|
内存泄漏是指由于疏忽或错误造成程序未能释放已经不再使用的内存。内存泄漏并非指内存在物理上的消失，而是应用程序分配某段内存后，由于设计错误，导致在释放该段内存之前就失去了对该段内存的控制，从而造成了内存的浪费。
) p0 _4 t$ g c) ] 我们平时开发过程中不可避免的会遇到内存泄漏问题，你是如何排查的呢？估计你是使用下面这几个工具吧？ valgrind mtrace dmalloc ccmalloc memwatch debug_new
$ ^8 o9 N3 e7 Y# C% M
这里程序喵向大家推荐新的一个排查内存泄漏的工具：AddressSanitizer(ASan)，该工具为gcc自带，4.8以上版本都可以使用，支持Linux、OS、Android等多种平台，不止可以检测内存泄漏，它其实是一个内存错误检测工具，可以检测的问题有： 使用方法直接看我下面的代码： 检测内存泄漏 内存泄漏代码： - 5 \/ y/ k2 a+ E4 F: p6 U
- #include <stdlib.h>* p1 I" n" _& }: k x
" n* U1 F z/ ]8 D- void func1() { malloc(7); }. j1 d+ M5 @# H; O4 g
: r; G1 E B& W G: @/ S) m! |- void func2() { malloc(5); }
$ x* Y! s( `* e5 _: X! i$ O+ m# u
0 l% F Q2 h, o7 C- S/ p- int main() {
, b4 v* J, F: f - func1();% Z6 C& j- y5 r0 z
- func2();
9 j8 O0 S& x; X/ L7 }8 [. @ - return 0;
* Q4 u w$ {5 L% u2 g - }
8 @3 D' h: P1 L" A9 ~0 {" Z" U$ E
编译and输出： - # B' X, T9 N* x9 s
- g++ -fsanitize=address -g test_leak.cc && ./a.out* t( w4 v& g3 N0 `' u" K* q- J! D
7 Q* |2 G/ ]- @! c3 j8 ?- =================================================================
, f2 z9 G( j' Z b$ O - ==103==ERROR: LeakSanitizer: detected memory leaks6 u+ k- g; j& S
- * ?. i2 ?) i3 h$ c, Q
- Direct leak of 7 byte(s) in 1 object(s) allocated from:
& h: _5 F; S+ }- l* b" Z - #0 0x7f95b231eb40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)& _9 C ]" S3 B2 y3 }( ~4 q
- #1 0x7f95b36007f7 in func1() /home/wangzhiqiang/test/test_leak.cc:3
: K) m9 h' B$ l }: v - #2 0x7f95b3600814 in main /home/wangzhiqiang/test/test_leak.cc:8. f) [& @4 J- e3 |$ d
- #3 0x7f95b1e61b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)) |' [ q' z$ o
- ; r) M* W( M5 C: v
- Direct leak of 5 byte(s) in 1 object(s) allocated from:. Q) e/ O f) W9 ?1 X; V- _ x; R
- #0 0x7f95b231eb40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
5 X: ^( S$ {( \ - #1 0x7f95b3600808 in func2() /home/wangzhiqiang/test/test_leak.cc:5
a5 v, V* S+ s3 b - #2 0x7f95b3600819 in main /home/wangzhiqiang/test/test_leak.cc:9
* _# |; w9 X0 L# Z) b - #3 0x7f95b1e61b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
* h" m9 g! A. Q8 w6 o/ [# p+ W - ( ~: I' ^ c7 C3 u* i
- SUMMARY: AddressSanitizer: 12 byte(s) leaked in 2 allocation(s).
