Can I use Valgrind to find static memory errors?

Question

I'm working on an embedded program. I use the avr-gcc tool chain to compile the C source from my MacBook Pro. Until recently things have been going pretty well. In my latest development iteration though, I seem to have introduced some sort of intermittent bug that I'm suspecting is some sort of stack or other memory corruption error.

I've never used Valgrind, but it seems it gets rave reviews, but most of the references seem to refer to malloc/free types of errors. I don't do any malloc'ing. It's a smallish embedded program, no OS. Can Valgrind help me? Any pointers on how I would use it to help find static memory mismanagement errors in a cross-compiled scenario would be really helpful!

Or is there a different tool or technique I should look at to validate my code's memory management?

Answer 1

Yes, valgrind can definitely help you. In addition to a lot of heap-based analysis (illegal frees, memory leaks, etc.) its memcheck tool detects illegal reads and writes, ie situations when your program accesses memory that it should not access. This analysis does not differentiate between static and dynamic memory: it would report accesses outside of a stack frame, accesses beyond bounds of a static array, and so on. It also detects access to variables that have not been onitialized previously. Both situations are undefined behavior, and can lead to crash.

Answer 2

Frama-C is a static analysis framework (as opposed to Valgrind which provides dynamic analysis). It was originally designed with embedded, possibly low-level code in mind. Frama-C's “value analysis“ plug-in basically detects all C undefined behaviors that you may want to know about in embedded code (including accessing an invalid pointer).

Since it is a static analyzer, it does not execute the code(*) and is thus ideal in a cross-compiled context. Look for option -machdep . Values for this option include x86_64 x86_32 ppc_32 x86_16.

Disclaimer: I am one of the contributors of Frama-C's “value analysis” plug-in.

(*) though if you provide all inputs and set precision on maximum, it can interpret the source code as precisely as any cross-compilation+execution would .