双免费或腐败崩溃

我有一个从数据库读取/写入的程序（smbanner），最近我添加了一个加密程序来加密DB写入的数据，并在数据库读取时解密它（smbanner does通过调用某些数据库读/写例程在其他地方读取/写入......在这些数据库例程中，我注入了我的密码函数调用）。我还会补充一点，我把它扔到我的腿上，而C远不及我的第一语言，所以请善待！双免费或腐败崩溃

所有我的代码编译得很好，cppcheck静态分析表明它很好，多个环境运行它就好了......除了一个。在这种环境中，我得到如下：

[[email protected] update]# *** glibc detected *** /home/silentm/bin/smbanner: double free or corruption (!prev): 0x000000000455e750 *** 
======= Backtrace: ========= 
/lib64/libc.so.6[0x374e075e66] 
/lib64/libc.so.6[0x374e0789b3] 
/lib64/libc.so.6(fclose+0x14d)[0x374e0664cd] 
/home/silentm/bin/smbanner[0x4b6ffb] 
/home/silentm/bin/smbanner[0x480f00] 
/home/silentm/bin/smbanner[0x40dcac] 
/lib64/libc.so.6(__libc_start_main+0xfd)[0x374e01ed5d] 
/home/silentm/bin/smbanner[0x403849] 
======= Memory map: ======== 
00400000-00613000 r-xp 00000000 09:01 25886937       /home/silentm/bin/smbanner 
00813000-008e7000 rw-p 00213000 09:01 25886937       /home/silentm/bin/smbanner 
008e7000-00b11000 rw-p 00000000 00:00 0 
01091000-0456f000 rw-p 00000000 00:00 0         [heap] 
3569000000-35691b9000 r-xp 00000000 09:00 917372       /usr/lib64/libcrypto.so.1.0.1e 
35691b9000-35693b8000 ---p 001b9000 09:00 917372       /usr/lib64/libcrypto.so.1.0.1e 
35693b8000-35693d3000 r--p 001b8000 09:00 917372       /usr/lib64/libcrypto.so.1.0.1e 
35693d3000-35693df000 rw-p 001d3000 09:00 917372       /usr/lib64/libcrypto.so.1.0.1e 
35693df000-35693e3000 rw-p 00000000 00:00 0 
374dc00000-374dc20000 r-xp 00000000 09:00 783364       /lib64/ld-2.12.so 
374de1f000-374de20000 r--p 0001f000 09:00 783364       /lib64/ld-2.12.so 
374de20000-374de21000 rw-p 00020000 09:00 783364       /lib64/ld-2.12.so 
374de21000-374de22000 rw-p 00000000 00:00 0 
374e000000-374e18a000 r-xp 00000000 09:00 783367       /lib64/libc-2.12.so 
374e18a000-374e38a000 ---p 0018a000 09:00 783367       /lib64/libc-2.12.so 
374e38a000-374e38e000 r--p 0018a000 09:00 783367       /lib64/libc-2.12.so 
374e38e000-374e38f000 rw-p 0018e000 09:00 783367       /lib64/libc-2.12.so 
374e38f000-374e394000 rw-p 00000000 00:00 0 
374e400000-374e417000 r-xp 00000000 09:00 783373       /lib64/libpthread-2.12.so 
374e417000-374e617000 ---p 00017000 09:00 783373       /lib64/libpthread-2.12.so 
374e617000-374e618000 r--p 00017000 09:00 783373       /lib64/libpthread-2.12.so 
374e618000-374e619000 rw-p 00018000 09:00 783373       /lib64/libpthread-2.12.so 
374e619000-374e61d000 rw-p 00000000 00:00 0 
374e800000-374e802000 r-xp 00000000 09:00 783380       /lib64/libdl-2.12.so 
374e802000-374ea02000 ---p 00002000 09:00 783380       /lib64/libdl-2.12.so 
374ea02000-374ea03000 r--p 00002000 09:00 783380       /lib64/libdl-2.12.so 
374ea03000-374ea04000 rw-p 00003000 09:00 783380       /lib64/libdl-2.12.so 
374ec00000-374ec15000 r-xp 00000000 09:00 783377       /lib64/libz.so.1.2.3 
374ec15000-374ee14000 ---p 00015000 09:00 783377       /lib64/libz.so.1.2.3 
374ee14000-374ee15000 r--p 00014000 09:00 783377       /lib64/libz.so.1.2.3 
374ee15000-374ee16000 rw-p 00015000 09:00 783377       /lib64/libz.so.1.2.3 
374f400000-374f483000 r-xp 00000000 09:00 783388       /lib64/libm-2.12.so 
374f483000-374f682000 ---p 00083000 09:00 783388       /lib64/libm-2.12.so 
374f682000-374f683000 r--p 00082000 09:00 783388       /lib64/libm-2.12.so 
374f683000-374f684000 rw-p 00083000 09:00 783388       /lib64/libm-2.12.so 
3750800000-3750816000 r-xp 00000000 09:00 783389       /lib64/libgcc_s-4.4.7-20120601.so.1 
3750816000-3750a15000 ---p 00016000 09:00 783389       /lib64/libgcc_s-4.4.7-20120601.so.1 
3750a15000-3750a16000 rw-p 00015000 09:00 783389       /lib64/libgcc_s-4.4.7-20120601.so.1 
3757c00000-3757d49000 r-xp 00000000 09:00 929936       /usr/lib64/libxml2.so.2.7.6 
3757d49000-3757f48000 ---p 00149000 09:00 929936       /usr/lib64/libxml2.so.2.7.6 
3757f48000-3757f51000 rw-p 00148000 09:00 929936       /usr/lib64/libxml2.so.2.7.6 
3757f51000-3757f53000 rw-p 00000000 00:00 0 
7f657423e000-7f657424a000 r-xp 00000000 09:00 783433      /lib64/libnss_files-2.12.so 
7f657424a000-7f657444a000 ---p 0000c000 09:00 783433      /lib64/libnss_files-2.12.so 
7f657444a000-7f657444b000 r--p 0000c000 09:00 783433      /lib64/libnss_files-2.12.so 
7f657444b000-7f657444c000 rw-p 0000d000 09:00 783433      /lib64/libnss_files-2.12.so 
7f657444c000-7f6574451000 rw-p 00000000 00:00 0 
7f6574465000-7f6574467000 rw-p 00000000 00:00 0 
7fff289a1000-7fff28bcf000 rw-p 00000000 00:00 0       [stack] 
7fff28bff000-7fff28c00000 r-xp 00000000 00:00 0       [vdso] 
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0     [vsyscall]

