由於指針無效導致段錯誤

Question

我正在建立一個bin樹。例如：key AAAA1.ETR, value 1。

我閱讀文件與此結構：

DataLength Block-SequenceNummer FLag Start Data  Ende 
4 Bytes 8 Bytes    1 Byte S  Datalength E 

數據可以被壓縮或解壓縮（這是保存在標誌）。 數據包含更多消息。

我得到這個錯誤：

*** glibc detected *** /home/frog/reader/unzipper: free(): invalid pointer: 0x00007ffff4c55108 *** 
======= Backtrace: ========= 
/lib/x86_64-linux-gnu/libc.so.6(+0x7eb96)[0x7ffff758cb96] 
/home/frog/reader/unzipper[0x401f2f] 
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7ffff752f76d] 
/home/frog/reader/unzipper[0x400f59] 

回溯：

(gdb) backtrace 
#0 0x00007ffff7544425 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 
#1 0x00007ffff7547b8b in __GI_abort() at abort.c:91 
#2 0x00007ffff758239e in __libc_message (do_abort=2, fmt=0x7ffff768c748 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201 
#3 0x00007ffff758cb96 in malloc_printerr (action=3, str=0x7ffff7689053 "free(): invalid pointer", ptr=<optimized out>) at malloc.c:5039 
#4 0x0000000000401f1a in main() at u.c:373 (which is datap) 

這裏是我試過到目前爲止：

#include <stdint.h> 
#include <stdio.h> 
#include <stdlib.h> 
#include "zlib.h" 
#include <errno.h> 
#include <string.h> 
#include <dirent.h> 
#include <stdio.h> 
#include <glib.h> 
#include <sys/stat.h> 
#define MYMAXSIZE 10000000 
#define MAXFILESIZE 6000000 
#define OBJNAME "8" 
#define MSGTYPE "1" 

const uint8_t broadcast[] = { 0x36, 0x33 }; 
const uint8_t status[] = { 0x34 }; 
const char dir0[]= "/home/frog/reader/feed.0/"; 
const char dir1[]= "/home/frog/reader/feed.1/"; 
const char dir2[]= "/home/frog/reader/feed.2/"; 
const char dir3[]= "/home/frog/reader/feed.3/"; 

typedef struct mtmheader_t 
{ 
    unsigned char objName[20]; //8 
    unsigned char msgType[3];  //1 
}mtmheader_t; 

typedef struct analyzer_t 
{ 
    unsigned char *buff; 
    size_t s; 

}analyzer_t; 


typedef struct analyzers_t 
{ 
    analyzer_t anal1; 
    analyzer_t anal2; 
    analyzer_t anal3; 
    unsigned char* seq; 
}analyzers_t; 

int readFilec(GTree *tree) 
{ 
    FILE * fp = fopen("cfg/InstrumentList_FULL.csv", "rb"); 
    char * line = NULL; 
    size_t len = 0; 
    ssize_t read; 

    if (fp == NULL) 
    exit(EXIT_FAILURE); 
    while ((read = getline(&line, &len, fp)) != -1) 
    { 
    char *p1; 
    int *p2 = malloc(sizeof (int)); 
    printf("%s", line); 
    p1 = strtok(line, "|"); 
    *p2 = atoi(strtok(NULL, "|")); 
    g_tree_insert(tree, (gpointer) strdup(g_strdup(p1)), (gpointer)p2); 
    //TrieAdd(&root, strdup(p1), p2); 
    printf("-%s%d ", p1, *p2); 

    } 


    //exit(EXIT_SUCCESS); 

} 
int readFile(char *name,unsigned char *buffp) 
{ 
    int fileSize = 0; 
    //int n, i, j; 
    printf("Opening file: \"%s\"\n", name); 
    FILE *pFile = fopen(name, "rb"); 
    if(pFile == NULL) 
    { 
    printf("error: fopen()"); 
    return -1; 
    } 
    fseek(pFile, 0, SEEK_END); 
    fileSize = ftell(pFile); 
    printf ("%d\n", fileSize); 
    rewind(pFile); 
    //unsigned char *data = (unsigned char*) calloc(sizeof(unsigned char), fileSize + 20); 
    int bytes = fread(buffp, 1, fileSize, pFile); 
    if(ferror(pFile)) 
    { 
    printf("error: fread()"); 
    return -1; 
    } 
    return bytes; 
} 

int processMTMHeader(unsigned char *datap, mtmheader_t *h, unsigned char *endmmsgp) 
{ 
    unsigned char *nextFsp; 
    unsigned char *nextRsp; 
    //nextRs 
    size_t size = endmmsgp - datap; 
    //Den Header komplett abarbeiten (bis GS (x1D) oder ETX (x03) kommt) 
    //Byte lesen = RS (x1E) 
    while ((datap = (memchr(datap, 0x1E, size))) != NULL)//datap < endmmsgp)//= strchr(datap, '\x1E') != NULL) 
    { 
    datap++; 

