安全释放C中链表结构中的值的策略

Question

Using C I'm storing a large amount of data in a linked list structure. Some items in the linked list point to the same malloc'd data and this is causing issues when it comes to free-ing the linked list structure. I could solve the issue by copying the data as it's inserted into the linked list structure, but this has bigger implications for my program.

That said: the fact that I'm running into this issue suggests I have a design problem. As such, I'm looking for strategies and suggestions to help deal with this problem.

Here's some code that highlights the issue (and yes, I know that I shouldn't be blindly casting malloc like this):

char *val = (char *)malloc(256);
strcpy(val, "Dummy value");

LinkedListItem *itemB = (LinkedListItem *)malloc(sizeof(LinkedListItem));
itemB->value = val;
itemB->next = NULL;

LinkedListItem *itemA = (LinkedListItem *)malloc(sizeof(LinkedListItem));
itemA->value = val;
itemA->next = itemB;

LinkedListItem *cur = itemA;
while(cur)
{
    free(cur->value); // the crash will occur here, when performing a double free on itemB's value pointer
    cur->value = NULL;

    cur = cur->next;
}

I've seen many references to a 'safe' version of free that essentially NULL's the pointer after free-ing it, like so:

void free_generic(void **pp)
{
    assert(pp);

    if(pp != NULL)
    {
        free(*pp);
        *pp = NULL;
    }
}

while(cur)
{
    free_generic(&cur->value);
    cur = cur->next;
}

But this seems to have no effect. Any suggestions?

Answer 1

This is what reference-counting is for.

Use this struct every time you allocate something:

struct AllocatedStringValue {
    char* string;
    size_t refCount;
};


struct AllocatedStringValue value;
value.refCount = 0;
value.string = calloc( 256, sizeof(char) );

LinkedListItem *itemB = (LinkedListItem *)malloc(sizeof(LinkedListItem));
itemB->value = value;
itemB->next = NULL;
value.refCount++;

...

itemA->value = value;
value.refCount++;

...

while(cur) {
    if( cur->value.refCount > 0 ) {
        cur->value.refCount--;
    } else {
        free( cur->value->string );
    }
}

Answer 2

regarding this code snippit.

void free_generic(void **pp)
{
    assert(pp);       // this and following 'if' are testing same thing
                      // and this assert() should never fail as
                      // 'pp' is the address of a variable

    if(pp != NULL)    // could only fail if variable located at address 0
                      // should be: 'if( *pp )'
    {
        free(*pp);
        *pp = NULL;
    }
}

while(cur)
{
    free_generic(&cur->value);
    cur = cur->next;
}