# Q+ w; K, y5 Y6 M/ V
编译方式很简单，只需要添加-fsanitize=address -g就可以检测出具体产生内存泄漏的位置以及泄漏空间的大小。 检测堆栈内存越界访问 示例： - ' Y6 N* ^9 y+ I; Z
- #include <iostream>/ k9 O( I1 W$ k1 m
- ( B) y" H4 Y2 F* T" l* B
- int main() {
s( G# e; g* D' b2 v - int *array = new int[100];; |) J" I; g0 F( s# \+ k
- array[0] = 0;+ {$ H' d; v. S# L/ G" D s1 K
- int res = array[100]; // out of bounds0 S& i; |& `$ f" r+ n& c) `
- delete[] array;/ p+ O7 Q9 v4 c. _
- return res;) ]& S4 r" f- o- S
- }
r; o* S7 d5 x2 D
编译and输出：0 T; c1 M( H* J: x
- / q. W/ M% A4 w- W, H7 m# a) P( V
- g++ -fsanitize=address -g test_leak.cc && ./a.out
) n$ g+ ^+ k# |' G -
: t8 }( _& z* M" S7 q - =================================================================& w+ R) E$ H6 w! m. X
- ==110==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6140000001d0 at pc 0x7f0e06400d2e bp 0x7ffff5963f10 sp 0x7ffff5963f00
; b$ ]6 r7 f G+ j5 Z - READ of size 4 at 0x6140000001d0 thread T0( v5 D* t7 h4 Y
- #0 0x7f0e06400d2d in main /home/wangzhiqiang/test/test_leak.cc:6
& j& u) q( n5 a0 T6 d) O6 i - #1 0x7f0e048d1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)" m- h3 B7 |1 T! l' c _6 n+ ]
- #2 0x7f0e06400bb9 in _start (/mnt/d/wzq/wzq/util/test/a.out+0xbb9)9 M( N4 M! {& W& W" h" G
- 9 J+ [0 [% m) F1 l) F
- 0x6140000001d0 is located 0 bytes to the right of 400-byte region [0x614000000040,0x6140000001d0); O. n% T4 p% u d( z
- allocated by thread T0 here:3 N% \3 k! `- w. g) ?
- #0 0x7f0e05120608 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0608). J# X, K8 q3 [ _
- #1 0x7f0e06400cab in main /home/wangzhiqiang/test/test_leak.cc:4! U% L1 D4 P- E4 R" k+ Q- Y
- #2 0x7f0e048d1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
, [( w( X, u2 r - / K6 {/ K6 I$ P, z$ y$ {3 k
- SUMMARY: AddressSanitizer: heap-buffer-overflow /home/wangzhiqiang/test/test_leak.cc:6 in main
! y7 j! |+ ^% J( _6 m$ r8 M - Shadow bytes around the buggy address:2 P7 Z4 n5 B0 _0 _
- 0x0c287fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00% t2 ?; u- d* q7 i* Y0 K% `) y
- 0x0c287fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
3 `! o) @6 h' T3 _3 p; p$ p - 0x0c287fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
$ W T2 x% ?! P1 {. Q - 0x0c287fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 003 S2 c3 u/ F h; [: v3 W, M. j6 r$ b, R
- 0x0c287fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00+ m. x: M6 d( K
- =>0x0c287fff8030: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa1 \/ `. x5 y+ C9 ~/ n9 ^
- 0x0c287fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa( y! K& k5 P$ B* h6 t
- 0x0c287fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa/ p& Y& X# G. n8 p; L) X8 ~/ V
- 0x0c287fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa: B, C; w- p& o
- 0x0c287fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
q! E8 P1 N1 h: N4 D( e# ^+ r - 0x0c287fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
9 ?' `1 `8 g( _8 g - Shadow byte legend (one shadow byte represents 8 application bytes):% K1 r5 @ ?3 N; g* V* ^! Z4 T2 I
- Addressable: 00
