c-释放1000个字节的双倍空闲错误

Question

我写了一个小程序来测试内存内的分配+访问时间：

#include <stdio.h>
#include <stdlib.h>
int main (int argc, char *argv[])
{
    if (argc < 2)
    {
        printf("fail, %d argsn", argc);
        return 1;
    }
    char *a;
    int i;
    long long int stress_size = atoi(argv[1]);
    a = malloc(stress_size);
    printf("%Ld bytes allocatedn", stress_size);
    printf("a is here:     %pn", a);
    for (i = 0; i < stress_size; ++i)
    {
        a++;
        *a = 4;
    }
    printf("a is here now: %pn", a);
    a -= stress_size / sizeof(char);
    printf("back to original positionn");
    printf("a is here now: %pn", a);
    printf("pre-freen");
    free(a);
    printf("free okn");
    return 0;
} 

该程序即使适用于高值（400M字节），但在精确的字节数为1000时也会失败。

$ ./main 1000
1000 bytes allocated
a is here:     0x1c81010
a is here now: 0x1c813f8
back to original position
a is here now: 0x1c81010
pre-free
*** glibc detected *** ./main: double free or corruption (!prev): 0x0000000001c81010 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x76d76)[0x7f9133438d76]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f913343daac]
./main[0x4008cf]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7f91333e0ead]
./main[0x4006e9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:03 928478                             /home/alex/programmazione/c/memory_long_stress_test/main
00600000-00601000 rw-p 00000000 08:03 928478                             /home/alex/programmazione/c/memory_long_stress_test/main
01c81000-01ca2000 rw-p 00000000 00:00 0                                  [heap]
7f912c000000-7f912c021000 rw-p 00000000 00:00 0 
7f912c021000-7f9130000000 ---p 00000000 00:00 0 
7f91331ac000-7f91331c1000 r-xp 00000000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91331c1000-7f91333c1000 ---p 00015000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91333c1000-7f91333c2000 rw-p 00015000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91333c2000-7f9133542000 r-xp 00000000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133542000-7f9133742000 ---p 00180000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133742000-7f9133746000 r--p 00180000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133746000-7f9133747000 rw-p 00184000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133747000-7f913374c000 rw-p 00000000 00:00 0 
7f913374c000-7f91337b3000 r-xp 00000000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91337b3000-7f91339b3000 ---p 00067000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91339b3000-7f91339bb000 rw-p 00067000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91339bb000-7f9133a3c000 r-xp 00000000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133a3c000-7f9133c3b000 ---p 00081000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3b000-7f9133c3c000 r--p 00080000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3c000-7f9133c3d000 rw-p 00081000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3d000-7f9133c5d000 r-xp 00000000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e37000-7f9133e3a000 rw-p 00000000 00:00 0 
7f9133e59000-7f9133e5c000 rw-p 00000000 00:00 0 
7f9133e5c000-7f9133e5d000 r--p 0001f000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e5d000-7f9133e5e000 rw-p 00020000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e5e000-7f9133e5f000 rw-p 00000000 00:00 0 
7fff41490000-7fff414b1000 rw-p 00000000 00:00 0                          [stack]
7fff41511000-7fff41512000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

继续尝试，我发现同样的问题也会影响以下值：200、600、1000、1400。。。一般为400n+200。我真的不明白为什么会这样。

我在Linux 3.2.0-4-amd64#1 SMP Debian 3.2.46-1 x86_64 GNU/Linux下使用gcc（Debian 4.7.2-5）4.7.2编译了这篇文章。

Answer 1

您正在编写一个超过您所拥有位置的位置。（参见@Oli Charlesworth评论）

for (i = 0; i < stress_size; ++i)
{
    a++;  
    *a = 4;  // Bad: Setting array a_original[1] to a_original[stress_size].
}

更改为：

for (i = 0; i < stress_size; ++i)
{
    *a = 4;  // Setting array a_original[0] to a_original[stress_size-1].
    a++;  
}

BTW：您想要更低的l吗：printf("%Ld bytes allocatedn"...