错误消息：***检测到 glibc *** ./cube：双重释放或损坏（！prev）：0x0a4c4420 ***答案

【问题标题】：Error message: *** glibc detected *** ./cube: double free or corruption (!prev): 0x0a4c4420 ***错误消息：***检测到 glibc *** ./cube：双重释放或损坏（！prev）：0x0a4c4420 ***
【发布时间】：2011-10-01 01:23:57
【问题描述】：

在下面的代码中我得到一个错误：

333         glGenBuffers(surftotal, uiVBO);
334         {
335                 for(surfnum=0; surfnum<surftotal; ++surfnum)
336                 {
337                         glBindBuffer(GL_ARRAY_BUFFER, uiVBO[surfnum]);
338                         size_t buf_size = 9*sizeof(GLfloat)*triNum[surfnum];
339                         GLfloat* const pData = (GLfloat*)malloc(buf_size);
340                         for(i=0; i<triNum[surfnum]; ++i)
341                                 printf("%d...",triNum[surfnum]);
342                                 {
343                                 memcpy(pData+i*9,   triArray[surfnum][i].pt1, 3*sizeof(GLfloat));
344                                 memcpy(pData+i*9+3, triArray[surfnum][i].pt2, 3*sizeof(GLfloat));
345                                 memcpy(pData+i*9+6, triArray[surfnum][i].pt3, 3*sizeof(GLfloat));
346                                 }
347                                 glBufferData(GL_ARRAY_BUFFER, buf_size, pData, GL_STATIC_DRAW);
348                                 free(pData);
349                 }
350                 glBindBuffer(GL_ARRAY_BUFFER, 0);
351                 glEnableVertexAttribArray(VERTEX_ARRAY);
352                 for(surfnum=0; surfnum<surftotal; ++surfnum)
353                 {
354                         glBindBuffer(GL_ARRAY_BUFFER, uiVBO[surfnum]);
355                         glVertexAttribPointer(VERTEX_ARRAY, 3, GL_FLOAT, GL_FALSE, 0, 0);
356                         glDrawArrays(GL_TRIANGLES, 0, 3*triNum[surfnum]);
357                         if (!TestEGLError("glDrawArrays"))
358                         {
359                         goto cleanup;
360                         }
361                 }
362                 glBindBuffer(GL_ARRAY_BUFFER, 0);
363                 eglSwapBuffers(eglDisplay, eglSurface);
364 
365                 if (!TestEGLError("eglSwapBuffers"))
366                 {
367                         goto cleanup;
368                 }
369 
370                 int i32NumMessages = XPending( x11Display );
371                 for( int i = 0; i < i32NumMessages; i++ )
372                 {
373                         XEvent  event;
374                         XNextEvent( x11Display, &event );
375                 }
376         }
377         glDeleteBuffers(surftotal,uiVBO);

错误如下：

* 检测到 glibc ./cube: free(): invalid pointer: 0x090c53a0 **

printf 收到错误，它写入7 7 7 7 7 7 7 1 aborted，然后写入此错误。

当我尝试在那里打印时出现此错误。我尝试使用valgrind，它的输出是：

==8922== Memcheck, a memory error detector
==8922== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==8922== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==8922== Command: ./cube
==8922== 
libEGL warning: use software fallback
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391567 is 11 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391566 is 10 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391565 is 9 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391564 is 8 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391573 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391572 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391571 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391570 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157f is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157e is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157d is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157c is not stack'd, malloc'd or (recently) free'd
==8922== 
--8922-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--8922-- si_code=1;  Faulting address: 0xC8B91574;  sp: 0x62a5ce00

valgrind: the 'impossible' happened:
   Killed by fatal signal
==8922==    at 0x38031511: unlinkBlock (m_mallocfree.c:245)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==8922==    at 0x4024F12: calloc (vg_replace_malloc.c:467)
==8922==    by 0x48D068A: softpipe_resource_create (sp_texture.c:114)
==8922==    by 0x4A50D96: st_bufferobj_data (u_inlines.h:180)
==8922==    by 0x4A1BB4E: _mesa_BufferDataARB (bufferobj.c:1177)
==8922==    by 0x49BFFD7: _es_BufferData (api_exec_es2.c:391)
==8922==    by 0x804A561: main (Hello.cpp:347)

但我无法理解它。你能告诉我错误在哪里吗？如果我使用

导出 MALLOC_CHECK_=0

这会导致分段错误。

（我已经编辑了问题）

【问题讨论】：

您似乎遗漏了行号信息，请尝试通过完整调试重新构建。
你是什么意思所有这些 valgrind 命令“valgrind --leak-check=yes ./cube”给我粘贴了它..
@surbhi：Frank 的意思是你应该在编译和链接时将-g 选项传递给你的编译器（GCC ？），以便cube 可执行文件嵌入了调试信息。然后，Valgrind 可以打印错误发生在代码的哪一行（就像 memcpy 和 malloc 一样）。
您好我已经编辑了问题以给行编号，现在您可以在代码和调试代码中看到它
可能需要更多上下文。什么是triArray[surfnum][i].pt1 之类的？它们是有效的指针吗？不过，据我所知，这是一个只能通过调试才能解决的问题，因为查看这段代码可能不会告诉我们太多信息。

标签： c memory opengl-es valgrind glibc

【解决方案1】：

for(i=0; i<triNum[surfnum]; ++i)
    printf("%d...",triNum[surfnum]);
    {
    memcpy(pData+i*9,   triArray[surfnum][i].pt1, 3*sizeof(GLfloat));
    memcpy(pData+i*9+3, triArray[surfnum][i].pt2, 3*sizeof(GLfloat));
    memcpy(pData+i*9+6, triArray[surfnum][i].pt3, 3*sizeof(GLfloat));
    }

这里的大括号放置有问题。只有printf 在循环内，因此memcpy 行只会运行一次，i 的值太大。

这将覆盖缓冲区边界之外的内存，从而导致您看到的内存损坏错误。

【讨论】：