Valgrind 使用 C 中的鏈表讀取大小為 4 的無效

Question

我在 C 語言中的鏈表遇到了一些問題。我實際上正在做一個項目，使用套接字與服務器和客戶端連接。 我決定為我的客戶使用鏈接列表。 這是我的結構：

typedef struct ClientsList_s {
    int sockfd;
    struct ClientsList_s *next;
} ClientsList_t;

因此，當我使用 valgrind 執行工作時，我從 6 個上下文中得到了 6 個錯誤。 這是一個錯誤的示例：

Invalid read of size 4
==33211==    at 0x109531: get_max_socket (server.c:26)
==33211==    by 0x1097C2: do_server_loop (server.c:80)
==33211==    by 0x109A40: launch_teams (main.c:53)
==33211==    by 0x109AE6: main (main.c:63)
==33211==  Address 0x4a58040 is 0 bytes inside a block of size 16 free'd
==33211==    at 0x483CA3F: free (in /usr/lib/x86_64-linux- 
gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==33211==    by 0x109675: receive_socket_message (server.c:47)
==33211==    by 0x109832: do_server_loop (server.c:86)
==33211==    by 0x109A40: launch_teams (main.c:53)
==33211==    by 0x109AE6: main (main.c:63)
==33211==  Block was alloc'd at
==33211==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux- 
gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==33211==    by 0x10937B: add_client (client.c:18)
==33211==    by 0x109777: check_new_socket (server.c:68)
==33211==    by 0x109816: do_server_loop (server.c:84)
==33211==    by 0x109A40: launch_teams (main.c:53)
==33211==    by 0x109AE6: main (main.c:63)

這是錯誤來自的函數：

static int get_max_socket(MasterSocket_t *server, ClientsList_t **clients)
{
    int maxSd = server->sockfd;
    ClientsList_t *temp = *clients;

    FD_ZERO(&server->readfds);
    FD_SET(server->sockfd, &server->readfds);
    while (temp != NULL) {
        if (temp->sockfd > 0)
            FD_SET(temp->sockfd, &server->readfds);
        if (temp->sockfd > maxSd)
            maxSd = temp->sockfd;
        temp = temp->next;
    }
    return (maxSd);
}

因此，當我關閉客戶端並且服務器仍在運行時，會出現所有錯誤。 我在 while 中使用 temp 的每一行都會給我一個錯誤。 所以首先我認為這是一個初始化問題，但似乎並非如此。 這是我的功能：

void add_client(ClientsList_t **clients, int newSocket, int port)
{
    ClientsList_t *temp = NULL;
    ClientsList_t *last = *clients;

    temp = malloc(sizeof(ClientsList_t));
    temp->sockfd = newSocket;
    temp->next = NULL;
    if (*clients == NULL)
        *clients = temp;
    else {
        while (last->next != NULL)
            last = last->next;
        last->next = temp;
    }
}

還有一個功能，當我關閉他的客戶時，我會破壞一個元素：

static void receive_socket_message(ClientsList_t **clients,
                                   MasterSocket_t *server)
{
    ClientsList_t *temp = *clients;
    ClientsList_t *tempDel = NULL;
    int valread = 0;
    int addrlen = 0;
    char buffer[1025];

    while (temp != NULL) {
        if (FD_ISSET(temp->sockfd, &server->readfds)) {
            if ((valread = read(temp->sockfd, buffer, sizeof(buffer))) == 0) {
                tempDel = temp;
                temp = temp->next;
                close(tempDel->sockfd);
                free(tempDel);
                continue;
            } else {
                buffer[valread] = '\0';
                printf("%s\n", buffer);
            }
        }
        temp = temp->next;
    }
}

如果你想測試一些東西，有我的循環功能：

static int check_new_socket(ClientsList_t **clients,
                            MasterSocket_t *server, int port)
{
    int newSocket = 0;

    if (FD_ISSET(server->sockfd, &server->readfds)) {
        if ((newSocket = accept(server->sockfd,
                                (struct sockaddr *)&server->address,
                                (socklen_t *)&server->addrlen)) < 0)
            return (-1);
        add_client(clients, newSocket, port);
    }
    return (0);
}

int do_server_loop(MasterSocket_t server, int port)
{
    int maxSd = 0;
    int activity = 0;
    ClientsList_t *clients = NULL;

    while (true) {
        maxSd = get_max_socket(&server, &clients);
        if ((activity = select(maxSd + 1, &server.readfds,
                               NULL, NULL, NULL)) < 0 
        &&  (errno != EINTR))
            return (-1);
        if (check_new_socket(&clients, &server, port) == -1)
            return (-1);
        receive_socket_message(&clients, &server);
    }
    destroy_clients(clients);
    return (0);
}

謝謝你的幫助。

Answer 1

問題出在receive_socket_message中：釋放列表元素時，不會將前一個節點鏈接到下一個節點。

這是修改后的版本：

static void receive_socket_message(ClientsList_t **clients,
                                   MasterSocket_t *server)
{
    ClientsList_t *temp = *clients;
    ClientsList_t *tempDel = NULL;
    ClientsList_t **link = clients;
    int valread = 0;
    int addrlen = 0;
    char buffer[1025];

    while (temp != NULL) {
        if (FD_ISSET(temp->sockfd, &server->readfds)) {
            if ((valread = read(temp->sockfd, buffer, sizeof(buffer))) == 0) {
                tempDel = temp;
                *link = temp = temp->next;
                close(tempDel->sockfd);
                free(tempDel);
                continue;
            } else {
                buffer[valread] = '\0';
                printf("%s\n", buffer);
            }
        }
        link = &temp->next;
        temp = temp->next;
    }
}