请解释C中的*char malloc/realloc/free行为

Question

在C中使用链表时，我注意到这种我不理解的行为。下面的示例代码说明了声明一个简单列表并填充包含*char名称的节点的情况。theName字符串由_附加命令行中给出的每个参数生成，因此charNum比argv[i]大2以容纳_和。每个argv元素生成一个节点，该节点被添加到main函数的for循环中的列表中。

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
struct node {
  char* name;
  struct node* next;
};
struct node*
nalloc(char* name)
{
  struct node* n = (struct node*) malloc(sizeof(struct node));
  if (n)
  {
    n->name = name;
    n->next = NULL;
  }
  return n;
}
struct node*
nadd(struct node* head, char* name)
{
  struct node* new = nalloc(name);
  if (new == NULL) return head;
  new->next = head;
  return new;
}
void
nprint(struct node* head)
{
  struct node* n = NULL;
  printf("List start: n");
  for(n = head; n; n=n->next)
  {
    printf("  Node name: %s, next node: %pn", n->name, n->next);
  }
  printf("List end. n");
}
void
nfree(struct node* head)
{
  struct node* n = NULL;
  printf("Freeing up the list: n");
  while (head)
  {
    n = head;
    printf("  Freeing: %sn", head->name);
    head = head->next;
    free(n);
  }
  printf("Done.n");
}
int
main(int argc, char** argv)
{
  struct node* list = NULL;
  char* theName = (char*) malloc(0);
  int i, charNum;
  for (i=0; i < argc; i++)
  {
    charNum = strlen(argv[i]) + 2;
    theName = (char*) realloc(NULL, sizeof (char)*charNum);
    snprintf(theName, charNum, "%s_", argv[i]);
    list = nadd(list, theName);
  }
  nprint(list);
  nfree(list);
  free(theName);
  return 0;
}

上面的代码像人们期望的那样工作:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x1dae0d0
  Node name: two_, next node: 0x1dae090
  Node name: one_, next node: 0x1dae050
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: three_
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

但是，当我修改此代码并在打印列表之前调用free(theName)时:

  ...
  free(theName);
  nprint(list);
  nfree(list);
  return 0;
  ...

缺少最后一个列表项的名称:

$  ./a.out one two three
List start: 
  Node name: , next node: 0x3f270d0
  Node name: two_, next node: 0x3f27090
  Node name: one_, next node: 0x3f27050
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

所以释放theName指针影响了使用它作为其名称的列表节点，但为什么早期的realloc不影响其他节点?如果free(theName)打破了最后一个节点的名称，我猜realloc会做同样的事情，列表中的所有节点都将具有空白名称。

---

感谢大家的评论和回答。我修改了代码以删除malloc结果的强制转换，添加了node->name的释放，并将名称的"malloc -> multiple reallos -> free"更改为"multiple malloc -> free"。下面是新代码:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
struct node {
  char* name;
  struct node* next;
};
struct node*
nalloc(char* name)
{
  struct node* n = malloc(sizeof(struct node));
  if (n)
  {
    n->name = name;
    n->next = NULL;
  }
  return n;
}
struct node*
nadd(struct node* head, char* name)
{
  struct node* new = nalloc(name);
  if (new == NULL) return head;
  new->next = head;
  return new;
}
void
nprint(struct node* head)
{
  struct node* n = NULL;
  printf("List start: n");
  for(n = head; n; n=n->next)
  {
    printf("  Node name: %s, next node: %pn", n->name, n->next);
  }
  printf("List end. n");
}
void
nfree(struct node* head)
{
  struct node* n = NULL;
  printf("Freeing up the list: n");
  while (head)
  {
    n = head;
    printf("  Freeing: %sn", head->name);
    head = head->next;
    free(n->name);
    free(n);
  }
  printf("Done.n");
}
int
main(int argc, char** argv)
{
  struct node* list = NULL;
  char* theName;
  int i, charNum;
  for (i=0; i < argc; i++)
  {
    charNum = strlen(argv[i]) + 2;
    theName = malloc(sizeof (char)*charNum);
    snprintf(theName, charNum, "%s_", argv[i]);
    list = nadd(list, theName);
  }
  nprint(list);
  nfree(list);
  free(theName);
  return 0;
}

以上工作如预期:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x1826c0b0
  Node name: two_, next node: 0x1826c070
  Node name: one_, next node: 0x1826c030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: three_
  Freeing: two_
  Freeing: one_
  Freeing: ./a.out_
Done.

然而，当我把free(theName);放在nprint(list);之前:

  free(theName);
  nprint(list);
  nfree(list);
  return 0;

在输出中缺少最后一个节点的名称，nfree(list);抛出错误:

$  ./a.out one two three
List start: 
  Node name: , next node: 0x1cf3e0b0
  Node name: two_, next node: 0x1cf3e070
  Node name: one_, next node: 0x1cf3e030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
*** glibc detected *** ./a.out: double free or corruption (fasttop): 0x000000001cf3e0d0 ***
======= Backtrace: =========
...
======= Memory map: ========
...
Aborted

当我把free(theName);放在nprint(list);之后，nfree(list);之前:

  nprint(list);
  free(theName);
  nfree(list);
  return 0;

输出中的

所有节点都正确打印，但nprint(list);仍然抛出错误:

$  ./a.out one two three
List start: 
  Node name: three_, next node: 0x19d160b0
  Node name: two_, next node: 0x19d16070
  Node name: one_, next node: 0x19d16030
  Node name: ./a.out_, next node: (nil)
List end. 
Freeing up the list: 
  Freeing: 
*** glibc detected *** ./a.out: double free or corruption (fasttop): 0x000000001cf3e0d0 ***
======= Backtrace: =========
...
======= Memory map: ========
...
Aborted

这在我脑海中提出了另一个问题:我猜在任何情况下，theName指向的内存被释放两次:第一次作为node->name，第二次作为theName，那么为什么free(theName);在nfree(list);之后在程序结束时调用时不会引发双自由错误(就像它在工作代码中一样)?

Answer 1

释放theName时，指针仍然指向最近添加到列表中的名称部分。它不指向列表中较早的项，因为指针由结构元素正确地管理，并且theName被移动到指向不同的值(最近添加的值)。这就是为什么名称是free()d.

在释放struct元素本身之前，没有正确释放每个struct元素(即name)中的变量也会泄漏内存。我个人建议使用valgrind (linux)或this (windows)并通过它运行程序。

Answer 2

根据我的理解，如果在打印列表之前调用free(theName)，则释放最后一个列表节点所指向的内存。此外，我有点怀疑使用realloc来分配新的内存;当打印列表时，您可能会读取包含预期数据的内存，但是已经被realloc释放了。

请注意，realloc允许移动内存块的起始地址，这意味着即使在写入realloc返回的地址时，旧的内容可能仍然存在。