C语言 为什么瓦尔格林德抱怨这个代码?

Question

>我正在尝试实现一个存储非负整数的链表。我的实现如下所示：

我对内存泄漏感到好奇，所以我尝试了这个名为 Valgrind 的工具，命令是"valgrind --leak-check=yes"。

==2540== error calling PR_SET_PTRACER, vgdb might block
==2540== Invalid write of size 4
==2540==    at 0x10875E: node_create (in LinkedList/bin/main)
==2540==    by 0x108832: list_append (in LinkedList/bin/main)
==2540==    by 0x108920: main (in LinkedList/bin/main)
==2540==  Address 0x522d098 is 0 bytes after a block of size 8 alloc'd
==2540==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2540==    by 0x10874B: node_create (in LinkedList/bin/main)
==2540==    by 0x108832: list_append (in LinkedList/bin/main)
==2540==    by 0x108920: main (in LinkedList/bin/main)
.
.
.
==2540== Invalid read of size 4
==2540==    at 0x1088BA: list_pop (in LinkedList/bin/main)
==2540==    by 0x1089E1: main (in LinkedList/bin/main)
==2540==  Address 0x522d138 is 0 bytes after a block of size 8 alloc'd
==2540==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2540==    by 0x10874B: node_create (in LinkedList/bin/main)
==2540==    by 0x108832: list_append (in LinkedList/bin/main)
==2540==    by 0x108942: main (in LinkedList/bin/main)
.
.
.
==2540== HEAP SUMMARY:
==2540==     in use at exit: 0 bytes in 0 blocks
==2540==   total heap usage: 10 allocs, 10 frees, 584 bytes allocated
==2540==
==2540== All heap blocks were freed -- no leaks are possible

相应的函数实现如下：

struct Node {
struct Node* next;
int value;
};
struct List {
struct Node* head;
};
typedef struct Node* Node;
typedef struct List* List;
Node node_create(int value, Node nextNode) {
if(value < 0) {
printf("Error: Could not create node, value is negative.n");
return NULL;
}
Node node = malloc(sizeof(Node));
if(node != NULL)
{
node->value = value;
node->next = nextNode;
} else {
printf("Error: Could not create node, malloc returned NULL.n");
}
return node;
}
int list_append(List listHandle, int value) {
Node current = listHandle->head;
Node new = node_create(value, NULL);
if(new == NULL) {
return -1;
}
if(current == NULL) {
listHandle->head = new;
} else {
while(current->next != NULL) {
current = current->next;
}
current->next = new;
}
return value;
}
int list_pop(List listHandle) {
if(listHandle->head == NULL) {
printf("Error: Trying to pop an empty list.n");
return -1;
}
Node temp = listHandle->head;
int value = temp->value;
if(temp->next == NULL)
{
listHandle->head = NULL;
} else {
listHandle->head = temp->next;
}
free(temp);
return value;
}

我做错了什么？如何改进代码？这甚至是一个问题，还是瓦尔格林德只是过于迂腐？

Answer 1

typedef struct Node* Node;
Node node = malloc(sizeof(Node));

这将分配sizeof(Node)==sizeof(struct Node*)字节的内存。因此，Node node指向不sizeof(struct Node)字节的内存。您最终将获得越界/无效的内存访问。

若要修复代码，请取消引用指向结构节点的指针，或隐式使用大小为：

Node node = malloc(sizeof(*node));
Node node = malloc(sizeof(struct Node));

这只是一个修复程序。它使您的代码更加混乱，并且您刚刚发现为什么在typedef后面隐藏指针是一个坏主意。该行：

Node node = malloc(sizeof(*Node));

将不起作用，因为Node命名一个类型，不能被取消围栏，正如@Ctx在评论中指出的那样。

就个人而言，我强烈建议重写所有代码以使用：

typedef struct Node Node;
Node *node_create(int value, Node *nextNode)  {
...
Node *node = malloc(sizeof(Node));
...
}

现在，任何程序员立即查看函数node_create都会知道，它返回指向某些数据的指针，可能是动态分配的。是更具可读性，并且不会隐藏指针分配。

Answer 2

Node node = malloc(sizeof(Node));

Node实际上是struct Node *- 一个指针。繁荣！您只是为单个指针分配了内存，而不是结构，后者至少需要多sizeof(int)字节。这就是为什么你不typedef指针。