RTC checks whether your program accesses memory correctly by monitoring each read, write, and memory free operation.
Programs may incorrectly read or write memory in a variety of ways; these are called memory access errors. For example, the program may reference a block of memory that has been deallocated through a free()call for a heap block, or because a function returned a pointer to a local variable. Access errors may result in wild pointers in the program and can cause incorrect program behavior, including wrong outputs and segmentation violations. Some kinds of memory access errors can be very hard to track down.
RTC maintains a table that tracks the state of each block of memory being used by the program. RTC checks each memory operation against the state of the block of memory it involves and then determines whether the operation is valid. The possible memory states are:
Unallocated--initial state. Memory has not been allocated. It is illegal to read, write, or free this memory because it is not owned by the program.
Allocated, but uninitialized. Memory has been allocated to the program but not initialized. It is legal to write to or free this memory, but is illegal to read it because it is uninitialized. For example, upon entering a function, stack memory for local variables is allocated, but uninitialized.
Read-only. It is legal to read, but not write or free, read-only memory.
Allocated and initialized. It is legal to read, write, or free allocated and initialized memory.
Using RTC to find memory access errors is not unlike using a compiler to find syntax errors in your program. In both cases a list of errors is produced, with each error message giving the cause of the error and the location in the program where the error occurred. In both cases, you should fix the errors in your program starting at the top of the error list and working your way down. One error can cause other errors in a sort of chain reaction. The first error in the chain is therefore the "first cause," and fixing that error may also fix some subsequent errors. For example, a read from an uninitialized section of memory can create an incorrect pointer, which when dereferenced can cause another invalid read or write, which can in turn lead to yet another error.
RTC prints the following information for memory access errors:
type |
Type of error. |
access |
Type of access attempted (read or write). |
size |
Size of attempted access. |
addr |
Address of attempted access. |
detail |
More detailed information about addr. For example, if addr is in the vicinity of the stack, then its position relative to the current stack pointer is given. If addr is in the heap, then the address, size, and relative position of the nearest heap block is given. |
stack |
Call stack at time of error (with batch mode). |
allocation |
If addr is in the heap, then the allocation trace of the nearest heap block is given. |
location |
Where the error occurred. If line number information is available, this information includes line number and function. If line numbers are not available, RTC provides function and address. |
The following example shows a typical access error:
Read from uninitialized (rui): Attempting to read 4 bytes at address 0xefffee50 which is 96 bytes above the current stack pointer Variable is `j' Current function is rui 12 i = j;
RTC detects the following memory access errors:
Read from uninitialized memory (rui)
Read from unallocated memory (rua)
Write to unallocated memory (wua)
Write to read-only memory (wro)
Misaligned read (mar)
Misaligned write (maw)
Duplicate free (duf)
Bad free (baf)
Misaligned free (maf)
Out of memory (oom)
For a full explanation of each error and an example, see "RTC Errors".
RTC does not do array bound checking, and therefore does not report array bound violations as access errors.