% D& d( d; W/ s9 B) t4 N3 w0 o - Partially addressable: 01 02 03 04 05 06 074 w! y6 ]' R5 ~
- Heap left redzone: fa
- o3 \' W9 C6 u2 h' V( H- Z2 }7 R - Freed heap region: fd
* Q$ y3 c0 L; \& O - Stack left redzone: f1
5 v+ H: A, J1 t2 A, d& Z) _1 A5 ~ - Stack mid redzone: f2
; w# ?6 x j8 Z; Z - Stack right redzone: f3. Z8 `+ A( |4 e/ p. w; y4 z( c7 C" V F
- Stack after return: f5
: D: _% n5 `+ f6 j - Stack use after scope: f8
: j, \/ [: F$ P8 U& V# p% A - Global redzone: f9( I- L* ]- C0 L8 g2 D, @
- Global init order: f6
5 ~. W* h! ?. U& \: F1 r- [, s m - Poisoned by user: f7" Q+ b6 o$ |; W5 y i) x
- Container overflow: fc
8 h9 H8 I% G0 F! C" ?3 _ - Array cookie: ac
$ N7 [7 B2 @/ X' O" C: d - Intra object redzone: bb
# r7 s9 j( p0 [5 b - ASan internal: fe
8 v! V( v/ \( h; Z% ?2 m7 ^5 p+ P* J - Left alloca redzone: ca
1 H# p* I1 x& r" g+ A; w# ]0 A | - Right alloca redzone: cb
, u! t o4 n3 @/ Z - ==110==ABORTING
) R$ u# e8 d: G# E, O( N* I
可以方便定位到堆栈内存越界访问的错误。 全局内存越界访问： 示例： - 3 Q Y% Z$ ~: {" `0 W3 R. R
- #include <iostream>
6 t, Q) V$ |$ D M
# W; {! K' m# }: M3 y" o8 k- int global_array[100] = {0};
" q! _8 A9 A7 ]$ C1 C - 1 {& q! W7 \2 r$ i% D
- int main() {
2 F1 t! h* C6 E$ D! b - int res = global_array[100]; // out of bounds! t6 i, k- Z" X8 e' ^% Y; L
- return 0; x1 w* T. x/ u& `& u
- }
& k* |, E' m: Z' a0 V
编译and输出：
( t1 d5 n1 `9 G' q" C - : q' v1 c1 V' C6 K4 X
- g++ -fsanitize=address -g test_leak.cc && ./a.out
1 h" c' O9 a% z0 q. s3 B% F _. N - =================================================================
" ~" a8 d1 @2 V - ==116==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f42e6e02310 at pc 0x7f42e6c00c84 bp 0x7fffdda52780 sp 0x7fffdda52770
i& H0 t, `. \5 ` - READ of size 4 at 0x7f42e6e02310 thread T0
! d# u1 _* _# z, ~1 J1 w4 L# O! s9 n - #0 0x7f42e6c00c83 in main /home/wangzhiqiang/test/test_leak.cc:6
; p" j. H( |2 Z5 e - #1 0x7f42e50d1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
% J$ _" m6 o& o! [ n X - #2 0x7f42e6c00b69 in _start (/mnt/d/wzq/wzq/util/test/a.out+0xb69)
! C6 A$ D% [) ~& V7 a3 Z6 Q1 t1 |
8 M! D) K6 A6 a- 0x7f42e6e02310 is located 0 bytes to the right of global variable 'global_array' defined in 'test_leak.cc:3:5' (0x7f42e6e02180) of size 400. C; g, m5 ~3 ?. e7 l
- SUMMARY: AddressSanitizer: global-buffer-overflow /home/wangzhiqiang/test/test_leak.cc:6 in main( A' I1 `. ?9 p3 Y
- Shadow bytes around the buggy address:4 k$ r+ |- y: B6 E, b/ {
- 0x0fe8dcdb8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 003 u8 K( R- _1 y9 Q
- 0x0fe8dcdb8420: 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
3 B) L6 f) s' r3 ?1 [- ?$ g7 L3 y - 0x0fe8dcdb8430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
; G! Z3 j$ F, J( N$ M/ f - 0x0fe8dcdb8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00. K/ `. m* y: f; c7 M. v$ r) `
- 0x0fe8dcdb8450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4 x& G7 i. F+ y& | - =>0x0fe8dcdb8460: 00 00[f9]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
