valgrind使用简介

1、问题

虽然C/C++是一种非常有用且功能强大的语言，但很难调试。 某些时候可能遇到内存错误。 如果知道出错 ，或者程序一直崩溃，我们可以用gdb／DBX去调试。 但是，有时遇到的问题是由于内存错误造成的，但它不出段错误，很多时候，我们不希望海里捞针，在gdb中设置很多断点，逐步盘查。 还有可能会遇到的另一个问题是内存泄漏：在某个地方，调用malloc分配的内存没有调用free来释放。 Valgrind是一个可以帮助解决这两个问题的程序

2、valgrind功能介绍

Valgrind是一个构建动态分析工具的工具框架，其带有一组工具，每个都执行某种调试，分析或类似的任务，可帮助开发者改进程序。 Valgrind的架构是模块化的，因此可以轻松创建新工具，而不会影响现有结构。标准提供了许多有用的工具。

• Memcheck是一个内存错误检测器。它可以帮助您使您的程序更加正确，特别是使用C和C ++编写的程序。
• Cachegrind是一个缓存和分支预测分析器。它可以帮助您使程序运行得更快。
• Callgrind是一个调用图生成缓存分析器。它与Cachegrind有一些重叠，但也收集了一些Cachegrind没有的信息。
• Helgrind是一个线程错误检测器。它可以帮助您使多线程程序更加正确。
• DRD也是一个线程错误检测器。它与Helgrind类似，但使用不同的分析技术，因此可能会发现不同的问题。
• Massif是一个堆分析器。它可以帮助您使您的程序使用更少的内存。
• DHAT是一种不同类型的堆分析器。它可以帮助您了解块寿命，块利用率和布局低效问题。
• SGcheck是一个可以检测堆栈和全局数组溢出的实验工具。它的功能与Memcheck的功能是互补的：SGcheck发现了Memcheck无法解决的问题，反之亦然。
• BBV是一个实验性的SimPoint基本块矢量生成器。对于从事计算机体系结构研究和开发的人员非常有用。

在这里，我们主要讨论内存错误检测器(Memcheck)，用于检测C/C ++程序中常见问题：

• 访问不应该使用的内存，例如溢出，堆溢出，溢出栈顶，在访问释放了的内存。
• 使用未定义的值，即尚未初始化的值或从其他未定义值派生的值。
• 错误地释放堆内存，如重复释放堆，或者不匹配的使用malloc/new/new []与free/delete/delete []
• 在memcpy和相关函数中重叠src和dst指针。
• 在调用内存分配函数时，给size参数传递一个负值。
• 内存泄漏。

像这些问题有时候很难通过其他方式发现，常常长时间未被发现，然后导致偶然的，难以诊断的崩溃。Memcheck还使用命令行选项--xtree-memory和monitor命令xtmemory，对执行树提供内存分析。

3、内存泄露

在这个例子中，释放缓存的逻辑已经被注释，所以产生一个内存泄露的问题。

#define SNPRINTF_ATTR(fmt_pos, firstarg_pos)  \
        __attribute__ ((format(vsnprintf, fmt_pos, firstarg_pos)))

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>

using namespace std;
class query_buffer {
private:
    char *buf;
    size_t len;
    size_t cap;

public:
    query_buffer(): len(), cap() {
        buf = (char *)calloc(cap, sizeof(char));
    };

    virtual ~query_buffer() {
        //if (buf) free(buf);
        len = ;
        cap = ;
    };

    void resize_if_needed(size_t new_len) {
        if (new_len >= cap) {
            while (new_len > cap) cap *= ;
            buf = (char *)realloc(buf, cap*sizeof(char));
        }
        else if ( * new_len < cap) {
            cap /= ;
            buf = (char *)realloc(buf, cap*sizeof(char));
        }
    };

