什么机制检测未分配内存的访问？

Question

From time to time, I'll have an off-by-one error like the following:

unsigned int* x = calloc(2000, sizeof(unsigned int));

printf("%d", x[2000]);

I've gone beyond the end of the allocated region, so I get an EXC_BAD_ACCESS signal at runtime. My question is: how is this detected? It seems like this would just silently return garbage, since I'm only off by one byte and not, say, a full page. What part of the system prevents me from just returning the garbage byte at x + 2000 ?

Answer 1

The memory system has sentinel values at the beginning and end of its memory fields, beyond your allocated bytes. When you free the memory, it checks to see if those values are intact. If not, it tells you.

Answer 2

Perhaps you are just lucky because you are using 2000 as a size. Depending on the size of int the total size is divisible by 32 or 64 , so chances are high that the end of it really terminates the "real" allocation. Try with some odd number of bytes (better use a char array for that) and see if your systems still detects it.

In any case you shouldn't rely on finding these bugs this way. Always use valgrind or similar to check your memory accesses.