8 ]9 `: Y0 A' T6 g - 0x0fe8dcdb8470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1 A! |; _2 D$ ]/ x9 R# Q - 0x0fe8dcdb8480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00, S0 }( b: t1 w m% L
- 0x0fe8dcdb8490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00( q/ T$ }( p' b
- 0x0fe8dcdb84a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
9 M7 A U& S( H$ E( Z5 E- }# X - 0x0fe8dcdb84b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0 l, b( S8 Q- K! d7 a6 a U - Shadow byte legend (one shadow byte represents 8 application bytes):
0 j! _7 b+ l; a) s - Addressable: 00+ l3 q n; c. Z( e/ k9 g w: v2 k( c
- Partially addressable: 01 02 03 04 05 06 07- L$ R; |, y) D# F/ u7 h6 |& N
- Heap left redzone: fa
4 F1 x! l2 Q- g - Freed heap region: fd1 T: Q( e( W! B' \
- Stack left redzone: f1
: M% H5 P2 t9 @5 u - Stack mid redzone: f2
# _$ e4 T" h4 d3 s e- W3 x$ l - Stack right redzone: f3 k, m1 j9 d1 r% }; M& k. {+ l
- Stack after return: f5
( z/ f' U1 \7 |( M' M8 q* g - Stack use after scope: f8
+ x% {; N& v3 T- |5 G! O3 O* e3 | - Global redzone: f9! s K; l' [8 ] D8 y+ k% P2 o1 U
- Global init order: f6
: w+ |: q1 \# N V) v6 J. C! Y - Poisoned by user: f7, ~. } e2 o; J8 a, ~8 d
- Container overflow: fc
$ g4 ?! R- h8 w( ~ `/ U' X. W* U - Array cookie: ac
+ j h9 o; `' ^% Z M - Intra object redzone: bb
" S7 q9 g# \$ `. e - ASan internal: fe$ t4 E- H/ _7 {/ M0 z2 B: \
- Left alloca redzone: ca
7 l: u3 T* q/ h6 x) g$ U - Right alloca redzone: cb
0 B- z: c6 Q; E7 L- H: j - ==116==ABORTING
& @* B7 q) i" d3 r6 f0 a
局部内存被外层使用 示例：
- e0 ~/ |4 R/ [+ w; P5 E7 b) W- #include <iostream>* M" a3 J! f; M* L* R L
4 n+ G/ B% @8 q# `) W' m0 J- volatile int *p = 0;
6 D# _4 p; r, J: L: z# j - ! A: F b, h5 ]8 N6 a/ C2 Q6 Q6 D
- int main() {
, W: s; K- I1 }" D8 w3 X, B - {( K" ~5 n; Z3 F, r8 q
- int x = 0;
- D: w' f# v. C - p = &x;
. e+ p( J: O! Z. e, G! ~ - }
# R' n+ t0 E8 r - *p = 5;6 K6 Q. K! k; K1 f. \, h9 S7 q3 j! ?$ q
- return 0;( ^* _8 c$ H; F1 P$ g
- }
/ f) o% r& p& b9 m* Y
编译and输出：) }- `$ V3 C6 f3 k! j7 h1 ?
- 4 J3 ^5 v: W I; N; {. u
- g++ -fsanitize=address -g test_leak.cc && ./a.out: X' r& y7 A" r& K
- =================================================================
- S$ x. e7 X1 f/ C - ==243==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fffce12a4b0 at pc 0x7f3993e00e7e bp 0x7fffce12a480 sp 0x7fffce12a470
" Q' f: l* E$ E7 k a - WRITE of size 4 at 0x7fffce12a4b0 thread T08 ? }; a9 `& u4 j
- #0 0x7f3993e00e7d in main /home/wangzhiqiang/test/test_leak.cc:10 j1 c; j' f0 H: G% P
- #1 0x7f39922d1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)4 U8 @. s# A" d
- #2 0x7f3993e00c89 in _start (/mnt/d/wzq/wzq/util/test/a.out+0xc89)
! ]% y- A1 P. J8 G
: @, F( j! H$ s9 Q- Address 0x7fffce12a4b0 is located in stack of thread T0 at offset 32 in frame
B% o. Q* }1 }" t2 u. w! S - #0 0x7f3993e00d79 in main /home/wangzhiqiang/test/test_leak.cc:5! O$ G6 X+ D% \9 _0 B/ H7 }5 [
- ! S) Q6 y6 q9 n3 L2 ?" H
- This frame has 1 object(s):
% O; p, U% q; ] J0 `3 T" V: ^ - [32, 36) 'x' <== Memory access at offset 32 is inside this variable
