Valgrind的无效写入大小为8

Question

I have some code that is suppose to break apart a string that looks like the example below and store it into a data structure.

ORGANIZER;CN=John Doe;ON=Another Person;SN=Maybe another

Here is what my function looks like:

CalError parseOptionalParam(char * paramString, CalParam * param) {
  char * parseString = malloc(strlen(paramString) + sizeof(char*));
  strcpy(parseString, paramString);

  char * tokenSemi;
  tokenSemi = strtok(parseString, ";");
  if(tokenSemi == NULL) return SYNTAX;
  int i = 0;
  while(tokenSemi != NULL) {
    tokenSemi = strtok(NULL, ";");
    if(tokenSemi == NULL) return SYNTAX;

    char * tokenEqual = strtok(tokenSemi, "=");
    param->name = malloc(strlen(tokenEqual) + sizeof(char*));
    strcpy(param->name, tokenEqual);

    param = realloc(param, sizeof(param) + sizeof(char*));
    tokenEqual = strtok(tokenSemi, "=");
    param->value[i] = malloc(sizeof(char*) + strlen(tokenEqual));
    strcpy(param->value[i], tokenEqual);

    i++;
  }
  free(parseString);
  return OK;
}

And here is what valgrind is telling me:

==7925== Invalid write of size 8
==7925==    at 0x400E56: parseOptionalParam (calutil.c:79)
==7925==    by 0x400CED: parseCalProp (calutil.c:50)
==7925==    by 0x400B0B: main (testfile.c:8)
==7925==  Address 0x5202508 is 8 bytes after a block of size 16 alloc'd
==7925==    at 0x4C2DD9F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7925==    by 0x400E13: parseOptionalParam (calutil.c:77)
==7925==    by 0x400CED: parseCalProp (calutil.c:50)
==7925==    by 0x400B0B: main (testfile.c:8)

The line 79 is the line that starts with param->value[i] = and then valgrind is referring to the realloc that is 2 lines above. I am confused what is wrong here? Within the param structure there is a flexible array member at the end of the structure which is value . I am simply trying to allocate another array position in the structure and then use that position for a string.

At some point in those two lines I am guessing I am doing something incorrect regarding the memory, but I am unsure what it is yet.

Answer 1

Within the param structure there is a flexible array member at the end of the structure which is value . I am simply trying to allocate another array position in the structure and then use that position for a string.

Let's do the math: in order to allocate enough space for CalParam with its flexible array member that has i elements you need

• sizeof(CalParam) - that's the base size of your struct
• (i+1)*sizeof(char*) - that's an array of char* of size i+1

Therefore, your realloc call should look like this:

param = realloc(param, sizeof(*param) + (i+1)*sizeof(char*));

Note the asterisk in front of param . This is important, because param is a pointer.

This is not the end of the story, however, because param is passed by value, and you are changing its value by realloc -ing it. This will result in dangling reference in the caller. In order to fix this problem, you need to receive param pointer by pointer (ie a double-asterisk pointer), and assign it in your call of realloc , like this:

CalError parseOptionalParam(char * paramString, CalParam **param) {
    ...
    *param = realloc(*param, sizeof(**param) + (i+1)*sizeof(char*));
    ...
}

Note some more asterisks there. To make your code slightly easier to read, consider replacing the first sizeof with sizeof(CalParam) , like this:

*param = realloc(*param, sizeof(CalParam) + (i+1)*sizeof(char*));

Finally, you should also fix the potential memory leak with realloc : instead of assigning to *param directly, you should assign to a temporary, check for NULL , and then either assign back to *param , or free the old value and report an error.

Answer 2

I'm assuming the following definition of CalParam .

typedef struct {
    char* name;
    char* value[];
} CalParam;

sizeof(param) is the same as sizeof(typeof(param)) , which is the same as sizeof(CalParam*) , which is the size of a pointer. You probably meant sizeof(*param)

sizeof(*param) is the same as sizeof(typeof(*param)) , which is the same as sizeof(CalParam) . Types are constant, so sizeof is known at compile-time, so flexible arrays must be ignored in the count.

As such,

param = realloc(param, sizeof(param) + sizeof(char*));

should be

param = realloc(param, sizeof(CalParam) + sizeof(char*)*(i+1));

---

Your other memory allocations are wonky too. In three places, you have something like

char * dst = malloc(strlen(src) + sizeof(char*));
strcpy(dst, src);

That should be

char * dst = malloc((strlen(src) + 1) * sizeof(char));
strcpy(dst, src);

But of course, sizeof(char) is 1 , so we can just use

char * dst = malloc(strlen(src) + 1);
strcpy(dst, src);

But strdup does the same thing.

char * dst = strdup(src);