    int append(const char *fmt, ...) SNPRINTF_ATTR(, ) {
        //resize_if_needed(len + max_print_len);
        va_list args;
        va_start(args, fmt);
        int n = vsnprintf(buf + len, static_cast<int>(cap - len), fmt, args);
        if (n>=) len += n;
        va_end(args);
        return n;
    };

    const char *get_buf() {
        return this->buf;
    };
};

int main(void) {
    query_buffer query_buffer;
    query_buffer.resize_if_needed();

    int n = query_buffer.append("%d: %s -- %s, %s\n",
            , "engineer", "office", "computer?");
    n += query_buffer.append("%d: %s -- %s, %s\n",
            , "chef", "kitchen", "oven?");
    n += query_buffer.append("%d: %s -- %s, %s\n",
            , "gardener", "yard", "yard?");
    n += query_buffer.append("%d: %s -- %s, %s\n",
            , "nurse", "hospital", "patient?");
    printf("Total size %d:\n%s", n, query_buffer.get_buf());
}

编译后，运行程序querybuf：

valgrind --tool=memcheck --leak-check=yes --show-reachable=yes --num-callers=20 --track-fds=yes ./querybuf

==== Memcheck, a memory error detector
==== Copyright (C) -, and GNU GPL'd, by Julian Seward et al.
==== Using Valgrind-3.10. and LibVEX; rerun with -h for copyright info
==== Command: ./a.out
====
Total size :
: engineer -- office, (what wrong with the computer?)
: chef -- kitchen, (what wrong with the oven?)
: gardener -- yard, (what wrong with the yard?)
: nurse -- hospital, (what wrong with the patient?)
====
==== FILE DESCRIPTORS:  open at exit.
==== Open file descriptor : /dev/pts/
====    <inherited from parent>
====
==== Open file descriptor : /dev/pts/
====    <inherited from parent>
====
==== Open file descriptor : /dev/pts/
====    <inherited from parent>
====
====
==== HEAP SUMMARY:
====     in use at exit: , bytes in  blocks
====   total heap usage:  allocs,  frees, , bytes allocated
====
==74342== 1,024 bytes in 1 blocks are definitely lost in loss record 1 of 1
==74342==    at 0x4C2BB4A: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==74342==    by 0x400B38: query_buffer::resize_if_needed(unsigned long) (tryvarargs.cpp:32)
==74342==    by 0x4008B5: main (tryvarargs.cpp:53)
====
==== LEAK SUMMARY:
====    definitely lost: , bytes in  blocks
====    indirectly lost:  bytes in  blocks
====      possibly lost:  bytes in  blocks
====    still reachable:  bytes in  blocks
====         suppressed:  bytes in  blocks
====
==== For counts of detected and suppressed errors, rerun with: -v
==== ERROR SUMMARY:  errors from  contexts (suppressed:  from )

从上述报错信息可知，realloc的内存没有释放造成内存泄露。这指向释放realloc分配内存的地方有问题--〉类的destructor。

4、读写过界

下面例子有两个问题：

• 字符串数组分配了10个元素，但是在符值时有11个
• 用malloc分配的内存却用delete来释放。

int main(void) {
    char *buf = (char *)calloc(, sizeof(char));

    for (int i = ; i < ; ++i)
        buf[i] = static_cast<char>('a' + i);