1 D- N H* H4 d$ V% s) j, Z. A - HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
5 I. P( g+ e* f% w' j% e5 U - (longjmp and C++ exceptions *are* supported)
/ @$ Q- G, v1 \: t1 G) y - SUMMARY: AddressSanitizer: stack-use-after-scope /home/wangzhiqiang/test/test_leak.cc:10 in main. k5 j, G5 x$ G0 ~ o' v, s
- Shadow bytes around the buggy address:% W- ~8 @' k& P9 h) Y/ a% [, ~
- 0x100079c1d440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00& S% o/ b3 g& e2 J6 x
- 0x100079c1d450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
! c1 j/ J5 H1 _ - 0x100079c1d460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
; B; ^! ~ n5 Y- _- ` - 0x100079c1d470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ n! U3 Z2 ]( c" b0 c2 S* ` - 0x100079c1d480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 009 s, O, c$ T' w" T. u0 @
- =>0x100079c1d490: 00 00 f1 f1 f1 f1[f8]f2 f2 f2 00 00 00 00 00 00
/ ^( l- a( b; L- J4 k - 0x100079c1d4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00& ^$ A7 ^ b9 g n/ p
- 0x100079c1d4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
$ o3 q5 p9 j1 r1 T - 0x100079c1d4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
9 G( S: c0 L, k- i9 o8 f - 0x100079c1d4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
" ~# {% C/ I' w9 Q$ g- x - 0x100079c1d4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 003 n6 ?. [, _2 P' p. G9 j
- Shadow byte legend (one shadow byte represents 8 application bytes):. G, K. M/ A/ a' l5 C+ Z& s7 \
- Addressable: 00
1 p2 [% z- Q1 O- b3 _3 D - Partially addressable: 01 02 03 04 05 06 07" r4 H, `" k# f; }2 m! w
- Heap left redzone: fa# c1 R) b3 V' Z/ i1 `; O, a
- Freed heap region: fd
7 z" G' _' \1 N, @: O% A - Stack left redzone: f1
! c6 A. Y! o* b6 @ - Stack mid redzone: f2
7 V, i4 y6 m; U. n& q( h, R - Stack right redzone: f3
/ J1 C$ k+ ? X7 e3 l. \ - Stack after return: f5
$ ~1 s* H% g F! w& n" a - Stack use after scope: f8
. u! z! E% a$ H: R7 m" o. x - Global redzone: f9
0 [0 A* T- m1 N2 U' K - Global init order: f6
3 G& ]9 {/ t+ Y( r! Q* C - Poisoned by user: f7; q8 F- O, O3 ?* v: L
- Container overflow: fc
6 J2 @3 _3 f7 N4 t; x - Array cookie: ac
9 X; l) i7 D+ T4 Y - Intra object redzone: bb1 w* D( S% ?$ J3 n2 F, \+ | `
- ASan internal: fe; |$ G2 @3 a2 b. c
- Left alloca redzone: ca. T! U& H( h* x5 d
- Right alloca redzone: cb
" ?, y" t1 M; n0 J2 d - ==243==ABORTING
9 A+ m* j' p4 d2 P2 ~; B+ o
free后被使用 示例： - : `, k- }1 l+ I! W. V) H9 A
- #include <iostream>* w4 o6 W1 ]/ T. c( ?
6 X; @5 Y# m! p9 I- int main() {
$ s. x9 a) Q2 }8 e5 P* M1 E - int *array = new int[100];6 N: l' r; f; Z3 q* k5 [# H9 N* W* V
- delete[] array;
- z5 U3 f" d) k2 S. d+ l - int a = array[0]; // error/ e/ B' v$ O+ ]: I; v
- return 0;- L3 a$ w# U7 V+ R( A
- }
8 E( w, m- ]$ W/ o( u. e# [
编译and输出：
5 c& z5 j4 y2 I: y: \" | - / N: O, n: y6 W7 f" G
- g++ -fsanitize=address -g test_leak.cc && ./a.out
, g0 G9 V4 V) p( x% E) I* c! Q2 x - =================================================================
