类似 Getline 的函数崩溃答案

【问题标题】：Getline-like function crashing类似 Getline 的函数崩溃
【发布时间】：2018-06-26 15:30:17
【问题描述】：

我目前正在学习编程，并且正在上第一年。我们目前正在研究 C，我们的任务是创建一个有点像 getline() 的函数，但不同之处在于该函数只接受一个文件描述符作为参数并且将返回每次调用一个 malloc'd 字符串，该字符串表示文件中与文件描述符相对应的下一行。

函数返回的行不能包含任何'\n'字符，当没有任何内容可读取或函数遇到错误时必须返回NULL。我们也仅限于以下功能：read、malloc 和 free。

我已经编写了以下代码（对不起，如果很难阅读，我还在学习，我们在编写代码时要遵循“编码风格”）：

#include "get_next_line.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>

int find_n(char *str)
{
    int i = 0;

    while (str[i] != '\0') {
        if (str[i] == '\n')
            return (i);
        i++;
    }
    return (0);
}

static char *my_realloc(char *str, unsigned int size, unsigned int start_at)
{
    int i = 0;
    char *new_str;

    new_str = malloc(size);
    while (str[i + start_at] != '\0') {
        new_str[i] = str[i + start_at];
        i++;
    }
    if (str[i + start_at] == '\0')
        new_str[i] ==  '\0';
    free(str);
    return (new_str);
}

static char *get_line(char *str, unsigned int *total_read)
{
    int i = find_n(str);
    int j = 0;
    int len = 0;
    char *line = malloc(i + 1);

    while (j < i) {
        line[j] = str[j];
        j++;
    }
    line[j] = '\0';
    while (str[i + 1 + len] != '\0') {
        len++;
    }
    *total_read = len;
    str = my_realloc(str, len + 1, i + 1);
    return (line);
}

static void my_strcat(char *dest, char const *src)
{
    int dest_len = 0;
    int i = 0;

    while (dest[i] != '\0') {
        i++;
    }
    dest_len = i;
    i = 0;
    while (src[i] != '\0') {
        dest[dest_len + i] = src[i];
        i++;
    }
    dest[dest_len + i] = '\0';
}

static char *get_text(int fd, char *str)
{
    char *buf;
    int n_read = READ_SIZE;
    static unsigned int total_read = 0;
    int loop_started = 0;

    buf = malloc(READ_SIZE + 1);
    buf[0] = '\0';
    while (n_read == READ_SIZE) {
        n_read = read(fd, buf, READ_SIZE);
        if (n_read == -1 || (n_read == 0 && !loop_started)) {
            free(str);
            free(buf);
            return (NULL);
        }
        buf[n_read] = '\0';
        total_read += n_read;
        str = my_realloc(str, total_read + 1, 0);
        my_strcat(str, buf);
        loop_started = 1;
        if (find_n(buf)) {
            break;
        }
    }
    free(buf);
    return (get_line(str, &total_read));
}

char *get_next_line(int fd)
{
    static char *str;
    int is_str_malloced = 0;

    if (!is_str_malloced) {
        str = malloc(1);
        str[0] = '\0';
        is_str_malloced = 1;
    }
    return(get_text(fd, str));
}

int main(void)
{
    char *str;
    int fd;

    fd = open("script", O_RDONLY);
    while (1) {
        str = get_next_line(fd);
        if (str == NULL) {
            close(fd);
            return (0);
        }
        printf("%s\n", str);
    }
    close(fd);
    return (0);
}

主要功能几乎仅用于测试目的。当我编译和测试这个时，我得到：

*** Error in `./a.out': free(): invalid next size (normal): 0x0000000000ed71b0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7cbac)[0x7f67d51a5bac]
/lib64/libc.so.6(+0x87a59)[0x7f67d51b0a59]
/lib64/libc.so.6(cfree+0x16e)[0x7f67d51b63be]
./a.out[0x40071b]
./a.out[0x40095f]
./a.out[0x400a07]
./a.out[0x400a32]
/lib64/libc.so.6(__libc_start_main+0xea)[0x7f67d514988a]
./a.out[0x40059a]
======= Memory map: ========
00400000-00401000 r-xp 00000000 103:05 22939320                          /home/ldidierjean/delivery/CPE_getnextline_2017/a.out
00600000-00601000 r--p 00000000 103:05 22939320                          /home/ldidierjean/delivery/CPE_getnextline_2017/a.out
00601000-00602000 rw-p 00001000 103:05 22939320                          /home/ldidierjean/delivery/CPE_getnextline_2017/a.out
00ed7000-00ef8000 rw-p 00000000 00:00 0                                  [heap]
7f67d0000000-7f67d0021000 rw-p 00000000 00:00 0 
7f67d0021000-7f67d4000000 ---p 00000000 00:00 0 
7f67d4f12000-7f67d4f28000 r-xp 00000000 103:05 7210485                   /usr/lib64/libgcc_s-7-20170915.so.1
7f67d4f28000-7f67d5127000 ---p 00016000 103:05 7210485                   /usr/lib64/libgcc_s-7-20170915.so.1
7f67d5127000-7f67d5128000 r--p 00015000 103:05 7210485                   /usr/lib64/libgcc_s-7-20170915.so.1
7f67d5128000-7f67d5129000 rw-p 00016000 103:05 7210485                   /usr/lib64/libgcc_s-7-20170915.so.1
7f67d5129000-7f67d52f4000 r-xp 00000000 103:05 7217643                   /usr/lib64/libc-2.25.so
7f67d52f4000-7f67d54f4000 ---p 001cb000 103:05 7217643                   /usr/lib64/libc-2.25.so
7f67d54f4000-7f67d54f8000 r--p 001cb000 103:05 7217643                   /usr/lib64/libc-2.25.so
7f67d54f8000-7f67d54fa000 rw-p 001cf000 103:05 7217643                   /usr/lib64/libc-2.25.so
7f67d54fa000-7f67d54fe000 rw-p 00000000 00:00 0 
7f67d54fe000-7f67d5525000 r-xp 00000000 103:05 7219338                   /usr/lib64/ld-2.25.so
7f67d56f6000-7f67d56f9000 rw-p 00000000 00:00 0 
7f67d5721000-7f67d5724000 rw-p 00000000 00:00 0 
7f67d5724000-7f67d5725000 r--p 00026000 103:05 7219338                   /usr/lib64/ld-2.25.so
7f67d5725000-7f67d5727000 rw-p 00027000 103:05 7219338                   /usr/lib64/ld-2.25.so
7fff51a9b000-7fff51abd000 rw-p 00000000 00:00 0                          [stack]
7fff51ac2000-7fff51ac5000 r--p 00000000 00:00 0                          [vvar]
7fff51ac5000-7fff51ac7000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Abandon (core dumped)

