segfault sur valgrind

**lilington** · 17/12/2013, 11h08

bonjours, j'ai une erreur bizarre que j'arrive pas a comprendre.
je m'explique
j'ai une fonction dpush qui ajoute une chaine de caractere a une liste
soit un char * a un char **.
dpush prend en argment l'addresse de la liste, la chaine a ajoute et le nombre d'element.
se nombre servira pour accelerer l'acces plutot qu'a chercher le dernier element. si le dernier element n'est pas NULL alors on cherche les elements suivant jusqu'a le trouver sinon on a segfault.
mon probleme c'est que quand j'execute ca marche, avec gdb ca marche aussi mais valgrind plante lamentablement.

voici le code:

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
unsigned long int dpush(char ***vlst,char *str,unsigned long int n);
//int dpop(char ***lst);
 
/**************************************************************************
###########################################################################
*
*   Implementation  
*
###########################################################################
**************************************************************************/
 
/*----------------------- Main ------------------------------------------*/
int main(int argc,char **argv)
{
    char **lst,**p;
    unsigned long int n=0;
    int i=0;
 
    lst=malloc(sizeof(char*));
    lst[0]=NULL;
    //fprintf(stderr,"n=%ld\n",n);    n=dpush(&lst,"line 1",n);
    //fprintf(stderr,"n=%ld\n",n);
    n=dpush(&lst,"line 2",n);
    //fprintf(stderr,"n=%ld\n",n);
 
    p=lst;
    fprintf(stdout,"total line:%d\n",n);
    while(*p!=NULL)
    {
        ++i;
        fprintf(stdout,"[%d] %s\n",i,*p);
        ++p;
    }
    p=lst;
    while(*p!=NULL)
    {
        char *q=*p;
        ++p;
        free(q);
    }
    free(lst);
    return EXIT_SUCCESS;
    return EXIT_SUCCESS;
}
 
unsigned long int dpush(char ***vlst,char *str,unsigned long int n)
{
    char **lst=*vlst;
    char **p;
    char n_e=n;
    unsigned long int i;
    //n should be less or equal to number of string in vlst or segfault will occure
 
    //element control, if list is NULL return 0
    if(lst==NULL)
        return 0;
    p=lst;
    if(p[n_e]!=NULL)
    {
        while(p[n_e]!=NULL)
            n_e+=1;
    }
 
    fprintf(stderr,"n=%ld %s\n",n_e,lst[n_e]);
    char **ptr=realloc(lst,sizeof(char *)*n_e+2);
    if(ptr==NULL)
    {
        fprintf(stderr,"allocation error\n");
        exit(1);
    }
    lst=ptr;
 
    lst[n_e]=malloc(sizeof(char)*strlen(str)+1);
    if(lst[n_e]==NULL)
     ........
    strcpy(lst[n_e],str);
    lst[n_e+1]=NULL;
    n_e+=1;
 
