理解“损坏的大小与prev_size”glibc错误
理解“损坏的大小与prev_size”glibc错误
提问于 2018-04-03 19:11:19
我已经实现了到FDK-AAC的JNA桥。源代码可以在here中找到
当对我的代码进行基准测试时，我可以在相同的输入上成功运行数百次，然后偶尔会发生C级崩溃，这将杀死整个进程，导致生成核心转储：
查看核心转储，它看起来如下所示：
#1 0x00007f3e92e00f5d in __GI_abort () at abort.c:90
#2 0x00007f3e92e4928d in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f3e92f70528 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:181
#3 0x00007f3e92e5064a in malloc_printerr (action=<optimized out>, str=0x7f3e92f6cdee "corrupted size vs. prev_size", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5426
#4 0x00007f3e92e5304a in _int_free (av=0x7f3de0000020, p=<optimized out>, have_lock=0) at malloc.c:4337
#5 0x00007f3e92e5744e in __GI___libc_free (mem=<optimized out>) at malloc.c:3145
#6 0x00007f3e113921e9 in FDKfree (ptr=0x7f3de009df60) at libSYS/src/genericStds.cpp:233
#7 0x00007f3e1130d7d3 in Free_AacEncoder (p=0x7f3de0115740) at libAACenc/src/aacenc_lib.cpp:407
#8 0x00007f3e1130fbb3 in aacEncClose (phAacEncoder=0x7f3de0115740) at libAACenc/src/aacenc_lib.cpp:1395如果我运行repeat基准测试足够多的次数，这个反向/堆栈跟踪错误是可以重现的，尽管我很难理解导致这种错误的原因是什么？分配给指针0x7f3de009df60的内存也是在CPP/C代码中分配的，我可以保证分配的实例会被释放。基准测试当然是单线程的。
在阅读这些内容之后：
security checks && internal functions
我仍然很难理解--什么可能是真正的(非利用，而是错误)场景，导致我得到上面的错误？为什么这种情况很少发生呢？
当前怀疑
运行详细的回溯，我得到以下输入：
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
set = {__val = {4, 6378670679680, 645636045657660056, 90523359816, 139904561311072, 292199584, 139903730612120, 139903730611784, 139904561311088, 1460617926600, 47573685816, 4119199860131166208,
139904593745464, 139904553224483, 139904561311136, 288245657}}
pid = <optimized out>
tid = <optimized out>
#1 0x00007f3e92e00f5d in __GI_abort () at abort.c:90
save_stage = 2
act = {__sigaction_handler = {sa_handler = 0x7f3de026db10, sa_sigaction = 0x7f3de026db10}, sa_mask = {__val = {139903730540556, 19, 30064771092, 812522497172832284, 139903728706672, 1887866374039011357,
139900298780168, 3775732748407067896, 763430436865, 35180077121538, 4119199860131166208, 139904561311552, 139904553065676, 1, 139904561311584, 139904561312192}}, sa_flags = 4096,
sa_restorer = 0x14}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007f3e92e4928d in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f3e92f70528 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:181
ap = {{gp_offset = 40, fp_offset = 32574, overflow_arg_area = 0x7f3e11adf1d0, reg_save_area = 0x7f3e11adf160}}
fd = <optimized out>
list = <optimized out>
nlist = <optimized out>
cp = <optimized out>
written = <optimized out>
#3 0x00007f3e92e5064a in malloc_printerr (action=<optimized out>, str=0x7f3e92f6cdee "corrupted size vs. prev_size", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5426
buf = "00007f3de009e9f0"
cp = <optimized out>
ar_ptr = <optimized out>
ptr = <optimized out>
str = 0x7f3e92f6cdee "corrupted size vs. prev_size"
action = <optimized out>
#4 0x00007f3e92e5304a in _int_free (av=0x7f3de0000020, p=<optimized out>, have_lock=0) at malloc.c:4337
size = 2720
fb = <optimized out>
nextchunk = 0x7f3de009e9f0
nextsize = 736
nextinuse = <optimized out>
prevsize = <optimized out>
bck = <optimized out>
fwd = <optimized out>
errstr = 0x0
locked = <optimized out>
#5 0x00007f3e92e5744e in __GI___libc_free (mem=<optimized out>) at malloc.c:3145
ar_ptr = <optimized out>
p = <optimized out>
hook = <optimized out>
#6 0x00007f3e113921e9 in FDKfree (ptr=0x7f3de009df60) at libSYS/src/genericStds.cpp:233
No locals.
#7 0x00007f3e1130d7d3 in Free_AacEncoder (p=0x7f3de0115740) at libAACenc/src/aacenc_lib.cpp:407
No locals.
#8 0x00007f3e1130fbb3 in aacEncClose (phAacEncoder=0x7f3de0115740) at libAACenc/src/aacenc_lib.cpp:1395
hAacEncoder = 0x7f3de009df60
err = AACENC_OK在frame address #6中，你可以看到问题中的指针是0x7f3de009df60.
- In frame #4，你可以看到大小是2720，这确实是结构的预期大小，the
- of
nextchunkis0x7f3de009e9f0，它只比当前正在释放的指针晚2704个字节，我可以确认，当出现错误reproduces.
- Could时，情况总是如此，这强烈地表明了我所面临的错误??
，，
回答 1
Stack Overflow用户
回答已采纳
发布于 2018-04-05 05:25:40
好了，我已经设法克服了这个问题。
首先-“损坏的大小与prev_size”的实际原因非常简单-由于代码的越界访问，相邻的后续块中的内存块控制结构字段正在被覆盖。如果您为指针p分配了x字节，但最终对同一指针进行了超出x的写入，则可能会收到此错误，指示当前内存分配(块)大小与下一个块控制结构中的大小不同(由于它被覆盖)。
至于内存泄漏的原因，在Java/JNA层中完成的结构映射意味着与#pragma相关的填充/对齐与编译dll/so时使用的不同。这反过来会导致数据被写入所分配的结构边界之外。禁用该对齐可使问题消失。(数千次执行，没有一次崩溃！)
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/49628615
复制相关文章
相似问题