尺寸1 X的無效寫入字節** **裏面大小的塊> X ** ** alloc'd

Question

我是比較新的調試Valgrind的錯誤，而這其中有我難住了：

==1920== Invalid write of size 1 
==1920== at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506) 
==1920== by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448) 
      ... redacted (see end for full error) 
==1920== Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd 
==1920== at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299) 
==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879) 
      ... redacted (see end for full error) 

請注意，這是字節井內和分配塊。我已經看到類似的錯誤，涉及寫入之後，或之前，或到free'd塊，甚至寫入寫入大小大於塊結束地址（因此溢出），但我找不到像這個。

這發生在R CRAN check farm在this line of code。

我無法在OSX或linux虛擬機上使用valgrind在本地重現錯誤。

除此之外，錯誤對我沒有意義。爲什麼我不能在分配塊的中間寫入1個字節？這一切都在R內部運行，所以我猜可能我認爲有問題的分配是由程序的一個不同部分產生的，並且它以某種方式保留下來（一種可能的提示是，發生這種情況的是我從R請求的分配小於60字節當錯誤出現時），但我不知道這是valgrind能夠檢測到的東西。

完整的錯誤：可使用內存池時發生

==1920== Invalid write of size 1 
==1920== at 0x4C2ECC7: strcpy (/builddir/build/BUILD/valgrind-3.11.0/memcheck/../shared/vg_replace_strmem.c:506) 
==1920== by 0x1D533B57: CSR_bullet (packages/tests-vg/vetr/src/cstringr.c:448) 
==1920== by 0x1D53317D: CSR_bullet_ext (packages/tests-vg/vetr/src/cstringr-ext.c:107) 
==1920== by 0x4852BD: do_dotcall (svn/R-devel/src/main/dotcode.c:1252) 
==1920== by 0x4C274D: Rf_eval (svn/R-devel/src/main/eval.c:728) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4C2391: Rf_eval (svn/R-devel/src/main/eval.c:747) 
==1920== by 0x4C29E0: forcePromise (svn/R-devel/src/main/eval.c:520) 
==1920== by 0x4C27A1: Rf_eval (svn/R-devel/src/main/eval.c:647) 
==1920== by 0x4C7746: do_withVisible (svn/R-devel/src/main/eval.c:2998) 
==1920== by 0x4F7104: do_internal (svn/R-devel/src/main/names.c:1363) 
==1920== by 0x4B553B: bcEval (svn/R-devel/src/main/eval.c:6503) 
==1920== Address 0x1bd1be1f is 5,599 bytes inside a block of size 7,960 alloc'd 
==1920== at 0x4C2BBAD: malloc (/builddir/build/BUILD/valgrind-3.11.0/coregrind/m_replacemalloc/vg_replace_malloc.c:299) 
==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879) 
==1920== by 0x4F5814: Rf_allocVector3 (svn/R-devel/src/main/memory.c:2659) 
==1920== by 0x4CAEAF: Rf_allocVector (svn/R-devel/src/include/Rinlinedfuns.h:247) 
==1920== by 0x4CAEAF: do_growconst (svn/R-devel/src/main/eval.c:7490) 
==1920== by 0x4B64BD: bcEval (svn/R-devel/src/main/eval.c:6483) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 
==1920== by 0x4C3AB5: R_execClosure (svn/R-devel/src/main/eval.c:1617) 
==1920== by 0x4BAE13: bcEval (svn/R-devel/src/main/eval.c:6454) 
==1920== by 0x4C2207: Rf_eval (svn/R-devel/src/main/eval.c:624) 

Answer 1

這樣的錯誤。

通常，lib或應用程序（例如R）可以通過獲取大塊（例如R）來構建其自己的分配器 。從malloc，然後從這些大塊分配小塊 。 Valgrind有一些客戶端請求允許描述這些塊（大或小塊）和它們的分配。

有了這樣的客戶端請求，您可能會分配一部分malloc分配塊 ，實際上標記爲不可尋址。

看到堆棧跟蹤條目：

==1920== by 0x4F3D3E: GetNewPage (svn/R-devel/src/main/memory.c:879)

上面的解釋看起來似是而非。

然後，這可能是有一個真正的錯誤的地方中的R 的指示和/或在R分配器描述了它的內存池的valgrind