    *vlst=lst;
    return n_e;
}

voici ce que valgrind me dit

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
valgrind ./pp 
==19523== Memcheck, a memory error detector
==19523== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==19523== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==19523== Command: ./pp
==19523== 
n=0 (null)
==19523== Invalid write of size 8
==19523==    at 0x400967: dpush (pushpop.c:100)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523==  Address 0x51b9090 is 0 bytes inside a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523== 
==19523== Invalid read of size 8
==19523==    at 0x40097E: dpush (pushpop.c:101)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523==  Address 0x51b9090 is 0 bytes inside a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523== 
==19523== Invalid write of size 8
==19523==    at 0x4009A8: dpush (pushpop.c:102)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523==  Address 0x51b9098 is 6 bytes after a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523== 
==19523== Invalid read of size 8
==19523==    at 0x40087F: dpush (pushpop.c:85)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523==  Address 0x51b9098 is 6 bytes after a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523== 
==19523== Invalid read of size 8
==19523==    at 0x4008C3: dpush (pushpop.c:91)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523==  Address 0x51b9098 is 6 bytes after a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523== 
n=1 (null)
==19523== Invalid write of size 8
==19523==    at 0x400967: dpush (pushpop.c:100)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523==  Address 0x51b9138 is 8 bytes inside a block of size 10 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523== 
==19523== Invalid read of size 8
==19523==    at 0x40097E: dpush (pushpop.c:101)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523==  Address 0x51b9138 is 8 bytes inside a block of size 10 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523== 
==19523== Invalid write of size 8
==19523==    at 0x4009A8: dpush (pushpop.c:102)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523==  Address 0x51b9140 is 6 bytes after a block of size 10 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007C0: main (pushpop.c:59)
==19523== 
total line:2
==19523== Conditional jump or move depends on uninitialised value(s)
==19523==    at 0x400822: main (pushpop.c:64)
==19523== 
==19523== Conditional jump or move depends on uninitialised value(s)
==19523==    at 0x4E74953: vfprintf (vfprintf.c:1623)
==19523==    by 0x4E7D3D7: fprintf (fprintf.c:33)
==19523==    by 0x400812: main (pushpop.c:67)
==19523== 
==19523== Use of uninitialised value of size 8
==19523==    at 0x4E74CBA: vfprintf (vfprintf.c:1623)
==19523==    by 0x4E7D3D7: fprintf (fprintf.c:33)
==19523==    by 0x400812: main (pushpop.c:67)
==19523== 
==19523== Invalid read of size 1
==19523==    at 0x4E74CBA: vfprintf (vfprintf.c:1623)
==19523==    by 0x4E7D3D7: fprintf (fprintf.c:33)
==19523==    by 0x400812: main (pushpop.c:67)
==19523==  Address 0x90e0 is not stack'd, malloc'd or (recently) free'd
==19523== 
==19523== 
==19523== Process terminating with default action of signal 11 (SIGSEGV)
==19523==  Access not within mapped region at address 0x90E0
==19523==    at 0x4E74CBA: vfprintf (vfprintf.c:1623)
==19523==    by 0x4E7D3D7: fprintf (fprintf.c:33)
==19523==    by 0x400812: main (pushpop.c:67)
==19523==  If you believe this happened as a result of a stack
==19523==  overflow in your program's main thread (unlikely but
==19523==  possible), you can try to increase the size of the
==19523==  main thread stack using the --main-stacksize= flag.
==19523==  The main thread stack size used in this run was 8388608.
[1] ==19523== 
==19523== HEAP SUMMARY:
==19523==     in use at exit: 24 bytes in 3 blocks
==19523==   total heap usage: 5 allocs, 2 frees, 34 bytes allocated
==19523== 
==19523== LEAK SUMMARY:
==19523==    definitely lost: 14 bytes in 2 blocks
==19523==    indirectly lost: 0 bytes in 0 blocks
==19523==      possibly lost: 0 bytes in 0 blocks
==19523==    still reachable: 10 bytes in 1 blocks
==19523==         suppressed: 0 bytes in 0 blocks
==19523== Rerun with --leak-check=full to see details of leaked memory
==19523== 
==19523== For counts of detected and suppressed errors, rerun with: -v
==19523== Use --track-origins=yes to see where uninitialised values come from
==19523== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 4 from 4)
Segmentation fault

**Obsidian** · 17/12/2013, 12h44

Hello,
Quelques remarques à la volée :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
unsigned long int dpush(char ***vlst,char *str,unsigned long int n)
{
    char **lst=*vlst;
    char **p;
    char n_e=n;

Tu affectes un unsigned long int à un char. Dépassement quasi-assuré et si n est multiple de 2^CHAR_BIT (généralement 256), n_e risque d'être nul et ça va te poser des problèmes plus loin.

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
==19523== Invalid write of size 8
==19523==    at 0x400967: dpush (pushpop.c:100)
==19523==    by 0x4007A7: main (pushpop.c:57)
==19523==  Address 0x51b9090 is 0 bytes inside a block of size 2 alloc'd
==19523==    at 0x4C28CCE: realloc (vg_replace_malloc.c:632)
==19523==    by 0x4008FE: dpush (pushpop.c:92)
==19523==    by 0x4007A7: main (pushpop.c:57)

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
unsigned long int dpush(char ***vlst,char *str,unsigned long int n)
{
    …
    char **ptr=realloc(lst,sizeof(char *)*n_e+2);
    …
    lst[n_e]=malloc(sizeof(char)*strlen(str)+1);

Si « n_e » est nul (et c'est le cas puisque c'est ce qui est envoyé par main), tu alloues ici un bloc de deux octets. Tu voulais probablement écrire : char **ptr=realloc(lst,sizeof(char *)*(n_e+2));

**lilington** · 17/12/2013, 14h03

Génial, je n'ai pas d'ordinateur sous la main Mais je crois que c'est bien là l'erreur (2+n_e).
En ce qui concerne le type de n_e c'est une erreur de frappe j'avais pas copié collé le début de la fonction il n'y avait donc pas les déclarations, j'ai rajouté à la main.

**Médinoc** · 17/12/2013, 14h23

J'espère que tu es sur un smartphone, en ce moment, et que c'est ton excuse pour taper aussi mal...

**lilington** · 18/12/2013, 03h13

oui j'etais sur un smartphone qui est tres peu smart d'ailleurs.
mais generalement j'ecris mal aussi mais la c'etait pire.
desole pour le manque d'accent aussi.

pour en revenir au sujet c'est bon c'est resolut.

sinon je viens de me rentre compte que grace a la remarque precedente sur char que j'aurai des problemes si le n passe est superieur a 18446744073709551615. soit il y a de la marge mais ca veut dire que on ne peut pas indefiniment push.
bref je pense tout de meme que malloc echouera avant d'en arriver la.

segfault sur valgrind

C

Discussions similaires

Partager

Partager