C语言 为什么会出现双自由度?

Question

我一直在尝试写一个拼写检查程序，它需要一个字典和一个文本文件来尽可能快地找到拼错的单词。但是，我得到一个错误消息，指出在运行程序时发生了双重释放。我想知道为什么会这样。

错误信息:

~/pset5/speller/ $ ./speller texts/constitution.txt
MISSPELLED WORDS
USConstitution
http
usconstitution
const
html
double free or corruption (fasttop)
Aborted

拼写(CS50):

// Implements a spell-checker by CS50
#include <ctype.h>
#include <stdio.h>
#include <sys/resource.h>
#include <sys/time.h>
#include "dictionary.h"
// Undefine any definitions
#undef calculate
#undef getrusage
// Default dictionary
#define DICTIONARY "dictionaries/large"
// Prototype
double calculate(const struct rusage *b, const struct rusage *a);
int main(int argc, char *argv[])
{
// Check for correct number of args
if (argc != 2 && argc != 3)
{
printf("Usage: ./speller [DICTIONARY] textn");
return 1;
}
// Structures for timing data
struct rusage before, after;
// Benchmarks
double time_load = 0.0, time_check = 0.0, time_size = 0.0, time_unload = 0.0;
// Determine dictionary to use
char *dictionary = (argc == 3) ? argv[1] : DICTIONARY;
// Load dictionary
getrusage(RUSAGE_SELF, &before);
bool loaded = load(dictionary);
getrusage(RUSAGE_SELF, &after);
// Exit if dictionary not loaded
if (!loaded)
{
printf("Could not load %s.n", dictionary);
return 1;
}

// Calculate time to load dictionary
time_load = calculate(&before, &after);
// Try to open text
char *text = (argc == 3) ? argv[2] : argv[1];
FILE *file = fopen(text, "r");
if (file == NULL)
{
printf("Could not open %s.n", text);
unload();
return 1;
}
// Prepare to report misspellings
printf("nMISSPELLED WORDSnn");
// Prepare to spell-check
int index = 0, misspellings = 0, words = 0;
char word[LENGTH + 1];
// Spell-check each word in text
char c;
while (fread(&c, sizeof(char), 1, file))
{
// Allow only alphabetical characters and apostrophes
if (isalpha(c) || (c == ''' && index > 0))
{
// Append character to word
word[index] = c;
index++;
// Ignore alphabetical strings too long to be words
if (index > LENGTH)
{
// Consume remainder of alphabetical string
while (fread(&c, sizeof(char), 1, file) && isalpha(c));
// Prepare for new word
index = 0;
}
}
// Ignore words with numbers (like MS Word can)
else if (isdigit(c))
{
// Consume remainder of alphanumeric string
while (fread(&c, sizeof(char), 1, file) && isalnum(c));
// Prepare for new word
index = 0;
}
// We must have found a whole word
else if (index > 0)
{
// Terminate current word
word[index] = '';
// Update counter
words++;
// Check word's spelling
getrusage(RUSAGE_SELF, &before);
bool misspelled = !check(word);
getrusage(RUSAGE_SELF, &after);
// Update benchmark
time_check += calculate(&before, &after);
// Print word if misspelled
if (misspelled)
{
printf("%sn", word);
misspellings++;
}
// Prepare for next word
index = 0;
}
}
// Check whether there was an error
if (ferror(file))
{
fclose(file);
printf("Error reading %s.n", text);
unload();
return 1;
}
// Close text
fclose(file);
// Determine dictionary's size
getrusage(RUSAGE_SELF, &before);
unsigned int n = size();
getrusage(RUSAGE_SELF, &after);
// Calculate time to determine dictionary's size
time_size = calculate(&before, &after);
// Unload dictionary
getrusage(RUSAGE_SELF, &before);
bool unloaded = unload();
getrusage(RUSAGE_SELF, &after);
// Abort if dictionary not unloaded
if (!unloaded)
{
printf("Could not unload %s.n", dictionary);
return 1;
}
// Calculate time to unload dictionary
time_unload = calculate(&before, &after);
// Report benchmarks
printf("nWORDS MISSPELLED:     %dn", misspellings);
printf("WORDS IN DICTIONARY:  %dn", n);
printf("WORDS IN TEXT:        %dn", words);
printf("TIME IN load:         %.2fn", time_load);
printf("TIME IN check:        %.2fn", time_check);
printf("TIME IN size:         %.2fn", time_size);
printf("TIME IN unload:       %.2fn", time_unload);
printf("TIME IN TOTAL:        %.2fnn",
time_load + time_check + time_size + time_unload);
// Success
return 0;
}
// Returns number of seconds between b and a
double calculate(const struct rusage *b, const struct rusage *a)
{
if (b == NULL || a == NULL)
{
return 0.0;
}
else
{
return ((((a->ru_utime.tv_sec * 1000000 + a->ru_utime.tv_usec) -
(b->ru_utime.tv_sec * 1000000 + b->ru_utime.tv_usec)) +
((a->ru_stime.tv_sec * 1000000 + a->ru_stime.tv_usec) -
(b->ru_stime.tv_sec * 1000000 + b->ru_stime.tv_usec)))
/ 1000000.0);
}
}

