堆损坏 - "自由堆块61af0f0在61af194被修复后被释放"C++

Question

在我的应用程序中,我收到此错误:

HEAP[App.exe]: HEAP: Free Heap block 61af0f0 modified at 61af194 after it was freed

这是一个调用堆栈:

    ntdll.dll!_RtlpBreakPointHeap@4()   Unknown
    ntdll.dll!@RtlpAllocateHeap@24()    Unknown
    ntdll.dll!_RtlAllocateHeap@12() Unknown
    ntdll.dll!_RtlDebugAllocateHeap@12()    Unknown
    ntdll.dll!@RtlpAllocateHeap@24()    Unknown
    ntdll.dll!_RtlAllocateHeap@12() Unknown
>   msvcr110d.dll!_heap_alloc_base(unsigned int size) Line 57   C
    msvcr110d.dll!_heap_alloc_dbg_impl(unsigned int nSize, int nBlockUse, const char * szFileName, int nLine, int * errno_tmp) Line 431 C++
    msvcr110d.dll!_nh_malloc_dbg_impl(unsigned int nSize, int nhFlag, int nBlockUse, const char * szFileName, int nLine, int * errno_tmp) Line 239  C++
    msvcr110d.dll!_nh_malloc_dbg(unsigned int nSize, int nhFlag, int nBlockUse, const char * szFileName, int nLine) Line 302    C++
    msvcr110d.dll!malloc(unsigned int nSize) Line 56    C++
    msvcr110d.dll!operator new(unsigned int size) Line 59   C++
    App.exe!std::_Allocate<char>(unsigned int _Count, char * __formal) Line 28  C++
    App.exe!std::allocator<char>::allocate(unsigned int _Count) Line 591    C++
    App.exe!std::basic_stringbuf<char,std::char_traits<char>,std::allocator<char> >::overflow(int _Meta) Line 152   C++
    msvcp110d.dll!std::basic_streambuf<char,std::char_traits<char> >::sputc(char _Ch) Line 196  C++
    msvcp110d.dll!std::ostreambuf_iterator<char,std::char_traits<char> >::operator=(char _Right) Line 634   C++
    msvcp110d.dll!std::num_put<char,std::ostreambuf_iterator<char,std::char_traits<char> > >::_Put(std::ostreambuf_iterator<char,std::char_traits<char> > _Dest, const char * _Ptr, unsigned int _Count) Line 1553  C++
    msvcp110d.dll!std::num_put<char,std::ostreambuf_iterator<char,std::char_traits<char> > >::_Iput(std::ostreambuf_iterator<char,std::char_traits<char> > _Dest, std::ios_base & _Iosbase, char _Fill, char * _Buf, unsigned int _Count) Line 1544 C++
    msvcp110d.dll!std::num_put<char,std::ostreambuf_iterator<char,std::char_traits<char> > >::do_put(std::ostreambuf_iterator<char,std::char_traits<char> > _Dest, std::ios_base & _Iosbase, char _Fill, long _Val) Line 1216   C++
    msvcp110d.dll!std::num_put<char,std::ostreambuf_iterator<char,std::char_traits<char> > >::put(std::ostreambuf_iterator<char,std::char_traits<char> > _Dest, std::ios_base & _Iosbase, char _Fill, long _Val) Line 1137  C++
    msvcp110d.dll!std::basic_ostream<char,std::char_traits<char> >::operator<<(int _Val) Line 311   C++
    App.exe!TUtil::intToString(int val) Line 43 C++
    App.exe!TFontManager::getFont(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & filename, int size) Line 15  C++
    App.exe!TButton::draw() Line 55 C++
    App.exe!TWindow::draw() Line 203    C++
    App.exe!TGUIManager::drawObjects() Line 49  C++
    App.exe!TGameAppLayer::gameCycle() Line 456 C++
    App.exe!TGameAppLayer::mainLoop() Line 520  C++
    App.exe!wWinMain(HINSTANCE__ * hInstance, HINSTANCE__ * hPrevInstance, wchar_t * lpCmdLine, int nCmdShow) Line 36   C++
    App.exe!__tmainCRTStartup() Line 528    C
    App.exe!wWinMainCRTStartup() Line 377   C
    kernel32.dll!@BaseThreadInitThunk@12()  Unknown
    ntdll.dll!___RtlUserThreadStart@8() Unknown
    ntdll.dll!__RtlUserThreadStart@8()  Unknown

所以据我所知,我得到的错误是由访问(再次删除)已经释放的内存块引起的.已经是第三天尝试找出我的代码到底出了什么问题.在这段时间里,我发现了一些我已经修复的小内存泄漏,现在Visual Leak Detector告诉我它没有检测到任何泄漏.

然而,堆腐败的问题仍然存在.

在我的代码的每个地方使用"删除"操作符的地方,我首先检查指针是否不是nullptr.如果没有,我将其设置为nullptr:

if(m_pVar != nullptr)
{
    delete m_pVar;
    m_pVar = nullptr;
}

所以似乎不应该有多次释放同一块内存的问题.

我试图从这个调用堆栈中找出一些东西,但那是我想请求你帮助的地方.在一个调用堆栈中,似乎问题在于string分配,但这到底意味着什么呢？被调用的最后一个MY函数是string TUtil::intToString(int val) Line 43,因此如果我向您展示该函数的主体可能会更容易:

std::string TUtil::intToString(int val)
{
    std::ostringstream s;
    s << val;                 // Here's line 43
    return s.str();
}

有时调用堆栈是不同的,因此string TUtil::intToString(int val)函数甚至不存在,但它始终与strings分配有关.

我希望我刚才说的很清楚.如果您需要更多信息,请告诉我,我将在编辑中提供此问题.

Answer 1

所以据我所知,我得到的错误是由访问(再次删除)已经释放的内存块引起的.

除非有你知道但没有告诉我们的事情,否则以上很可能是一个红色的鲱鱼.该错误还可能意味着您通过悬空指针修改内存,或者由于缓冲区溢出.

如果你曾经做过指针的复制(明确地,或者未能定义复制构造函数/赋值操作符),那么m_pVar = nullptr删除时的设置将不提供防止双重删除的保证,更不用说其他类型的内存错误了.

如果您通过检查代码找不到问题,那么您最好的选择可能是像Valgrind或Purify这样的工具.