    //next Fs 
    //Byte lesen = FS (x1C) 
    nextFsp = memchr(datap, 0x1C,size); 
    //Byte lesen = RS (x1C) 
    nextRsp = memchr(datap, 0x1E, size); 
    size = endmmsgp - nextRsp; 
    if (nextFsp - datap != 1)continue; 
    if(*datap == 0x38) 
    { 
     //Objectnamen generieren() (Nur die ersten beiden Felder des Objectnamens verwenden) 
     memcpy (h->objName, nextFsp+1, nextRsp - (nextFsp+1) ); 
     h->objName[ nextRsp - (nextFsp+1)]='\0'; 
     //Abbruch der Schleife da ich jetzt den Objectnamen habe (Den Header komplett abarbeiten) 
     return 1; 
    } 
    else if (*datap == 0x31) 
    { 
     memcpy (h->msgType, nextFsp+1, nextRsp - (nextFsp+1) ); 
     h->msgType[nextRsp - (nextFsp+1)]='\0'; 
     if((memcmp(h->msgType, broadcast, sizeof broadcast) != 0) && (memcmp(h->msgType,status, sizeof(status))!=0)) return 2; 
    } 
    } 
    return -1; 
} 

int processData(unsigned char *datap, size_t size, GTree* t, analyzers_t *anals) 
{ 
    int headerOk=0; 
    unsigned char *nextmtmmsgp; 
    unsigned char *endmmsgp ; 
    int * qsp; 
    int s; 

    while ((datap = memchr (datap, 0x02, size))!= NULL) 
    { 
    //datap++; 
    //printf("data\n%s", datap); 
    endmmsgp = memchr (datap, 0x03, size); 
    mtmheader_t h; 
    headerOk = processMTMHeader(datap, &h, endmmsgp); 
    int headersSize1 = 10; 
    int headersSize2 = 10; 
    int headersSize3 = 10; 
    if (headerOk == 1) 
    { 
     if ((qsp = (int *) g_tree_lookup(t, h.objName)) != NULL) 
     { 
      s = (endmmsgp - datap)+ 1; 
      printf("found: %s %d\n", h.objName, *qsp); 
      switch (*qsp) 
      { 
      case 1: 
       memcpy(anals->anal1.buff + anals->anal1.s + headersSize1, datap, s); 
       anals->anal1.s = s + headersSize1 + anals->anal1.s ; 
       headersSize1=0; 
       break; 
      case 2: 
       memcpy(anals->anal2.buff + anals->anal2.s + headersSize2, datap, s); 
       anals->anal2.s= s + headersSize2 + anals->anal2.s ; 
       headersSize2=0; 
       break; 
      case 3: 
       memcpy(anals->anal3.buff + anals->anal1.s + headersSize3, datap, s); 
       anals->anal3.s= s + headersSize3 + anals->anal3.s ; 
       headersSize3=0; 
       break; 
     } 
     } 
     else if (headerOk == 2) 
     { 
     memcpy(anals->anal1.buff + anals->anal1.s + headersSize1, datap, s); 
     anals->anal1.s = s + headersSize1 + anals->anal1.s ; 
     headersSize1=0; 

     memcpy(anals->anal2.buff + anals->anal2.s + headersSize2, datap, s); 
     anals->anal2.s= s + headersSize2 + anals->anal2.s ; 
     headersSize2=0; 

     memcpy(anals->anal3.buff + anals->anal1.s + headersSize3, datap, s); 
     anals->anal3.s= s + headersSize3 + anals->anal3.s ; 
     headersSize3=0; 
     } 
    } 
    datap++; 
    printf("Name, type: %s %s\n",(char *) &h.objName,(char *) &h.msgType); 
    } 
    return -1; 
} 

gboolean iter_all(gpointer key, gpointer value, gpointer data) { 
    int *s = (int *)value; 
    printf("\n%s%d \n", (char *)key, *s); 
    return FALSE; 
} 

int writeFile(char *name, unsigned char *buff, size_t *size, char *dir) 
{ 
    FILE * pFile; 
    char fullName[50]; 
    //fullName[0]='\0'; 
    //strcat(fullName, dir); 
    //strcat(fullName, name); 
    chdir (dir); 
    pFile = fopen (name, "wb"); 
    //pFile = fopen (strcat (strcat(strcat("feed.",anal), "/") , name), "wb"); 
    fwrite (buff , sizeof(unsigned char), *size, pFile); 
    fclose (pFile); 
} 


int writeFiles(char *name, analyzers_t *anals) 
{ 
    if (anals->anal1.s > 10)writeFile(name, anals->anal1.buff, &anals->anal1.s, dir1); 
    if (anals->anal2.s > 10)writeFile(name, anals->anal2.buff, &anals->anal2.s, dir2); 
    if (anals->anal3.s > 10)writeFile(name, anals->anal3.buff, &anals->anal3.s, dir3); 
} 

int addHeader(size_t *start_size, size_t *end_size,unsigned char *buff, unsigned char *seq) 
{ 
    *(buff+*start_size+ 9) ='S'; 
    uint32_t s = ((*end_size - *start_size) - 10); 

