free（）导致堆栈溢出

Question

我正在尝试使用一些通信DLLs使用Visual Studio C ++开发应用程序。 在其中一个DLL中，我有一个堆栈溢出异常。

我有两个功能，一个接收数据包，另一个函数对数据包执行一些操作。

static EEcpError RxMessage(unsigned char SrcAddr, unsigned char SrcPort, unsigned char DestAddr, unsigned char DestPort, unsigned char* pMessage, unsigned long MessageLength)
{
    EEcpError Error = ERROR_MAX;
    TEcpChannel* Ch = NULL;
    TDevlinkMessage* RxMsg = NULL;

    // Check the packet is sent to an existing port
    if (DestPort < UC_ECP_CHANNEL_NB)
    {
        Ch = &tEcpChannel[DestPort];
        RxMsg = &Ch->tRxMsgFifo.tDevlinkMessage[Ch->tRxMsgFifo.ucWrIdx];

        // Check the packet is not empty
        if ((0UL != MessageLength)
            && (NULL != pMessage))
        {
            if (NULL == RxMsg->pucDataBuffer)
            {
                // Copy the packet
                RxMsg->SrcAddr = SrcAddr;
                RxMsg->SrcPort = SrcPort;
                RxMsg->DestAddr =DestAddr;
                RxMsg->DestPort = DestPort;
                RxMsg->ulDataBufferSize = MessageLength;
                RxMsg->pucDataBuffer = (unsigned char*)malloc(RxMsg->ulDataBufferSize);
                if (NULL != RxMsg->pucDataBuffer)
                {
                    memcpy(RxMsg->pucDataBuffer, pMessage, RxMsg->ulDataBufferSize);

                    // Prepare for next message
                    if ((UC_ECP_FIFO_DEPTH - 1) <= Ch->tRxMsgFifo.ucWrIdx)
                    {
                        Ch->tRxMsgFifo.ucWrIdx = 0U;
                    }
                    else
                    {
                        Ch->tRxMsgFifo.ucWrIdx += 1U;
                    }

                    // Synchronize the application
                    if (0 != OS_MbxPost(Ch->hEcpMbx))
                    {
                        Error = ERROR_NONE;
                    }
                    else
                    {
                        Error = ERROR_WINDOWS;
                    }
                }
                else
                {
                    Error = ERROR_WINDOWS;
                }
            }
            else
            {
                // That should never happen. In case it happens, that means the FIFO
                // is full. Either the FIFO size should be increased, or the listening thread 
                // does no more process the messages.
                // In that case, the last received message is lost (until the messages are processed, or forever...)
                Error = ERROR_FIFO_FULL;
            }
        }
        else
        {
            Error = ERROR_INVALID_PARAMETER;
        }
    }
    else
    {
        // Trash the packet, nothing else to do
        Error = ERROR_NONE;
    }

    return Error;
}

static EEcpError ProcessNextRxMsg(unsigned char Port, unsigned char* SrcAddr, unsigned char* SrcPort, unsigned char* DestAddr, unsigned char* Packet, unsigned long* PacketSize)
{
    EEcpError Error = ERROR_MAX;
    TEcpChannel* Ch = &tEcpChannel[Port];
    TDevlinkMessage* RxMsg = &Ch->tRxMsgFifo.tDevlinkMessage[Ch->tRxMsgFifo.ucRdIdx];

    if (NULL != RxMsg->pucDataBuffer)
    {
        *SrcAddr = RxMsg->ucSrcAddr;
        *SrcPort = RxMsg->ucSrcPort;
        *DestAddr = RxMsg->ucDestAddr;
        *PacketSize = RxMsg->ulDataBufferSize;
        memcpy(Packet, RxMsg->pucDataBuffer, RxMsg->ulDataBufferSize);

        // Cleanup the processed message
        free(RxMsg->pucDataBuffer);   // <= Exception stack overflow after 40 min
        RxMsg->pucDataBuffer = NULL;
        RxMsg->ulDataBufferSize = 0UL;
        RxMsg->ucSrcAddr = 0U;
        RxMsg->ucSrcPort = 0U;
        RxMsg->ucDestAddr = 0U;
        RxMsg->ucDestPort = 0U;

        // Prepare for next message
        if ((UC_ECP_FIFO_DEPTH - 1) <= Ch->tRxMsgFifo.ucRdIdx)
        {
            Ch->tRxMsgFifo.ucRdIdx = 0U;
        }
        else
        {
            Ch->tRxMsgFifo.ucRdIdx += 1U;
        }

        Error =ERROR_NONE;
    }
    else
    {
        Error = ERROR_NULL_POINTER;
    }

    return Error;
}

问题在40分钟后发生，在这段时间内，我收到了很多数据包，并且一切进展顺利。 40分钟后，堆栈溢出异常立即发生。 我不知道怎么了。

有人可以帮我吗？

谢谢。

Answer 1

一些建议：

1. 线

     memcpy(Packet, RxMsg->pucDataBuffer, RxMsg->ulDataBufferSize); 

   有点怀疑，因为它发生在free()调用崩溃之前。 如何分配Packet ，如何确保此处不会发生缓冲区溢出？

2. 如果这是一个异步/多线程程序，您是否具有必要的锁以防止同时写入/读取数据？
3. 如果您仍然需要查找问题，最好的选择是运行类似Valgrind的工具，以帮助更准确地诊断和缩小内存问题。 正如dasblinklight在评论中提到的那样，问题很可能起源于其他地方，并且恰好出现在free()调用中。