解释Valgrind的trace-malloc输出

Question

Valgrind is an excellent memory debugger, and it has the option --trace-malloc=yes , which produces something like this:

--16301-- malloc(8) = 0x4EAD748
--16301-- free(0x4EAD748)
--16301-- free(0x4EAD498)
--16301-- malloc(21) = 0x4EAD780
--16301-- malloc(8) = 0x4EAD838
--16301-- free(0x4EAD6F8)
--16301-- calloc(1,88) = 0x4EAD870
--16301-- realloc(0x0,160)malloc(160) = 0x4EB1CF8
--16301-- realloc(0x4EB9F28,4) = 0x4EBA060

Is there a tool that parses this output and tells me for each address whether it's not been correctly allocated and freed in a matching pair?

GCC has something similar with the mtrace() function and the mtrace command-line tool, but the format is different.

Bonus question: Is it possible to output the actual address next to a "definitely lost" statement?

(I'm tagging this "C" and "C++" for the two languages most likely to be used with Valgrind.)

Answer 1

The output seems to be a partial output (or it is from hideously broken code. However, this seems to be a jobby for a simple perl script matching up the address. Actually, with C++2011's regular expressions even C++ should be up to the task but I haven't used these, yet. So, here is a simple (although probably rather clumsy) perl script reading valgrind's output from standard input:

 #!/usr/bin/perl -w
use strict;

my %allocated;

while (<>)
  {
    chomp;
    if (/(realloc\(([^,]*),([^)]*)\)).* = (.*)/)
      {
        if ($2 ne "0x0")
          {
            if (!exists $allocated{$2})
              {
                print "spurious realloc($2, $3) = $4\n";
              }
            else
              {
                delete $allocated{$2};
              }
          }
        $allocated{$4} = "$1$;$3";
      }
    elsif (/(malloc\((.*)\)) = (.*)/)
      {
        $allocated{$3} = "$1$;$2";
      }
    elsif (/ free\((.*)\)/)
      {
        if ($1 ne "0x0")
          {
            if (!exists $allocated{$1})
              {
                print "spurious free($1)\n";
              }
            else
              {
                delete $allocated{$1};
              }
          }
      }
    elsif (/(calloc\((.*),(.*)\)) = (.*)/)
      {
        $allocated{$4} = "$1$;" . ($2 * $3);
      }
  }

my $total = 0;
foreach my $leak (keys %allocated)
  {
    my($call, $size) = split(/$;/, $allocated{$leak});
    print "leak: address=$leak source=$call size=$size\n";
    $total += $size;
  }

if (0 < $total)
  {
    print "total leak=$total\n";
  }

Answer 2

I'm a bit late to the party, but the other answer didn't take memalign into account. There are other functions like valloc, cfree or posix_memalign but at least on linux they are aliased. Anyway here is my python version, no guarantees.

#!/usr/bin/python
import sys, re

memmap = {}

for line in sys.stdin:
    tok = [x for x in re.split(' |\(|\)|,|=|\n', line) if x][1:]
    if tok and tok[0] in ['malloc', 'calloc', 'memalign', 'realloc', 'free']:
        addr = int(tok[-1], 16)
        if tok[0] == 'malloc':
            memmap[addr] = int(tok[1])
        elif  tok[0] == 'calloc':
            memmap[addr] = int(tok[1]) * int(tok[2])
        elif tok[0] == 'memalign':
            memmap[addr] = int(tok[-2])
        elif tok[0] == 'realloc':
            oldaddr = int(tok[1], 16)
            if oldaddr != 0:
                del memmap[oldaddr]
            memmap[addr] = int(tok[2])
        elif tok[0] == 'free' and addr != 0:
            del memmap[addr]

for k, v in memmap.iteritems():
    print 'leak at 0x%x, %d bytes' % (k, v)
print 'total %d bytes' % sum(memmap.itervalues()) 

Answer 3

Yesterday's solution used perl to analyze the output. Obviously, being a C++ programmer I'm supposed to do it in C++. I hadn't used std::regex before and need to learn a bit about this first. So here is a C++ solution:

#include "boost/regex.hpp"
#include <functional>
#include <iostream>
#include <iterator>
#include <map>
#include <stdexcept>
#include <string>
#include <vector>

namespace re = boost;

long to_long(std::string const& s)
{
    return strtol(s.c_str(), 0, 10);
}

template <typename T>
static void insert(T& map, std::string const& address, std::string const& call, size_t size)
{
    if (!map.insert(std::make_pair(address, std::make_pair(call, size))).second)
        std::cout << "WARNING: duplicate address for " << call << ": " << address << "\n";
}

template <typename T>
static void erase(T& map, std::string const& address, std::string const& call)
{
    auto it(map.find(address));
    if (it == map.end() && address != "0x0")
        std::cout << "WARNING: spurious address in " << call << "\n";
    else
        map.erase(it);
}

static void process(std::istream& in)
{
    std::map<std::string, std::pair<std::string, size_t>> m;

    std::vector<std::pair<re::regex, std::function<void(re::smatch&)>>> exps;
    exps.emplace_back(re::regex(".*(malloc\\((.*)\\)) = (.*)"), [&](re::smatch& results){
            ::insert(m, results[3], results[1], ::to_long(results[2]));
        });
    exps.emplace_back(re::regex(".*(free\\((.*)\\))"), [&](re::smatch& results){
            ::erase(m, results[2], results[1]);
        });
    exps.emplace_back(re::regex(".*(calloc\\((.*),(.*)\\)) = (.*)"), [&](re::smatch& results){
            ::insert(m, results[4], results[1], ::to_long(results[2]) * ::to_long(results[3]));
        });
    exps.emplace_back(re::regex(".*(realloc\\((.*),(.*)\\)) = (.*)"), [&](re::smatch& results){
            ::erase(m, results[2], results[1]);
            ::insert(m, results[4], results[1], ::to_long(results[3]));
        });

    for (std::string line; std::getline(in, line); )
    {
        re::smatch results;
        for (auto it(exps.begin()), end(exps.end()); it != end; ++it)
        {
            if (re::regex_match(line, results, it->first))
            {
                (it->second)(results);
                break;
            }
        }
    }

    size_t total{0};
    for (auto it(m.begin()), end(m.end()); it != end; ++it)
    {
        std::cout << "leaked memory at " << it->first << " " << "from " << it->second.first << "\n";
        total += it->second.second;
    }
    std::cout << "total leak: " << total << "\n";
}

int main(int, char*[])
{
    try
    {
        ::process(std::cin);
    }
    catch (std::exception const &ex)
    {
        std::cerr << "ERROR: " << ex.what() << "\n";
    }
}

Because it seems that gcc's current version of std::regex is buggy I used the implementation from Boost. It should be easy to switch the version: just define re to be an alias for std instead of boost .