大小为 1 X 字节的无效写入 inside 大小为 >X alloc'd 的块

Question

我在调试 valgrind 错误方面比较陌生，这个让我很困惑：

==1920== Invalid write of size 1
==1920==    at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506)
==1920==    by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448)
            ... redacted (see end for full error)
==1920==  Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd
==1920==    at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299)
==1920==    by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879)
            ... redacted (see end for full error)

注意这是 1 字节在内部 alloc'd 块。我见过类似的错误，涉及在空闲块之后、之前或写入空闲块，甚至在写入大小大于块末尾地址（因此溢出）的地方写入，但我找不到类似的错误这个。

这发生在 R CRAN check farm at this line of code。

我无法在 OSX 或 linux VM 上使用 valgrind 在本地重现错误。

除此之外，错误对我来说没有任何意义。为什么我不能在分配块的中间写入 1 个字节？这就是 R 中的所有运行，所以我猜想有问题的分配可能是由程序的不同部分进行的，并且以某种方式保留（一个可能的暗示是我从 R 请求的分配出现错误时小于 60 个字节），但我不知道 valgrind 是否能够检测到。

完整错误：

==1920== Invalid write of size 1
==1920==    at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506)
==1920==    by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448)
==1920==    by 0x1D53317D: CSR_bullet_ext (packages/tests-vg/vetr/src/cstringr-ext.c:107)
==1920==    by 0x4852BD: do_dotcall (svn/R-devel/src/main/dotcode.c:1252)
==1920==    by 0x4C274D: Rf_eval (svn/R-devel/src/main/eval.c:728)
==1920==    by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617)
==1920==    by 0x4C2391: Rf_eval (svn/R-devel/src/main/eval.c:747)
==1920==    by 0x4C29E0: forcePromise (svn/R-devel/src/main/eval.c:520)
==1920==    by 0x4C27A1: Rf_eval (svn/R-devel/src/main/eval.c:647)
==1920==    by 0x4C7746: do_withVisible (svn/R-devel/src/main/eval.c:2998)
==1920==    by 0x4F7104: do_internal (svn/R-devel/src/main/names.c:1363)
==1920==    by 0x4B553B: bcEval (svn/R-devel/src/main/eval.c:6503)
==1920==  Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd
==1920==    at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299)
==1920==    by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879)
==1920==    by 0x4F5814: Rf_allocVector3 (svn/R-devel/src/main/memory.c:2659)
==1920==    by 0x4CAEAF: Rf_allocVector (svn/R-devel/src/include/Rinlinedfuns.h:247)
==1920==    by 0x4CAEAF: do_growconst (svn/R-devel/src/main/eval.c:7490)
==1920==    by 0x4B64BD: bcEval (svn/R-devel/src/main/eval.c:6483)
==1920==    by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624)
==1920==    by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617)
==1920==    by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454)
==1920==    by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624)
==1920==    by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617)
==1920==    by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454)
==1920==    by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624)

Answer 1

使用内存池时可能会发生此类错误。

通常，库或应用程序（例如 R）可以构建自己的分配器通过获得大块，例如从 malloc，然后分配小块从这些大块。 Valgrind 有一些客户端请求允许描述这些块（大块或内部小块）及其分配。

对于此类客户端请求，您可能拥有一部分 malloc 分配块这实际上被标记为不可寻址。

查看堆栈跟踪条目：

==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879)

以上解释看起来有道理。

这可能表明 R 中某处确实存在错误 and/or R 分配器向 valgrind 描述其内存池的方式

大小为 1 X 字节的无效写入 **inside** 大小为 >X **alloc'd** 的块

Invalid write of size 1 X bytes **inside** a block of size >X **alloc'd**

c

valgrind

r

大小为 1 X 字节的无效写入 inside 大小为 >X alloc'd 的块

Invalid write of size 1 X bytes inside a block of size >X alloc'd