已释放对象的校验和不正确 - 对象可能在释放后被修改。我该如何解决？

Question

虽然运行我收到错误代码：ds(57203,0x70000fba3000) malloc: * 对象 0x7ff875402848 错误：释放对象的校验和不正确 - 对象可能在被修改后被修改释放。 * 在 malloc_error_break 设置断点调试

有时它可以工作，有时它会在尝试 malloc 一个新节点（参见 createNode 函数）后崩溃，所以我怀疑错误来自那里。

我做错了什么？我该如何解决？

我已尝试调试代码并更改多个 malloc，但无法解决问题。

正如我之前所说，我怀疑错误出在 createNode 函数中。

    #include <pthread.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <stdbool.h>
    #include <unistd.h>
    #include <dirent.h>
    #include <string.h>


void* threadFunction(void* searchTerm);
void scanDirName(char * path, char * searchTerm);
char* rootSD;
pthread_mutex_t qlock;

struct Node {
    char* data;
    struct Node* next;
};

// Two glboal variables to store address of front and rear nodes.
    struct Node* front = NULL;
    struct Node* rear = NULL;

// To Enqueue an integer
void Enqueue(char* x) {
    pthread_mutex_lock(&qlock);
/*    printf("\nhere\n");*/
    struct Node* temp = (struct Node*)malloc(sizeof(struct Node));
    temp->data =x;
    temp->next = NULL;
    if(front == NULL && rear == NULL){
        front = rear = temp;
        pthread_mutex_unlock(&qlock);
        return;
    }
    rear->next = temp;
    rear = temp;
    pthread_mutex_unlock(&qlock);
}

// To Dequeue an integer.
char* Dequeue() {
    pthread_mutex_lock(&qlock);
    struct Node* temp = front;
    if(front == NULL) {
        pthread_mutex_unlock(&qlock);
        return NULL;
    }
    char* data;
    data = front->data;
    if(front == rear) {
        front = rear = NULL;

    }
    else {
        front = front->next;
    }

    free(temp);
    pthread_mutex_unlock(&qlock);
    return data;
}


void Print() {
    struct Node* temp = front;
    while(temp != NULL) {
        printf("%s ",temp->data);
        temp = temp->next;
    }
    printf("\n");
}

void* threadFunction(void* st){

    char* filepath;
    filepath = NULL;
    char* searchTerm;
    searchTerm = (char*)st;

    while (filepath == NULL) {
        filepath = Dequeue();
    }

    printf("about to enter with %s, %s\n",filepath, searchTerm);
    fflush(stdout);
    scanDirName(filepath, searchTerm);
    if (strcmp(filepath,rootSD) != 0)
        free(filepath);
    return (void*)1;


}

void scanDirName(char * path, char * searchTerm){
    DIR * d = opendir(path); // open the path
    char* str3;

    if(d==NULL) return; // if was not able return

;

    struct dirent * dir; // for the directory entries
    while ((dir = readdir(d)) != NULL) // if we were able to read somehting from the directory
    {

        if(dir-> d_type == DT_DIR){ //
            if (dir->d_type == DT_DIR && strcmp(dir->d_name, ".") != 0 & strcmp(dir->d_name, "..") != 0) // if it is a directory
            {
                str3 = malloc(1+strlen("/") + strlen(searchTerm)+ strlen(dir->d_name) );
                if (!str3){
                    return;
                }

                strcpy(str3, path);
                strcat(str3, "/");
                strcat(str3, dir->d_name);
                printf("\n---\n%s\n---\n",str3);
                Enqueue(str3);
                printf("Succ");
            }
        } else if(dir-> d_type == DT_REG){ //
            if(strstr(dir->d_name, searchTerm)){

                printf("%s/%s\n", path, dir->d_name);
            }
        }

    }
    closedir(d); // finally close the directory
}

int main(int argc, char* argv[]){


    if (argc != 4){
        printf("ERROR\n");
        exit(1);
    }
    char* rootSearchDir = argv[1];
    char* searchTerm = argv[2];
    int threadsNumber = atoi(argv[3]);

    pthread_t threadsCollection[threadsNumber];

    rootSD = rootSearchDir;
    Enqueue(rootSearchDir);

    int i;
    for (i=0; i<threadsNumber; i++){
        if(pthread_create(&threadsCollection[i], NULL, threadFunction, (void*)searchTerm)) {

            fprintf(stderr, "Error creating thread\n");
            return 1;

        }
    }

    int rc;

    for (i=0; i<threadsNumber; i++){
        rc = pthread_join((threadsCollection[i]), NULL);
        if(rc) {
            fprintf(stderr, "Error joining thread, %d\n", rc);
            return 1;

        }
    }



}

}

此代码使用线程从根搜索目录开始搜索其名称包含 searchTerm 的文件。

Answer 1

问题是您正在分配 searchTerm 的大小，但复制了 path。

path的长度和searchTerm的长度相同的几率较小。因此越界访问 str3 并调用未定义的行为。

         str3 = malloc(1+strlen("/") + strlen(searchTerm)+ strlen(dir->d_name) );
            if (!str3){
                return;
            }

            strcpy(str3, path);  //Here
            strcat(str3, "/");
            strcat(str3, dir->d_name);

解决分配长度为path的内存。

str3 = malloc(1+strlen("/") + strlen(path)+ strlen(dir->d_name) );

已释放对象的校验和不正确 - 对象可能在释放后被修改。我该如何解决？

incorrect checksum for freed object - object was probably modified after being freed. how can I fix it?

c

clion