Valgrind 给我：

==6142== Memcheck, a memory error detector
==6142== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==6142== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==6142== Command: ./a.out --track-origins=yes
==6142== 
==6142== Conditional jump or move depends on uninitialised value(s)
==6142==    at 0x400824: my_strcat (get_next_line.c:67)
==6142==    by 0x400960: get_text (get_next_line.c:98)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid read of size 1
==6142==    at 0x40081F: my_strcat (get_next_line.c:67)
==6142==    by 0x400960: get_text (get_next_line.c:98)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214257 is 0 bytes after a block of size 16,759 alloc'd
==6142==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==6142==    by 0x4006B3: my_realloc (get_next_line.c:31)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid write of size 1
==6142==    at 0x400857: my_strcat (get_next_line.c:73)
==6142==    by 0x400960: get_text (get_next_line.c:98)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214270 is 16 bytes after a block of size 16,768 in arena "client"
==6142== 
==6142== Invalid write of size 1
==6142==    at 0x400883: my_strcat (get_next_line.c:76)
==6142==    by 0x400960: get_text (get_next_line.c:98)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214277 is 23 bytes after a block of size 16,768 in arena "client"
==6142== 
==6142== Conditional jump or move depends on uninitialised value(s)
==6142==    at 0x4006F7: my_realloc (get_next_line.c:32)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid read of size 1
==6142==    at 0x4006F2: my_realloc (get_next_line.c:32)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214257 is 0 bytes after a block of size 16,759 alloc'd
==6142==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==6142==    by 0x4006B3: my_realloc (get_next_line.c:31)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid read of size 1
==6142==    at 0x4006D8: my_realloc (get_next_line.c:33)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214257 is 0 bytes after a block of size 16,759 alloc'd
==6142==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==6142==    by 0x4006B3: my_realloc (get_next_line.c:31)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid write of size 1
==6142==    at 0x4006DB: my_realloc (get_next_line.c:33)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x521841e is 0 bytes after a block of size 16,766 alloc'd
==6142==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==6142==    by 0x4006B3: my_realloc (get_next_line.c:31)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142== 
==6142== Invalid read of size 1
==6142==    at 0x40070A: my_realloc (get_next_line.c:36)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)
==6142==  Address 0x5214277 is 23 bytes after a block of size 16,768 in arena "client"
==6142== 
--6142-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--6142-- si_code=1;  Faulting address: 0x206991B288;  sp: 0x1002ba9e30

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==6142==    at 0x5804F2DC: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==6142==    by 0x5800B304: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==6142==    by 0x5800B4D2: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==6142==    by 0x58098653: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==6142==    by 0x580A7256: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 6142)
==6142==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==6142==    by 0x4006B3: my_realloc (get_next_line.c:31)
==6142==    by 0x400949: get_text (get_next_line.c:97)
==6142==    by 0x4009F1: get_next_line (get_next_line.c:118)
==6142==    by 0x400A1C: main (get_next_line.c:128)


Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using.  Thanks.

看起来 my_realloc 函数中的 free() 导致程序崩溃，但我完全不知道为什么，有人可以帮助我吗？

【问题讨论】：

在没有头文件内容的情况下我们如何测试这个：get_next_line.h?
通常，当对free() 的调用崩溃时，这意味着堆已损坏。这通常是由于堆中分配的缓冲区溢出造成的。
在调用任何堆分配函数时：( malloc, calloc, realloc )，始终检查 (!=NULL) 返回值以确保操作成功。
在调用open() 时始终检查返回值。值 -1 表示发生错误。发生错误时，调用perror()输出附文及系统认为错误发生的原因stderr
关于：int is_str_malloced = 0; if (!is_str_malloced) is_str_malloced 将始终为 0，因此将始终输入 if 代码块。

标签： c crash malloc valgrind free

【解决方案1】：

重建您的 realloc 可能是个好主意！

想想你给realloc 的start_at 值。

一种更简单的重新分配方法：

char            *my_realloc(char *old, int size)
{
  int           i = 0;
  char          *new;

  new = malloc(sizeof(char) * (my_strlen(old) + size));
  while (old[i] != '\0')
    {
      new[i] = old[i];
      i++;
    }
  free(old);
  return (new);
}

另外，我更喜欢这样malloc：

malloc(sizeof(char) * len);

而且这个项目最好有get_char:

char get_char(const int fd)
{
  static char buff[READ_MAX];
  static char* pointer;
  static int len = 0;
  char caracter;

  if (len == 0)
    {
      len = read(fd, buff, READ_MAX);
      pointer = (char*)&buff;
      if (len == 0)
        return (0);
    }
  caracter = *pointer;
  pointer++;
  len--;
  return caracter;
}

祝你好运！

【讨论】：