' x4 H. d, [& p! v8 O, S - ==282==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000040 at pc 0x7f209fa00caa bp 0x7ffff2a15020 sp 0x7ffff2a150108 X( b& _$ }0 [: _, p
- READ of size 4 at 0x614000000040 thread T0
# B2 }5 H) {! b! z3 G - #0 0x7f209fa00ca9 in main /home/wangzhiqiang/test/test_leak.cc:6
5 b6 {6 W# {' h, L - #1 0x7f209ded1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
( [ B: d2 S: A+ W - #2 0x7f209fa00b69 in _start (/mnt/d/wzq/wzq/util/test/a.out+0xb69)
8 [1 f2 P/ S( W% w+ Y
; |1 `- Z" n- J: G# X8 I+ A; G- 0x614000000040 is located 0 bytes inside of 400-byte region [0x614000000040,0x6140000001d0)# I* M7 X/ e3 _0 T( g3 ]% V- h9 K) f& b
- freed by thread T0 here:1 {: W- e T/ Z
- #0 0x7f209e721480 in operator delete[](void*) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe1480)
@# r0 R. `- h3 b - #1 0x7f209fa00c72 in main /home/wangzhiqiang/test/test_leak.cc:5/ l7 H. q z- }! C& e! H. Q: Q' Z
- #2 0x7f209ded1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
; c2 n7 n! _4 v* E - 8 Q) X' W o: n
- previously allocated by thread T0 here:
) [7 B; V9 l2 }! `6 c - #0 0x7f209e720608 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe0608)
. R `) a# ?" w, K* X# |. z - #1 0x7f209fa00c5b in main /home/wangzhiqiang/test/test_leak.cc:4
4 T% U8 H/ n- l7 S: j - #2 0x7f209ded1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
/ {7 S" I# v2 ?4 `4 z/ N" n - 5 E: {# h/ D/ W* @
- SUMMARY: AddressSanitizer: heap-use-after-free /home/wangzhiqiang/test/test_leak.cc:6 in main) v9 M1 T2 ~" T# b2 Z5 G+ U
- Shadow bytes around the buggy address:
2 H, c9 Z* Y6 i) n' ?7 L+ l1 ^ - 0x0c287fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 004 X' H# Y# e! x& W/ S6 n+ z. _
- 0x0c287fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 008 s, a, ?8 H$ ]' q; l2 }& X) E
- 0x0c287fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
8 _2 R( S$ r$ E: G - 0x0c287fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00* c& B' u. |/ K2 L5 ?& H( X
- 0x0c287fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00! r/ B" O& ~7 m3 e" T
- =>0x0c287fff8000: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd& R1 U- F8 O2 `6 ?" b: n3 b, U+ @
- 0x0c287fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd$ F* A0 q# `; C8 s. t
- 0x0c287fff8020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd( A0 i8 N5 s: r% X1 X* Q! E' e
- 0x0c287fff8030: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
/ l6 v3 c& O* T& h' P9 D - 0x0c287fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa0 @- \' }0 Y1 V" _3 [1 X
- 0x0c287fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
* q. C8 H7 R. y* g- h/ } - Shadow byte legend (one shadow byte represents 8 application bytes):8 c4 f# E/ N$ e4 B2 v; L) W
- Addressable: 00
' B5 F8 Z# X; x - Partially addressable: 01 02 03 04 05 06 07! O, p2 ]# l' r& X7 ?- m, c
- Heap left redzone: fa
. j( L! `( K% N( x, r$ ^ - Freed heap region: fd
) B0 K$ l* v$ t' I( \9 t - Stack left redzone: f1
3 p/ P" z; p' {. C - Stack mid redzone: f2
" E6 b9 M( ^) Q4 L' j4 y6 h - Stack right redzone: f32 j& J. R# A0 K* C7 |