    //size_t s_be = htonl(s); 
    memcpy(buff+*start_size, &s, sizeof(s)); 
    memcpy(buff+4+*start_size, seq, 8); 
    buff[*start_size+8] = '\x00'; 
    *(buff + *end_size) = 'E'; 

} 

int main() 
{ 
    analyzers_t anals; 
    anals.anal1.buff = malloc(MYMAXSIZE); 
    anals.anal2.buff = malloc(MYMAXSIZE); 
    anals.anal3.buff = malloc(MYMAXSIZE); 
    unsigned char *bytesp = malloc (MAXFILESIZE); 
    unsigned char *datap = malloc (MYMAXSIZE); 
    //char dir[]  = "feed.0/"; 

    DIR *dirp; 
    char currDir[]="."; 
    char parentDir[]=".."; 
    GTree* t = g_tree_new((GCompareFunc)g_ascii_strcasecmp); 
    readFilec(t); 
    g_tree_foreach(t, (GTraverseFunc)iter_all, NULL); 
    struct dirent *direntp; 
    if ((dirp = opendir(dir0)) == NULL) 
    { 
    perror("opendir"); 
    return 0; 
    } 
    struct stat status; 
    chdir(dir0); 
    int pos=0; 
    uint32_t seq; 
    size_t size; 
    int flag; 
    if (datap == NULL)return -1; 
    unsigned char *datapor = datap; 
    int compressOk=0; 
    int loop =0; 
    size_t oldSize1=0; 
    size_t oldSize2=0; 
    size_t oldSize3=0; 

    while((direntp = readdir(dirp)) != NULL) 
    { 
    if(strcmp(direntp->d_name, currDir) == 0)continue; 
    if(strcmp(direntp->d_name, parentDir) == 0)continue; 
    lstat(direntp->d_name, &status); 
    if(S_ISDIR(status.st_mode))continue; 

    compressOk=0; 
    loop =0; 
    pos=0; 
    anals.anal1.s = 0; 
    anals.anal2.s = 0; 
    anals.anal3.s = 0; 
    oldSize1 = 0; 
    oldSize2 = 0; 
    oldSize3 = 0; 
    anals.anal1.buff[0]='\0';//anal1or; 
    anals.anal2.buff[0]='\0';//anal2or; 
    anals.anal3.buff[0]='\0';//al3or; 
    readFile(direntp->d_name, bytesp); 
    while(bytesp[pos+9] == 'S') 
    { 
    datap = datapor; 

    printf("----------------------------\n"); 
    printf("| LOOP %d, POSITION %d |\n", loop, pos); 
    printf("----------------------------\n\n"); 

    size = ntohl(bytesp[pos+0]<<24| bytesp[pos+1]<<16| bytesp[pos+2]<<8| bytesp[pos+3]); 
    if (bytesp[pos+10+ size]!='E') 
    { 
     pos = pos + 11 + size; 
     continue; 
    } 
    seq = ntohl(bytesp[pos+4]<<24| bytesp[pos+5]<<16| bytesp[pos+6]<<8| bytesp[pos+7]); 
    anals.seq = bytesp +pos+4; 
    //Flag lesen 
    flag = bytesp[pos+8]; 
    if(bytesp[pos+8]=='\x01') 
    { 
     size_t size_uncompress = MYMAXSIZE * sizeof(unsigned char); 
     compressOk = uncompress(datap, &size_uncompress, &bytesp[pos+10], size); 
     datap[size_uncompress]='\0'; 
     printf ("%zu %zu :\n", size, size_uncompress) ; 
    } 
    else 
    { 
     datap = &bytesp[pos+10]; 
     //datap[pos+10+ size] ='\0'; 
    } 
    printf("---------------------------- \n"); 
    printf("|  Message as String: |\n"); 
    printf("---------------------------- \n"); 
    printf("%s\n\n\n", datap); 
    processData(datap, size, t, &anals); 
    pos = pos + 11 + size; 

    if (anals.anal1.s > oldSize1) 
    { 
     addHeader(&oldSize1,&anals.anal1.s, anals.anal1.buff, anals.seq); 
     anals.anal1.s++; 
     oldSize1 = anals.anal1.s; 

    } 
    if (anals.anal2.s > oldSize2) 
    { 
     addHeader(&oldSize2,&anals.anal2.s, anals.anal2.buff, anals.seq); 
     anals.anal2.s++; 
     oldSize2 = anals.anal2.s; 

    } 
    if (anals.anal3.s > oldSize3) 
    { 
     addHeader(&oldSize3,&anals.anal1.s, anals.anal3.buff, anals.seq); 
     anals.anal3.s++; 
     oldSize3 = anals.anal1.s; 

    } 

    loop++; 

    } 
    writeFiles(direntp->d_name, &anals); 
} 
free(datap); 
free(bytesp); 
free(anals.anal1.buff); 
free(anals.anal2.buff); 
free(anals.anal3.buff); 
} 

Answer 1

在功能readFilec()，free(line);你已經動態分配內存到指針p2並嘗試釋放一個字符指針line，這是不正確的。