    printf("%s", buf);
    delete buf;
}

我们运行valgrind来查一下内存：valgrind --tool=memcheck ./heapoverflow

==== Memcheck, a memory error detector
==== Copyright (C) -, and GNU GPL'd, by Julian Seward et al.
==== Using Valgrind-3.10. and LibVEX; rerun with -h for copyright info
==== Command: ./heapoverflow
====
==== Invalid write of size
====    at 0x400A3B: main (tryvarargs.cpp:)
====  Address 0x5a1304a is  bytes after a block of size  alloc'd
====    at 0x4C2B974: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
====    by 0x400A1A: main (tryvarargs.cpp:)
====
==101781== Invalid read of size 1
==101781==    at 0x569CA94: vfprintf (in /usr/lib64/libc-2.17.so)
==101781==    by 0x56A5C18: printf (in /usr/lib64/libc-2.17.so)
==101781==    by 0x400A5C: main (tryvarargs.cpp:68)
==101781==  Address 0x5a1304a is 0 bytes after a block of size 10 alloc'd
==101781==    at 0x4C2B974: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==101781==    by 0x400A1A: main (tryvarargs.cpp:63)
====
==== Invalid read of size
====    at 0x56CD4FE: _IO_default_xsputn (in /usr/lib64/libc-2.17.so)
====    by 0x56CB551: _IO_file_xsputn@@GLIBC_2.2.5 (in /usr/lib64/libc-2.17.so)
====    by 0x569CA4C: vfprintf (in /usr/lib64/libc-2.17.so)
====    by 0x56A5C18: printf (in /usr/lib64/libc-2.17.so)
====    by 0x400A5C: main (tryvarargs.cpp:)
====  Address 0x5a1304a is  bytes after a block of size  alloc'd
====    at 0x4C2B974: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
====    by 0x400A1A: main (tryvarargs.cpp:)
====
==101781== Mismatched free() / delete / delete []
==101781==    at 0x4C2B131: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==101781==    by 0x400A68: main (tryvarargs.cpp:69)
==101781==  Address 0x5a13040 is 0 bytes inside a block of size 10 alloc'd
==101781==    at 0x4C2B974: calloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==101781==    by 0x400A1A: main (tryvarargs.cpp:63)
====
abcdefghijk====
==== HEAP SUMMARY:
====     in use at exit:  bytes in  blocks
====   total heap usage:  allocs,  frees,  bytes allocated
====
==== All heap blocks were freed -- no leaks are possible
====
==== For counts of detected and suppressed errors, rerun with: -v
==== ERROR SUMMARY:  errors from  contexts (suppressed:  from )

输出中已经高亮显示的报错指出：

• Invalid read of size 1

• Mismatched free() / delete / delete []

5、在memcpy和相关函数中重叠src和dst指针

类似memcpy使用中重叠内存而出错的问题，不光是刚刚接触c/c++的程序员会犯，许多工作多年的高手也会犯同样问题。有时候是对库函数的定义和限制不清楚，有时候就是疏忽了。而这种问题特别难发现。valgrind的报告可以帮助我们找到问题：

int main(void) {
    char *buf = (char *)calloc(, sizeof(char));

    for (int i = ; i < ; ++i)
        buf[i] = static_cast<char>('a' + i);

    printf("%s", buf);

    char *dest = buf+;
    memcpy(dest, buf, 6);
    printf("%s", dest);

    free(buf);
}

$ valgrind --tool=memcheck ./heapoverflow
==== Memcheck, a memory error detector
==== Copyright (C) -, and GNU GPL'd, by Julian Seward et al.
==== Using Valgrind-3.10. and LibVEX; rerun with -h for copyright info
==== Command: ./heapoverflow
====
==103964== Source and destination overlap in memcpy(0x5a13043, 0x5a13040, 6)
==103964== at 0x4C2E1DC: memcpy@@GLIBC_2.14 (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==103964== by 0x400AF0: main (tryvarargs.cpp:72)
====
abcdefghijabcdefj====
==== HEAP SUMMARY:
==== in use at exit:  bytes in  blocks
==== total heap usage:  allocs,  frees,  bytes allocated
====
==== All heap blocks were freed -- no leaks are possible
====
==== For counts of detected and suppressed errors, rerun with: -v
==== ERROR SUMMARY:  errors from  contexts (suppressed:  from )

参考文献

[1] http://cs.ecs.baylor.edu/~donahoo/tools/valgrind/

[2] http://pages.cs.wisc.edu/~bart/537/valgrind.html

[3] https://www.thegeekstuff.com/2011/11/valgrind-memcheck/

[4] http://valgrind.org/docs/manual/manual.html