- Stack after return: f5& h& h5 d! F! H# \6 V$ ^
- Stack use after scope: f8
( S0 w) E! q/ G2 N) @, p m$ J - Global redzone: f9) N4 z( n0 }4 q
- Global init order: f68 j) k, L7 n5 [5 X0 p
- Poisoned by user: f7. g7 c: I& h0 `
- Container overflow: fc: m( Q# }2 D# l: o& G
- Array cookie: ac
: j# Q' F! \( d. ~- M - Intra object redzone: bb+ @! x3 F9 O( t* A
- ASan internal: fe
- L( q# G7 p! d# z2 R" k, T% Q - Left alloca redzone: ca3 s" l. g2 O0 J( T0 G7 Q- I
- Right alloca redzone: cb6 }8 Z! Q- ^. B( U# x5 U
- ==282==ABORTING
* C; f' s) f% @9 l2 Q
Initialization order bugs 示例，这里有两个文件： - 4 P- {6 ^( J4 |9 J3 U3 h
- // test_memory1.cc
0 ]: d' e" w/ ?( ` - #include <stdio.h>
3 a: q/ b* b7 _( Y+ D/ M+ S - & s. J0 G9 R* ]
- extern int extern_global;
# M+ U9 q- O% |" A. p+ }7 p - int read_extern_global() { return extern_global; }
. G, A. y4 Z* s2 |6 y& [) W - ! v6 c B- V: v: g( x
- int x = read_extern_global() + 1;9 _5 \9 M7 ^$ k8 ~! O- i$ A
/ N+ K) T0 G6 U3 c* F b+ [- int main() {
2 r; J/ l! Z, U, E. L1 ] - printf("%d\n", x);8 V5 S9 P: z* {( F
- return 0;" W |* ^, c# a; u. r+ D
- }
- 0 e* x2 c ?& U- a
- // test_memory2.cc
. \" ]8 Y9 q1 f - ; p* O5 w: M. a6 O% z- V( F
- int foo() { return 123; }1 J) G5 ]. {, Q$ ]. a! T' x. V
- int extern_global = foo();
& Q' b7 F7 d3 E. d$ R' P
第一种编译方式输出如下：" l. _! O; ]; P G* R5 n7 I
' b) D5 i4 I7 H: w) a- g++ test_memory1.cc test_memory2.cc && ./a.out6 ?0 S/ ^" A! D8 Z2 U
- 1
& Z& E* F' h/ i4 C. M
第二种编译方式输出如下：
- F& ?$ r* Y' T- j6 U8 m& k- g++ test_memory2.cc test_memory1.cc && ./a.out$ | ]) R# [+ S' L- [' |
- 124
& y- L* \: } B
这种问题我们平时编程过程中可以都不会太注意，然而通过ASan可以检测出这种潜在的bug：
3 t4 E9 p1 G' K1 ]0 R9 Q* V. X 编译and输出：
( C0 B3 Y' E& I3 I- g++ -fsanitize=address -g test_memory1.cc test_memory2.cc
( k1 n- n$ F$ p1 L: m5 D8 v" \ - N- @$ ~: \- J7 A
- ASAN_OPTIONS=check_initialization_order=true:strict_init_order=true ./a.out$ m& B! g% [$ C- O
- =================================================================- a3 h( v2 w% X$ A4 A
- ==419==ERROR: AddressSanitizer: initialization-order-fiasco on address 0x7f46c20021a0 at pc 0x7f46c1e00c28 bp 0x7fffe423d920 sp 0x7fffe423d9104 D) W# l& w1 t& W: B2 H
- READ of size 4 at 0x7f46c20021a0 thread T0
+ Y. X1 b) s: T- \- R: n - #0 0x7f46c1e00c27 in read_extern_global() /home/wangzhiqiang/test/test_memory1.cc:3
4 g3 f/ x; l+ N8 p# u - #1 0x7f46c1e00cb3 in __static_initialization_and_destruction_0 /home/wangzhiqiang/test/test_memory1.cc:40 n& M* C5 O$ D7 F. d5 t
- #2 0x7f46c1e00d0a in _GLOBAL__sub_I__Z18read_extern_globalv /home/wangzhiqiang/test/test_memory1.cc:8
# _' k/ b" j; U) |0 `( Y1 U0 a! y. J - #3 0x7f46c1e00e5c in __libc_csu_init (/mnt/d/wzq/wzq/util/test/a.out+0xe5c)4 H, a2 y, ?% B$ A9 g
- #4 0x7f46c0461b27 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b27)* D& E' p# u' Q1 l0 Y1 ^# }2 n0 D; N: W. c
- #5 0x7f46c1e00b09 in _start (/mnt/d/wzq/wzq/util/test/a.out+0xb09): B8 M0 v% x3 E# m
- 6 v) g) R5 C7 W1 j! }' B+ ^
- 0x7f46c20021a0 is located 0 bytes inside of global variable 'extern_global' defined in 'test_memory2.cc:2:5' (0x7f46c20021a0) of size 4" ^" q8 B* ~* q
