尺寸1 X的无效写入字节** **里面大小的块> X ** ** alloc'd

Question

我是比较新的调试Valgrind的错误，而这其中有我难住了：

==1920== Invalid write of size 1 
==1920== at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506) 
==1920== by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448) 
      ... redacted (see end for full error) 
==1920== Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd 
==1920== at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299) 
==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879) 
      ... redacted (see end for full error) 

请注意，这是字节井内和分配块。我已经看到类似的错误，涉及写入之后，或之前，或到free'd块，甚至写入写入大小大于块结束地址（因此溢出），但我找不到像这个。

这发生在R CRAN check farm在this line of code。

我无法在OSX或linux虚拟机上使用valgrind在本地重现错误。

除此之外，错误对我没有意义。为什么我不能在分配块的中间写入1个字节？这一切都在R内部运行，所以我猜可能我认为有问题的分配是由程序的一个不同部分产生的，并且它以某种方式保留下来（一种可能的提示是，发生这种情况的是我从R请求的分配小于60字节当错误出现时），但我不知道这是valgrind能够检测到的东西。

完整的错误：可使用内存池时发生

==1920== Invalid write of size 1 
==1920== at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506) 
==1920== by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448) 
==1920== by 0x1D53317D: CSR_bullet_ext (packages/tests-vg/vetr/src/cstringr-ext.c:107) 
==1920== by 0x4852BD: do_dotcall (svn/R-devel/src/main/dotcode.c:1252) 
==1920== by 0x4C274D: Rf_eval (svn/R-devel/src/main/eval.c:728) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4C2391: Rf_eval (svn/R-devel/src/main/eval.c:747) 
==1920== by 0x4C29E0: forcePromise (svn/R-devel/src/main/eval.c:520) 
==1920== by 0x4C27A1: Rf_eval (svn/R-devel/src/main/eval.c:647) 
==1920== by 0x4C7746: do_withVisible (svn/R-devel/src/main/eval.c:2998) 
==1920== by 0x4F7104: do_internal (svn/R-devel/src/main/names.c:1363) 
==1920== by 0x4B553B: bcEval (svn/R-devel/src/main/eval.c:6503) 
==1920== Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd 
==1920== at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299) 
==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879) 
==1920== by 0x4F5814: Rf_allocVector3 (svn/R-devel/src/main/memory.c:2659) 
==1920== by 0x4CAEAF: Rf_allocVector (svn/R-devel/src/include/Rinlinedfuns.h:247) 
==1920== by 0x4CAEAF: do_growconst (svn/R-devel/src/main/eval.c:7490) 
==1920== by 0x4B64BD: bcEval (svn/R-devel/src/main/eval.c:6483) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 

Answer 1

这样的错误。

通常，lib或应用程序（例如R）可以通过获取大块（例如R）来构建其自己的分配器 。从malloc，然后从这些大块分配小块 。 Valgrind有一些客户端请求允许描述这些块（大或小块）和它们的分配。

有了这样的客户端请求，您可能会分配一部分malloc分配块 ，实际上标记为不可寻址。

看到堆栈跟踪条目：

==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879)

上面的解释看起来似是而非。

然后，这可能是有一个真正的错误的地方中的R 的指示和/或在R分配器描述了它的内存池的valgrind