segfault分配char数组的大小

Question

I am new to programming so I am not that good yet. But I have been breaking my head of a segfault I have been getting.

basically I want to have a multithreaded accesible character storage which I can write to from multiple threads and read from with a single thread.

Now since a the buffer will be displayed on screen I didn`t want to protect the reading aspect by mutex because that lock would get a very high contention.

What I thought about is a static double buffer in function where I write to one buffer and then once I call the read the write buffer will be emptied into the read buffer and it returns a pointer to the read buffer.

This ensures that I can safely read with a single thread and write with many.

I have not implemented the cleanup or the output buffer since I cannot get the writing to work correctly.

Below is compileable code where I demonstrate what I want, I have commented out the mutexes. I get a segfault after allocating space for a single line. If I change my buffer stepsize it changes on what line it exactly segfaults.

I hope somebody can enlighten me on what I am doing wrong!

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char **message(char *msg, char mode, unsigned int *e) {
    //static pthread_mutex_t mtx = PTHREAD_MUTEX_INITIALIZER;

    static unsigned int errflag = 0;

    static unsigned int in_ln = 0; //amount of lines in the in_buf

    static unsigned int in_bufsize = 0; // current amount of lines the in_buf can hold
    static unsigned int out_bufsize = 0; // current amountof lines the out_buf can hold

    static const unsigned int bufsize_step = 2; // step size to increase the buffersizes

    static char **in_buf;
    static char **out_buf;

    unsigned int strlength = 0;
    unsigned int i = 0, h = 0, j = 0;
    unsigned int lncount = 0; // count of the amount of lines in the input message 'msg'

    // return once errflag is set previously
    if (errflag != 0) {
        *e = errflag;
        return NULL;
    }
    // mutex to ensure thread safety
    /*
    if (pthread_mutex_lock(&mtx) != 0) {
        errflag = 1;
        return NULL;
    }
    */

    //write to in_buf
    if (mode == 'w') {

        strlength = strlen(msg) + 1;
        printf("\n-----------new call---------\n");

        for (i=0; i<strlength; i++) {
            if (msg[i] == '\n' || msg[i] == '\0') {
                printf("found newline or \\n char at %u, with length %u, store at offset %u\n", i, i-h, lncount + in_ln);
                // check if buffer has suffcient size to hold a new line
                if (lncount + in_ln >= in_bufsize) {
                    // increase buffer by a step
                    printf("realloc buf. from %u to %u\n", in_bufsize, in_bufsize + bufsize_step);
                    in_bufsize += bufsize_step;
                    in_buf = realloc(in_buf, in_bufsize * sizeof(char *));
                    if (in_buf == NULL) {
                        errflag = 3;
                        *e = errflag;
                        goto end;
                    }
                }
                // allocate memory for the new line
                printf("alloc new line %u to %u\n", lncount + in_ln, (i - h + 1));
                in_buf[lncount + in_ln] = realloc(in_buf[lncount + in_ln] ,(i - h + 1) * sizeof(char));
                if (in_buf[lncount + in_ln] == NULL) {
                    errflag = 4;
                    *e = errflag;
                    goto end;
                }

                // put the line into the buffer
                for (j=0; h+j<i; j++) {
                    printf("%c", msg[h+j]);
                    in_buf[lncount + in_ln][j] = msg[h+j];
                }
                printf("\n");
                in_buf[lncount + in_ln][j] = '\0';

                printf("string %u is %s\n", lncount + in_ln, in_buf[lncount + in_ln]);
                h = i + 1;
                lncount++;
            }
        }

        in_ln += lncount;

    // append in_buf to out_buf, clean in_buf
    } else if (mode == 'r') {
        printf("realloc out_buf to %u\n", out_bufsize + in_ln);
        out_buf = realloc(out_buf, (out_bufsize + in_ln) * sizeof(char *));
        if (out_buf == NULL) {
            errflag = 4;
            *e = errflag;
            goto end;
        }

        printf("copying pointers...\n");
        for (i=0; i<in_ln; i++) {
            out_buf[i + out_bufsize] = in_buf[i];
            printf("copying %u. %s -> %u. %s\n", i + out_bufsize, out_buf[i + out_bufsize], i, in_buf[i]);
            in_buf[i] = NULL;
        }

        out_bufsize = out_bufsize + in_ln;
        in_ln = 0;
    // cleanup
    } else if (mode == 'c') {
        lncount = 0;
    }

    end: 
    /*
    if (pthread_mutex_unlock(&mtx) != 0) {
        errflag = 1;
        return buf;
    }
    */

    printf("in_buf: size %u\n", in_ln);
    for (i=0; i<in_ln; i++) {
        printf("%u. %s\n", i, in_buf[i]);
    }

    printf("out_buf: size %u\n", out_bufsize);
    for (i=0; i<out_bufsize; i++) {
        printf("%u. %s\n", i, out_buf[i]);
    }
    return out_buf;
}


int main() {
    unsigned int error;
    message("test test\n", 'w', &error);
    message(NULL, 'r', &error);
    message("test test2", 'w', &error);
    message("test test3", 'w', &error);
    message("test test4", 'w', &error);
    message(NULL, 'r', &error);
    message("test test5", 'w', &error);
    message("test test6", 'w', &error);
    message(NULL, 'r', &error);
    message("test test7", 'w', &error);
    message("test test8", 'w', &error);
    message(NULL, 'r', &error);
    message("test test9", 'w', &error);
    message("test test10", 'w', &error);
    message("test test11", 'w', &error);
    message("test test12", 'w', &error);
    message("test test13", 'w', &error);
    message("test test14", 'w', &error);

    message("lndsdss1\nln2\nln3\nln4\nln5\nln6\nln7\nln8\nln9\nln10\nln11\nln12\nln13\nln14\nln15\nln16\nln17\n", 'w', &error);

    exit(0);
}

Answer 1

Adding on to WhozCraig's comment. You are trying to use in_buf as an array of pointers to pointers, and in_buf is an static variable. Hence, in_buf is initialized to NULL (0).

If you read the definition of realloc , if the memory address passed is 0, it will act like malloc .

Hence now you have a array of pointers which has allocated memory and its first element is also pointing to the same address because in_buf and in_buf[0] is essentially the same address.

Hence, in_buf[0] is pointing to a valid allocated memory location, however in_buf[1] to in_buf[n-1] is holding garbage value as malloc does not set the content to 0, unlike calloc. When you move beyond in_buf[0] to in_buf[1] , it holds an invalid memory address, and when realloc tries to read from that address, segfault occours.