- registered at:
4 |6 j1 E3 X8 G8 f' k/ C t9 d% X - #0 0x7f46c08764a8 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x364a8)4 z* V& d! w& s3 M) }
- #1 0x7f46c1e00e0b in _GLOBAL__sub_I_00099_1__Z3foov (/mnt/d/wzq/wzq/util/test/a.out+0xe0b)1 P0 n e- B+ r2 I6 G. Y: U, ]" u
- #2 0x7f46c1e00e5c in __libc_csu_init (/mnt/d/wzq/wzq/util/test/a.out+0xe5c)
! z5 N/ [- a1 y - 9 Y+ f+ w3 r, S8 ]$ M
- SUMMARY: AddressSanitizer: initialization-order-fiasco /home/wangzhiqiang/test/test_memory1.cc:3 in read_extern_global()
2 ^7 a$ k* Y3 P$ K( n - Shadow bytes around the buggy address:! j4 s% n% z4 l Q9 c, `( k7 ^
- 0x0fe9583f83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
* @3 X2 E) T; X - 0x0fe9583f83f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
: ]0 T+ K, T6 G - 0x0fe9583f8400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
K6 x* k3 V1 W - 0x0fe9583f8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0 C" Z# m5 v3 Y - 0x0fe9583f8420: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9
( p+ o, d( V9 k+ f - =>0x0fe9583f8430: 00 00 00 00[f6]f6 f6 f6 f6 f6 f6 f6 00 00 00 00
# C3 J; l: `7 m# y - 0x0fe9583f8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00, j; c7 t: K9 K1 g1 w& a
- 0x0fe9583f8450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 005 U4 n1 Z g, D% k" T: ~) X
- 0x0fe9583f8460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ r( o A7 C* a- p9 r - 0x0fe9583f8470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 004 P! V& {2 k2 P, R% y) y
- 0x0fe9583f8480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6 [8 L: L9 Z0 q$ e1 ^: S2 @ - Shadow byte legend (one shadow byte represents 8 application bytes):, ~: G/ M; H9 {# f
- Addressable: 00
0 ]7 i$ `9 U" X9 ~9 k9 @- n- O+ B - Partially addressable: 01 02 03 04 05 06 07
3 H1 h, {6 T) A3 y8 _' A - Heap left redzone: fa
) p4 f( t0 E% z, c/ k: I- T2 i - Freed heap region: fd
4 k, f' a7 R% v# X& J- j - Stack left redzone: f1
- z) k$ m6 {4 y) v5 J( U# D9 V - Stack mid redzone: f2- d l6 l- H" ^; ~
- Stack right redzone: f3
' G! p/ j/ K8 c2 ? - Stack after return: f56 @9 [3 F: P+ R: g$ c0 z1 e) y
- Stack use after scope: f8$ x! o) t3 |8 D6 U, ^3 B
- Global redzone: f99 g/ N3 }& z/ w/ E/ O( n
- Global init order: f6
' U( u. M7 N& @5 _6 O( `' F( u6 F: S - Poisoned by user: f7
5 v" u7 m m* f; V - Container overflow: fc7 n2 ]: ^+ I4 i- g
- Array cookie: ac1 A: |' Y, l; b4 ^0 j" [0 T3 X& Q
- Intra object redzone: bb* ?3 d$ ^+ Y+ M7 w
- ASan internal: fe& l+ {( n- z% P* B+ v% z; M
- Left alloca redzone: ca
/ d3 o* S- t, N7 S$ h - Right alloca redzone: cb
c7 i8 m7 }7 R1 @$ ^* x& i% O, H - ==419==ABORTING
8 d% v1 v! ^3 @' ^/ i- j
注意：这里在运行程序前需要添加环境变量：; }( W- R+ t+ C9 X, f L- N
6 s3 _- D6 B" }! L4 `- ASAN_OPTIONS=check_initialization_order=true:strict_init_order=true
: k3 \; J# u% W3 W
小总结 ASan是个很好的检测内存问题的工具，不需要配置环境，使用还方便，编译时只需要-fsanitize=address -g就可以，运行程序时候可以选择添加对应的ASAN_OPTIONS环境变量就可以检测出很多内存问题。它的错误信息也很有用，明确指出当前是什么类型的内存错误，如：
0 _0 d0 S1 I* J$ h. r2 {8 d8 n/ s* c |
微信公众号
手机版
