2016-02-11 80 views
2

以下几行给出无效读写错误。你能解释我错过了什么吗?我已初始化该变量,但仍然导致错误。无效读写valgrind

==26319== Invalid read of size 4 

==26319== at 0x4035CC: connection_handler (thread.c:26) 

==26319== by 0x4E36A50: start_thread (in /lib64/libpthread-2.12.so) 

==26319== by 0x61E06FF: ??? 

==26319== Address 0x53e02c0 is 0 bytes inside a block of size 1 alloc'd 

==26319== at 0x4C27A2E: malloc (vg_replace_malloc.c:270) 

==26319== by 0x40335C: main (send_server.c:154) 


==26319== 1 errors in context 3 of 3: 

==26319== Thread 1: 

==26319== Invalid write of size 4 

==26319== at 0x4033C3: main (send_server.c:157) 

==26319== Address 0x53e02c0 is 0 bytes inside a block of size 1 alloc'd 

==26319== at 0x4C27A2E: malloc (vg_replace_malloc.c:270) 

==26319== by 0x40335C: main (send_server.c:154) 

代码

int *new_sock = NULL; 

while (1) 
{ 
    client_sock = accept(socket_desc, (struct sockaddr *)&client, (socklen_t*)&c); 

    if (client_sock < 0) 
    { 
     fprintf(stderr,"accept failed\n"); 
     LOGGER("Accept failed\n"); 
     continue; 
    } 

    else 
    { 
     LOGGER("\nConnection accepted\n"); 
     pthread_t sniffer_thread;  //assign thread for each client 
     if (NULL ==(new_sock = malloc(1))) //invalid read 
      continue;  
     printf("VAlue of new sock %p \n",new_sock); 
     *new_sock = client_sock; // invalid write of size 4 

     if (pthread_create(&sniffer_thread , NULL , connection_handler , (void*) new_sock) < 0) //Serving each thread 
     { 
      fprintf(stderr,"could not create thread\n"); 
      LOGGER("ERROR could not create thread\n"); 
      free(new_sock); 

     } 
     pthread_detach(sniffer_thread); 
     LOGGER("Handler assigned\n"); 
    } 

} 

回答

1

您对malloc使用了不正确的参数。您可以通过sizeof(int)获得正确的int大小,通常会得到4.尝试用malloc(sizeof(int))代替malloc(1)

new_sock = malloc(1)分配一个字节的内存,并将该内存的地址分配给变量new_sock

*new_sock = client_sock;将int存储到该区域的存储器中;将四个字节写入内存的一个字节区域会溢出分配。然后,当你试图从分配的内存(据推测在另一个线程中)读取一个int时,从分配的区域读取一个字节,但其他三个字节是从无效内存中读取的。

1

无效读不您发布的代码所示。

无效写入是由于malloc(3)需要以字节为单位分配空间的参数。

您正在分配一个字节,然后用int *指向该字节。因此,当您取消引用指针时,您正在访问的平台上的sizeof(int)字节大于1

尝试使用malloc(sizeof (int))或甚至更好malloc(sizeof *new_sock)来代替。

0

if (NULL ==(new_sock = malloc(1))) 

必须

new_sock = malloc(sizeof(int)); 
if(new_sock == NULL) 
    continue; 

malloc采取size_t参数是大小要分配的内存量的字节。 在你的情况下,你想要为int变量存储空间,那么sizeof(int)将返回正确的大小以进行分配。