为什么 Valgrind 在 calloc 语句上显示内存泄漏

Question

我正在尝试学习一些东西（只是作为一种爱好）并尝试学习使用 Valgrind。然而，这对我来说似乎没有意义。 Valgrind 似乎在说，当我在使用任何东西之前用 calloc 分配字节时，字节会丢失！有人可以解释这里发生了什么以及为什么第二个程序有效吗？我在 Eclipse 中以调试模式编译程序并在调试可执行文件上运行 Valgrind。

这是程序：

1 #include <stdlib.h>
2 #include <stdio.h>
3 #include <string.h>
4
5 int main(void) {
6
7     char* origstr = calloc(37, sizeof(char*));
8     char* newsubstr = calloc(9, sizeof(char*));
9
10    origstr = "TheQuickBrownFoxJumpedOverTheLazyDog";
11
12    strncpy(newsubstr, origstr + 8, 8);
13    printf("SubString is: %s\n", newsubstr);
14
15    free(newsubstr);
16    free(origstr);
17    return 0;
18 }

这是 Valgrind 给我的：

$ valgrind --tool=memcheck --leak-check=full ./test
==25404== Memcheck, a memory error detector
==25404== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==25404== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==25404== Command: ./test
==25404== 
SubString is: BrownFox
==25404== Invalid free() / delete / delete[] / realloc()
==25404==    at 0x4C29E90: free (vg_replace_malloc.c:473)
==25404==    by 0x400665: main (test.c:16)
==25404==  Address 0x4006f8 is not stack'd, malloc'd or (recently) free'd
==25404== 
==25404== 
==25404== HEAP SUMMARY:
==25404==     in use at exit: 296 bytes in 1 blocks
==25404==   total heap usage: 2 allocs, 2 frees, 368 bytes allocated
==25404== 
==25404== 296 bytes in 1 blocks are definitely lost in loss record 1 of 1
==25404==    at 0x4C2AD10: calloc (vg_replace_malloc.c:623)
==25404==    by 0x4005FC: main (test.c:7)
==25404== 
==25404== LEAK SUMMARY:
==25404==    definitely lost: 296 bytes in 1 blocks
==25404==    indirectly lost: 0 bytes in 0 blocks
==25404==      possibly lost: 0 bytes in 0 blocks
==25404==    still reachable: 0 bytes in 0 blocks
==25404==         suppressed: 0 bytes in 0 blocks
==25404== 
==25404== For counts of detected and suppressed errors, rerun with: -v
==25404== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

如果我删除了两个 free() 语句，Valgrind 给我的结果如下：

$ valgrind --tool=memcheck --leak-check=full ./test
==25597== Memcheck, a memory error detector
==25597== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==25597== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==25597== Command: ./test
==25597== 
SubString is: BrownFox
==25597== 
==25597== HEAP SUMMARY:
==25597==     in use at exit: 368 bytes in 2 blocks
==25597==   total heap usage: 2 allocs, 0 frees, 368 bytes allocated
==25597== 
==25597== 72 bytes in 1 blocks are definitely lost in loss record 1 of 2
==25597==    at 0x4C2AD10: calloc (vg_replace_malloc.c:623)
==25597==    by 0x4005BF: main (test.c:8)
==25597== 
==25597== 296 bytes in 1 blocks are definitely lost in loss record 2 of 2
==25597==    at 0x4C2AD10: calloc (vg_replace_malloc.c:623)
==25597==    by 0x4005AC: main (test.c:7)
==25597== 
==25597== LEAK SUMMARY:
==25597==    definitely lost: 368 bytes in 2 blocks
==25597==    indirectly lost: 0 bytes in 0 blocks
==25597==      possibly lost: 0 bytes in 0 blocks
==25597==    still reachable: 0 bytes in 0 blocks
==25597==         suppressed: 0 bytes in 0 blocks
==25597== 
==25597== For counts of detected and suppressed errors, rerun with: -v
==25597== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

现在，如果我运行这个程序：

1 #include <stdlib.h>
2 #include <stdio.h>
3 #include <string.h>
4
5 int main(void) {
6
7    char* origstr;
8    char* newsubstr = calloc(9, sizeof(char*));
9
10   origstr = "TheQuickBrownFoxJumpedOverTheLazyDog";
11
12   strncpy(newsubstr, origstr + 8, 8);
13   printf("SubString is: %s\n", newsubstr);
14
15   free(newsubstr);
16
17   return 0;
18 }

它表明一切都很好：

$ valgrind --tool=memcheck --leak-check=full ./test
==25862== Memcheck, a memory error detector
==25862== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==25862== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==25862== Command: ./test
==25862== 
SubString is: BrownFox
==25862== 
==25862== HEAP SUMMARY:
==25862==     in use at exit: 0 bytes in 0 blocks
==25862==   total heap usage: 1 allocs, 1 frees, 72 bytes allocated
==25862== 
==25862== All heap blocks were freed -- no leaks are possible
==25862== 
==25862== For counts of detected and suppressed errors, rerun with: -v
==25862== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

为什么我不能 calloc（分配） origstr 然后给它一些东西？如果我想分配该变量并在程序过程中将其作为另一个字符串变量中的一部分或使用它来捕获另一个返回字符串的函数的结果怎么办？然后我是否必须像处理 newsubstr 一样处理它？

这让我有点困惑，所以有人可以解释一下它是如何工作的，以便我更好地理解它吗？

Answer 1

origstr = "TheQuickBrownFoxJumpedOverTheLazyDog";

通过这样做，您将更改为 origstr 指向的内容。在此之后 origstr 不指向由 calloc 分配的内存块。

而你free内存不是由calloc或类似函数分配的，从而导致你的程序出错。

使用strcpy 将字符串复制到origstr -

strcpy(origstr,"TheQuickBrownFoxJumpedOverTheLazyDog");

然后你可以free你的指针origstr。

Answer 2

通过将字符串文字分配给origstr，您不要复制字符串，而只是更改origstrs 的值，从而丢失指向calloc 的指针。 freeing origstr 现在会导致未定义的行为。

使用strcpy 或strncpy 将字符串真正存储在堆上。但实际上将calloc 删除为origstr 就足够了。

---

注意事项：

• 正如 @LeeDanielCrocker 在 cmets 中提到的那样，您可能打算为 chars 分配空间，而不是为 char*s 分配空间，从而大大减少了分配内存的大小。您应该将 sizeof(char*) 替换为 sizeof(char) (a.k.a. 1)。

Answer 3

因为存在内存泄漏。你重新分配指针，它实际上是不正确的 free() 它，因为你有它。

要将内容复制到分配的指针，请使用strcpy()

strcpy(origstr, "TheQuickBrownFoxJumpedOverTheLazyDog");

让我们看看如何：

1. 你用calloc()请求内存

   origstring = calloc(9, sizeof(char*))
   

   这是错误的，原因有很多

   1. 您正在为9 指针分配空间，而不是9 字符。
   2. 你真的不需要calloc()，因为你会立即覆盖内容，使用malloc()。

2. 你用字符串覆盖指针

   origstr = "TheQuickBrownFoxJumpedOverTheLazyDog";
   

   现在您丢失了对calloc() 之前返回的指针的引用，并且您不可能free() 它，您应该只返回free() 指针由malloc()/calloc()/realloc() 返回。

事实是，你不需要calloc()oristring指针，calloc()/malloc()不是用来让你赋值给一个指针，而是写到由指向的内存指针，或者更好的是，指向一些你可以读/写的内存。