数据库例程读/写如下（我省略了这些功能无关的代码 - 由椭圆表示）：

ENTRY sfuint 
bt3DataRead _FL((fd, recno, data)) 
ISFILE *fd _DL 
sflong recno _DL 
void *data _EL 
{ 
    ... 
    lioRead(fd -> fdData, recno, trueBase(fd -> lastData)) 
    decrypt_db_rawData(fd -> lastData, fd->reclen - BASEOFFSET); //this routine is intelligent enough to know whether to actually decrypt or not, so it should be safe to call it here regardless of whether data is actually encrypted or not 
    ... 
} 

ENTRY sfuint 
bt3Write _FL((fd, data)) 
ISFILE *fd _DL 
void *data _EL 
{ 
    ... 
    void *dataCopy = malloc(fd->reclen);     //for saving a copy of the data, in its non-encrypted form, so later logic will work 
    memcpy(trueBase(dataCopy), trueBase(data), fd->reclen); //copy aside the raw unencrypted data for safe-keeping while we encrypt, next 
    encrypt_db_rawData(data, fd->reclen-BASEOFFSET);  //encrypt the data 
    lioWrite(fd -> fdData, recno, trueBase(data));   //write encrypted data to database 
    memcpy(trueBase(data), trueBase(dataCopy), fd->reclen); //now that the write is complete, restore the non-encrypted data, so stuff works right later 
    ... 
}

加密程序如下（数据只是技术上的字节数组;实际上是字符串）。他们遍历数组中的每个字节，并在同一时间做每一个密码：

int encrypt_db_rawData(char *data, size_t data_size) { 
    int ret = 0; 
    char *buf_out;     //where the whole encrypted byte "string" gets assembled 
    char obuf;      //declare our per-byte output buffer 
    int ilen, olen;     //stuff needed by EVP_CipherUpdate 
    EVP_CIPHER_CTX ctx;    //declare our EVP cipher context 
    int currbyte 

