内存访问错误和警告

Discover 会检测和报告许多内存访问错误，并就可能是错误的访问向您发出警告。

内存访问错误

Discover 可检测到以下内存访问错误：

• ABR：数组越界读

• ABW：数组越界写

• BFM：释放错误的内存块

• BRP：错误的重新分配地址参数

• CGB：损坏的数组保护块

• DFM：双重释放内存

• FMR：读取释放的内存

• FMW：写入释放的内存

• FRP：释放的重新分配参数

• IMR：无效的内存读取

• IMW：无效的内存写入

• 内存泄漏

• OLP：重叠源和目标

• PIR：部分初始化的读取

• SBR：堆栈帧越界读

• SBW：堆栈帧越界写

• UAR：读取未分配的内存

• UAW：写入未分配的内存

• UMR：读取未初始化的内存

以下几部分列出了一些简单的示例程序，这些程序会生成上述某些错误。

ABR

  //  ABR: reading memory beyond array bounds at address 0x%1x (%d byte%s)"
  int *a = (int*) malloc(sizeof(int[5]));
  printf("a[5] = %d\n",a[5]);

ABW

  //  ABW:  writing to memory beyond array bounds
  int *a = (int*) malloc(sizeof(int[5]));
  a[5] = 5;

BFM

  //  BFM:  freeing wrong memory block
  int *p = (int*) malloc(sizeof(int));
  free(p+1);

BRP

  //  BRP is "bad address parameter for realloc 0x%1x"
  int *p = (int*) realloc(0,sizeof(int));
  int *q = (int*) realloc(p+20,sizeof(int[2]));

DFM

  // DFM is "double freeing memory"
  int *p = (int*) malloc(sizeof(int));
  free(p);
  free(p);'

FMR

  //  FMR is "reading from freed memory at address 0x%1x  (%d byte%s)"
  int *p = (int*) malloc(sizeof(int));
  free(p);
  printf("p = 0x%h\n",p);

FMW

  //  FMW is "writing to freed memory at address 0x%1x (%d byte%s)"
  int *p = (int*) malloc(sizeof(int));
  free(p);
  *p = 1;

FRP

  //  FRP:  freed pointer passed to realloc
  int *p = (int*) malloc(sizeof(int));
  free(0);
  int *q = (int*) realloc(p,sizeof(int[2]));

IMR

  //  IMR:  read from invalid memory address
  int *p = 0;
  int i = *p;   // generates Signal 11...

IMW

  //  IMW:  write to invalid memory address
  int *p = 0;
  *p = 1;       // generates Signal 11...

OLP

  char *s=(char *) malloc(15);
  memset(s, 'x', 15);
  memcpy(s, s+5, 10);
  return 0;

PIR

  //  PIR:  accessing partially initialized data
  int *p = (int*) malloc(sizeof(int));
  *((char*)p) = 'c';
  printf("*(p = %d\n",*(p+1)); 

SBR

  int a[2]={0,1};
  printf("a[-10]=%d\n",a[-10]);
  return 0;

SBW

  int a[2]={0,1)'
  a[-10]=2;
  return 0;

UAR

  //  UAR is "reading from unallocated memory"
  int *p = (int*) malloc(sizeof(int));
  printf("*(p+1) = %d\n",*(p+1));

UAW

  // UAW is "writing to unallocated memory"
  int *p = (int*) malloc(sizeof(int));
  *(p+1) = 1;

UMR

  // UMR is "accessing uninitialized data from address 0x%1x (A%d byte%s)"
  int *p = (int*) malloc(sizeof(int));
  printf("*p = %d\n",*p);

内存访问警告

Discover 会报告下列内存访问警告：

• AZS：分配零大小

• SMR：推测性未初始化内存读取

下面列出了一个会生成 AZS 警告的简单示例程序。

AZS

  //  AZS:  allocating zero size memory block
  int *p = malloc();