我的记忆怎么了？

Question

I have a function that allocated a buffer for the size of a file with

char *buffer = new char[size_of_file];

The i loop over the buffer and copy some of the pointers into a subbuffer to work with smaller units of it.

char *subbuffer = new char[size+1];

for (int i =0; i < size; i++) {
  subbuffer[i] = (buffer + cursor)[i];
}

Next I call a function and pass it this subbuffer, and arbitrary cursor for a location in the subbuffer, and the size of text to be abstracted.

  wchar_t* FileReader::getStringForSizeAndCursor(int32_t size, int cursor, char *buffer) {

  int wlen = size/2;

  #if MARKUP_SIZEOFWCHAR == 4 // sizeof(wchar_t) == 4
  uint32_t *dest = new uint32_t[wlen+1];
  #else
  uint16_t *dest = new uint16_t[wlen+1];
  #endif

  char *bcpy = new char[size];
  memcpy(bcpy, (buffer + cursor), size+2);



  unsigned char *ptr = (unsigned char *)bcpy; //need to be careful not to read outside the buffer


  for(int i=0; i<wlen; i++) {
      dest[i] = (ptr[0] << 8) + ptr[1];
      ptr += 2;
  }
  //cout << "size:: " << size << " wlen:: " << wlen << " c:: " << c << "\n";

  dest[wlen] = ('\0' << 8) + '\0';
  return (wchar_t *)dest;
}

I store this in a value as the property of a struct whilst looping through the file.

My issue seems to be when I free subbuffer, and start reading the title properties of my structs by looping over an array of struct pointers, my app segfaults. GDB tells me it finished normally though, but a bunch of records that I cout are missing.

I suspect this has to do with function scope of something. I thought the memcpy in getStringForSizeAndCursor would fix the segfault since it's copying bytes outside of subbuffer before I free. Right now I would expect those to then be cleaned up by my struct deconstructor, but either things are deconstructing before I expect or some memory is still pointing to the original subbuffer, if I let subbuffer leak I get back the data I expected, but this is not a solution.

Answer 1

The only definite error I can see in your question's code is the too small allocation of bcpy, where you allocate a buffer of size size and promptly copy size+2 bytes to the buffer. Since you're not using the extra 2 bytes in the code, just drop the +2 in the copy.

Besides that, I can only see one suspicious thing, you're doing;

char *subbuffer = new char[size+1];

and copying size bytes to the buffer. The allocation hints that you're allocating extra memory for a zero termination, but either it shouldn't be there at all (no +1) or you should allocate 2 bytes (since your function hints to a double byte character set. Either way, I can't see you zero terminating it, so use of it as a zero terminated string will probably break.

@Grizzly in the comments has a point too, allocating and handling memory for strings and wstrings is probably something you could "offload" to the STL with good results.