Valgrind检查内存泄露简介

==14378== Rerun with --leak-check=full to see details of leaked memory ==14378==

==14378== For counts of detected and suppressed errors, rerun with: -v ==14378== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 2 from 2)

看来ls这个命令是没有任何内存问题的。。。这里的“14378”指的是执行ls -l的进程ID，这有利于区别不同进程的报告。memcheck会给出报告，分配置和释放了多少内存，有多少内存泄漏了，还有多少内存的访问是可达的，检查了多少字节的内存。

好了，我们自己写一段吧：

#include void bug ( ) { }

int a[100], * b, * c; b

=

new int[100];

0; 0;

// memset(a, 0, 2000);

a[100] = b[100] = *c =

0;

/* ----- end of function bug ----- */ int main ( int argc, char *argv[] ) { }

bug(); return 0;

/* ---------- end of function main ---------- */

这段代码囊括了经常遇到的内存问题：泄漏、野指针和越界访问。那么用valgrind测试的结果如何呢？（编译时请加上-ggdb -O0，以便valgrind能够定位到具体出问题的位置）

==14525== Memcheck, a memory error detector

==14525== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al. ==14525== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info ==14525== Command: ./membug ==14525==

==14525== Invalid write of size 4

==14525== at 0x40064E: bug() (membug.cpp:14) ==14525== by 0x400673: main (membug.cpp:25)

==14525== Address 0x59601d0 is 0 bytes after a block of size 400 alloc'd ==14525== at 0x4C28112: operator new[](unsigned long) (vg_replace_malloc.c:348) ==14525== by 0x400638: bug() (membug.cpp:11) ==14525== by 0x400673: main (membug.cpp:25) ==14525==

==14525== Use of uninitialised value of size 8 ==14525== at 0x400658: bug() (membug.cpp:15)

==14525== by 0x400673: main (membug.cpp:25) ==14525==

==14525== Invalid write of size 4

==14525== at 0x400658: bug() (membug.cpp:15) ==14525== by 0x400673: main (membug.cpp:25)

==14525== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==14525== ==14525==

==14525== Process terminating with default action of signal 11 (SIGSEGV) ==14525== Access not within mapped region at address 0x0 ==14525== at 0x400658: bug() (membug.cpp:15) ==14525== by 0x400673: main (membug.cpp:25)

==14525== If you believe this happened as a result of a stack ==14525== overflow in your program's main thread (unlikely but ==14525== possible), you can try to increase the size of the ==14525== main thread stack using the --main-stacksize= flag. ==14525== The main thread stack size used in this run was 8388608. ==14525==

==14525== HEAP SUMMARY:

==14525== in use at exit: 400 bytes in 1 blocks

==14525== total heap usage: 1 allocs, 0 frees, 400 bytes allocated ==14525==

==14525== 400 bytes in 1 blocks are still reachable in loss record 1 of 1 ==14525== at 0x4C28112: operator new[](unsigned long) (vg_replace_malloc.c:348) ==14525== by 0x400638: bug() (membug.cpp:11) ==14525== by 0x400673: main (membug.cpp:25) ==14525==

==14525== LEAK SUMMARY:

==14525== definitely lost: 0 bytes in 0 blocks ==14525== indirectly lost: 0 bytes in 0 blocks ==14525== possibly lost: 0 bytes in 0 blocks ==14525== still reachable: 400 bytes in 1 blocks ==14525== suppressed: 0 bytes in 0 blocks ==14525==

==14525== For counts of detected and suppressed errors, rerun with: -v ==14525== Use --track-origins=yes to see where uninitialised values come from ==14525== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 2 from 2) Segmentation fault

可以看出valgrind定位出了第11行的内存泄漏，第14行的越界访问，第15行的野指针访问，但对13行的数组越界无动于衷。实际运行可以发现，对数组a的也并未引起程序异常，这是为什么呢？原因是因为数组a是在栈中分配的空间，对a[100]的写入并未引起程序栈出现异常，可以说仅在这个时候没引起异常。为了加大栈溢出访问的影响，可以改成

memset(a, 0, 2000)，运行后发现valgrind会发现问题，可是由于栈数据丢失，已经不能分析出有问题的地方了。

Valgrind支持x86平台32和64位，支持arm32和64位，但是不支持mips，最近做的项目都是mips的，可惜暂时不能派上大用场了。

续：valgrind的mips补丁，有空可以试一下：https://bugs.kde.org/show_bug.cgi?id=270777 转自：

http://hi.http://www.china-audit.com//wind_stay/item/6cf1aa1477106d061994ec11 http://blog.csdn.net/coroutines/article/details/7783155