valgrind报告"无效写入大小8"

Question

我正在追逐内存分配的分段错误,所以我决定用valgrind运行我的应用程序.在一个意想不到的位置(但可能相关)我遇到了"无效写入大小8".但是,我没有看到代码有任何问题.我很欣赏另一种眼光.

我不确定要提供多少,所以这里有相关的功能.

43 static int sql_callback(void *sql_record, int argc, char **argv, char **azColName){
44   int i;
45   SQL_INFO *sql_info;
46   void *sql_temp;
47   sql_info = (SQL_INFO *)sql_record;
48
49
50   sql_info->num_cols=argc;
51
52  sql_info->sql_data=(SQL_DATA**)realloc(sql_info->sql_data,(sql_info->num_rows+1)*sizeof(SQL_DATA *));
53   sql_info->sql_data[sql_info->num_rows]=calloc(1,sizeof(SQL_DATA *));
54
55   sql_info->sql_data[sql_info->num_rows]->col_name=calloc(1,sizeof(*azColName)*argc);
56   sql_info->sql_data[sql_info->num_rows]->data=calloc(1,sizeof(*argv)*argc);
57
58   for(i=0; i<argc; i++){
59      sql_info->sql_data[sql_info->num_rows]->col_name[i]=strdup(azColName[i]);
60      sql_info->sql_data[sql_info->num_rows]->data[i]=strdup(argv[i]);
61   }
62   sql_info->num_rows++;
63   return 0;
64 }

Valgrind有两个有趣的信息点:

==31925== Invalid write of size 8
==31925==    at 0x405EC2: sql_callback (sql.c:56)
==31925==    by 0x5310FF5: sqlite3_exec (in /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6)
==31925==    by 0x4060D6: sql_query (sql.c:87)
==31925==    by 0x405121: send_trip_record (ssl_main.c:573)
==31925==    by 0x404579: do_work (ssl_main.c:380)
==31925==  Address 0x70f0fc8 is 0 bytes after a block of size 8 alloc'd
==31925==    at 0x4C29DB4: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31925==    by 0x405E8D: sql_callback (sql.c:53)
==31925==    by 0x5310FF5: sqlite3_exec (in /usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6)
==31925==    by 0x4060D6: sql_query (sql.c:87)
==31925==    by 0x405121: send_trip_record (ssl_main.c:573)
==31925==    by 0x404579: do_work (ssl_main.c:380)
==31925== 

所以,我使用sqlite3库,这个回调函数正在构建一个记录集的数组.在数组内部,是一个数组,如果是数据,那就是'data'变量.我正在做与col_name类似的事情,但是valgrind对此没问题并且不抱怨.

Answer 1

在这一行:

53   sql_info->sql_data[sql_info->num_rows]=calloc(1,sizeof(SQL_DATA *));

你应该分配sizeof(SQL_DATA).

因为在下一个语句中,您开始访问sql_info->sql_data[sql_info->num_rows],就好像它是一个SQL_DATA对象:

55   sql_info->sql_data[sql_info->num_rows]->col_name=calloc(1,sizeof(*azColName)*argc);
56   sql_info->sql_data[sql_info->num_rows]->data=calloc(1,sizeof(*argv)*argc);