字典操作和检查(由我):

// Implements a dictionary's functionality
#include <stdbool.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include "dictionary.h"
// Represents a node in a hash table
typedef struct node
{
char word[LENGTH + 1];
struct node *next;
}
node;
// Number of buckets in hash table
const unsigned long long int N = 50;
// Hash table
node *table[N];
// Returns true if word is in dictionary, else false
bool check(const char *word)
{
char temp_w[LENGTH];
unsigned int key = hash(word);
for(node *temp = table[key]; temp != NULL; temp = temp->next)
{
for(int i = 0; i < LENGTH; i++)
{
temp_w[i] = tolower(word[i]);
}
if(strcmp(temp->word, temp_w) == 0)
{
return true;
}
}
return false;
}
// Hashes word to a number
unsigned int hash(const char *word)         //Hashed using djb2
{
unsigned long hash = 5381;
int c = *word;
c = tolower(c);
while (*word != 0)
{
hash = ((hash << 5) + hash) + c;
c = *word++;
c = tolower(c);
}
return hash % N;
}
// Loads dictionary into memory, returning true if successful, else false
bool load(const char *dictionary)
{
char str[LENGTH];
char counter[1] = "0";
FILE *dict = fopen(dictionary,"r");
node *temp = NULL;
if(dict == NULL)
{
//printf("Error: n", strerror(errno));
return false;
}
for(int i = 0; i < N; i++)
{
table[i] = NULL;
}
while(fscanf(dict, "%s", str) == 1)
{
unsigned int key = hash(str);
//int key = rand();
temp = malloc(sizeof(node));
if(temp == NULL)
{
return false;
}
if(table[key] == NULL)
{
table[key] = malloc(sizeof(node));
table[key]->next = NULL;
strcpy(table[key]->word, str);

}
else //if(table[key]->next != NULL)
{
temp->next = table[key];
strcpy(temp->word, str);
table[key] = temp;
}
}
fclose(dict);
return true;
}
// Returns number of words in dictionary if loaded, else 0 if not yet loaded
unsigned int size(void)
{
long long int words = 0;
for(int i = 0; i < N; i++)
{
/*if(strcmp(table[i]->word, "0") != 0 && table[i]->next == NULL)
{
words++;
continue;
}
else*/
if(table[i] != NULL)
{
for(node *temp = table[i]; temp != NULL; temp = temp -> next)
{
words++;
}
}
}
return words;
}
// Unloads dictionary from memory, returning true if successful, else false
bool unload(void)
{
node *temp1 = NULL;
node *temp2 = NULL;
for(int i = 0; i < N; i++)
{
temp1 = table[i];
while(temp1 != NULL)
{
if(temp1->next != NULL)
{
temp2 = temp1 -> next;
free(temp1);
temp1 = temp2;
}
else free(temp1);
}
free(temp2);
free(table[i]);
}
return true;
}

dictionary.h:

// Declares a dictionary's functionality
#ifndef DICTIONARY_H
#define DICTIONARY_H
#include <stdbool.h>
// Maximum length for a word
// (e.g., pneumonoultramicroscopicsilicovolcanoconiosis)
#define LENGTH 45
// Prototypes
bool check(const char *word);
unsigned int hash(const char *word);
bool load(const char *dictionary);
unsigned int size(void);
bool unload(void);
#endif // DICTIONARY_H

Answer 1

代码中出现了一些问题。在纸上跟踪指针(reco)通过dratenik)导致去除:

free(temp2);

主要问题在于释放指针不会自动将其设置为NULL。这将导致释放不应该被访问的内存。通过替换:

else free(temp1);

:

else 
{
free(temp1);
free(table[i]);
temp1 = NULL;
}