    /* ... setup cipher context for encryption (omitted) ... */ 

    buf_out = malloc(data_size); 
    memset(buf_out, 0x00, data_size); //initialize buffer 

    for(currbyte = 0; currbyte <= data_size - 1; currbyte++) { 
    ret = EVP_CipherUpdate(&ctx, &obuf, &olen, &data[currbyte], 1); //actually do the encryption, outputting the current data byte to obuf as an encrypted byte 
    if(ret != 1) { 
     //encryption failed, so abort the entire function (no data modified) 
     free(buf_out); 
     return ret; 
    } 
    buf_out[currbyte] = obuf; //encryption of this byte succeeded, so append the encrypted byte to the main output buffer (which may be saved back into *data when all is done) 
    } 

    memcpy((void*)data, buf_out, data_size); //NOTE: not sure if we really need to cast as a void*, but doesn't seem to hurt (since the calling routine uses void*data instead of char*data) 
    free(buf_out); 
    return ret; 
} 

int decrypt_db_rawData(char *data, size_t data_size) { 
    int ret = 0; 
    char *buf_out;     //where the whole decrypted byte "string" gets assembled 
    char obuf;      //declare our per-byte output buffer 
    int ilen, olen;     //stuff needed by EVP_CipherUpdate 
    EVP_CIPHER_CTX ctx;    //declare our EVP cipher context 
    int currbyte; 

    /* ... setup cipher context for decryption (omitted) ... */ 

    buf_out = malloc(data_size); 
    memset(buf_out, 0x00, data_size); //initialize buffer 

    for(currbyte = 0; currbyte <= data_size - 1; currbyte++) { 
    ret = EVP_CipherUpdate(&ctx, &obuf, &olen, &data[currbyte], 1); //actually do the decryption, outputting the current data byte to obuf as an decrypted byte 
    if(ret != 1) { 
     //decryption failed, so abort the entire function (no data modified) 
     free(buf_out); 
     return ret; 
    } 
    buf_out[currbyte] = obuf; //decryption of this byte succeeded, so append the decrypted byte to the main output buffer (which may be saved back into *data when all is done) 
    } 

    memcpy((void*)data, buf_out, data_size); //NOTE: not sure if we really need to cast as a void*, but doesn't seem to hurt (since the calling routine uses void*data instead of char*data) 
    free(buf_out); 
    return ret; 
}

来源

2015-11-03 csr19us

使用'valgrind' http://valgrind.org/ – lrleon

@lrleon，我将尝试安装和运行，而我等待答复。谢谢你的提示。 – csr19us

单纯的错误（以非常规术语来说）意味着用于free（）的参数的值在程序结束前是两次相同的值。尝试使用valgrind，strace，gdb或任何其他调试器来查看问题出在哪里。 – Mike

的问题是在字节/指针移动被trueBase做......可能是重叠的一些内存空间我memcpy操作。 Valgrind对于快速发现这一点至关重要！感谢@lrleon。

这里是在数据库写入程序我更新的代码：

ENTRY sfuint 
bt3Write _FL((fd, data)) 
ISFILE *fd _DL 
void *data _EL 
{ 
    ... 
    void *dataCopy = malloc(fd->reclen - BASEOFFSET);   //for saving a copy of the data, in its non-encrypted form, so later logic will work 
    memcpy(dataCopy, trueBase(data), fd->reclen - BASEOFFSET); //copy aside the raw unencrypted data for safe-keeping while we encrypt, next 
    encrypt_db_rawData(data, fd->reclen-BASEOFFSET);   //encrypt the data 
    lioWrite(fd -> fdData, recno, trueBase(data));    //write encrypted data to database 
    memcpy(trueBase(data), dataCopy, fd->reclen - BASEOFFSET); //now that the write is complete, restore the non-encrypted data, so stuff works right later 
    if(dataCopy) 
    free(dataCopy); 
    ... 
}

来源

2015-11-03 20:54:32 csr19us

双免费或腐败崩溃

回答

相关问题