x4ebe500 (libc.so.6:memchr) redirected to 0x4c2dc80 (memchr)
--32203-- REDIR: 0x4ec4a50 (libc.so.6:__GI_memcpy) redirected to 0x4c2e580 (__GI_memcpy)
--32203-- REDIR: 0x4ebeeb0 (libc.so.6:__GI_memset) redirected to 0x4c2fe80 (memset)
--32203-- REDIR: 0x4ebc2e0 (libc.so.6:strlen) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4f98950 (libc.so.6:__strlen_sse2_pminub) redirected to 0x4c2c9d0 (strlen)
--32203-- REDIR: 0x4ebdd80 (libc.so.6:strncpy) redirected to 0x4a247b0 (_vgnU_ifunc_wrapper)
--32203-- REDIR: 0x4ecaf10 (libc.so.6:__strncpy_sse2_unaligned) redirected to 0x4c2d060 (__strncpy_sse2_unaligned)
--32203-- REDIR: 0x4eb5c90 (libc.so.6:free) redirected to 0x4c2ac56 (free)
==32203== Conditional jump or move depends on uninitialised value(s)
==32203==    at 0x400A6B: main (in /anteater)
==32203==  Uninitialised value was created by a heap allocation
==32203==    at 0x4C29BE3: malloc (vg_replace_malloc.c:299)
==32203==    by 0x4008E3: loadIP (in /anteater)
==32203==    by 0x4009F2: main (in /anteater)
==32203==
--32203-- REDIR: 0x4ec62e0 (libc.so.6:strchrnul) redirected to 0x4c30780 (strchrnul)
--32203-- REDIR: 0x4ebfa10 (libc.so.6:__GI_mempcpy) redirected to 0x4c30990 (__GI_mempcpy)
The program took 0.030000 seconds to run.
==32203==
==32203== HEAP SUMMARY:
==32203==     in use at exit: 0 bytes in 0 blocks
==32203==   total heap usage: 6 allocs, 6 frees, 657 bytes allocated
==32203==
==32203== All heap blocks were freed -- no leaks are possible
==32203==
==32203== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==32203==
==32203== 1 errors in context 1 of 1:
==32203== Conditional jump or move depends on uninitialised value(s)
==32203==    at 0x400A6B: main (in /anteater)
==32203==  Uninitialised value was created by a heap allocation
==32203==    at 0x4C29BE3: malloc (vg_replace_malloc.c:299)
==32203==    by 0x4008E3: loadIP (in /anteater)
==32203==    by 0x4009F2: main (in /anteater)
==32203==
==32203== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

感谢您的帮助!

Answer 1

while(IP[i] != NULL)

这最终将达到值 i在这种情况下，它将访问一些甚至没有由您分配的内存，并且还将读取未初始化的值(您的 memset 用法是错误的)。这会在代码中调用未定义的行为。

你的分配逻辑有点奇怪，

IP = (char **)malloc((sizeof(char *)*lines)+1);

将会

IP = malloc((sizeof(char *)*(lines+1));

现在您将分配一个比您需要的额外的指针变量 - 将使用值 0 对其进行初始化。 (不需要在 malloc 中进行转换)。

您对memset的使用应该是memset(IP, 0, (lines+1)*sizeof(char*)); 。这将确保该内存块上的所有指针变量都是 0已初始化。