关于malloc的bug记录

最新推荐文章于 2025-07-08 09:18:47 发布

原创最新推荐文章于 2025-07-08 09:18:47 发布 · 487 阅读

0 ·

CC 4.0 BY-SA版权

C bug 记录专栏收录该内容

1 篇文章

订阅专栏

这篇博客记录了一段代码中由于malloc使用不当引发的错误，表现为free()时出现"invalid next size (fast)"的问题。程序员通过调试发现并解决了这个问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

以下是出错的代码：

#include <stdio.h>
#include <stdlib.h>

#define TRUE 1
#define FALSE 0
#define ERR 0
#define OK 1
#define INIT_SIZE 10
#define INCREMENT_SIZE 5

typedef struct
{
	int *elem;
	int length;
	int size;
}SqList;

int InitList(SqList *L)
{
	L->elem = (int *)malloc(sizeof(int) * INIT_SIZE);
	if(!L->elem)
	{
		return ERR;
	}
	L->length = 0;
	L->size = INIT_SIZE;
	return OK;
}

int DestoryList(SqList *L)
{
	free(L->elem);
	L->length = 0 ;
	L->size = 0;
	return OK;
}

int ClearList(SqList *L)
{
	L->length = 0;
	return OK;
}

const int IsEmpty(SqList *L)
{
	if(L->length == 0)
	{
		return TRUE;
	}
	else
	{
		return FALSE;
	}
}

const int GetLength(SqList *L)
{
	return L->length;
}

const int GetElem(SqList *L, int i)
{
	if(i <= 0 || i > L->length)
	{
		return ERR;
	}
	return L->elem[i-1];
}

const int compare(int a, int b)
{
	if(a == b)
		return 0;
	else if(a < b)
		return -1;
	else
		return 1;
}

const int FindElem(SqList *L, int e, int (*compare)(int a, int b))
{
	int i;
	for(i = 0; i < L->length; i++)
	{
		if(!compare(L->elem[i], e))
		{
			return i + 1;
		}
	}
	return FALSE;
}

const int FindPreElem(SqList *L, int e)
{
	int i;
	for(i = 0; i < L->length; i++)
	{
		if(!compare(L->elem[i], e))
		{
			if(i != 0)
			{
				return L->elem[i-1];
			}
			else
			{
				return ERR;
			}
		}
	}
	return ERR;
}

const int FindNextElem(SqList *L, int e)
{
	int i;
	for(i = 0; i < L->length; i++)
	{
		if(!compare(L->elem[i], e))
		{
			if(i != L->length -1)
			{
				return L->elem[i+1];
			}
			else
			{
				return ERR;
			}
		}
	}
	return ERR;
}

int InsertElem(SqList *L, int i, int e)
{
	int *new;
	if(i <= 0 || i > L->length+1)
	{
		return ERR;
	}
	if(L->length+1 >= L->size)
	{
		new = (int *)realloc(L->elem, L->size+INCREMENT_SIZE*sizeof(int));
		if(!new)
		{
			return ERR;
		}
		L->elem = new;
		L->size += INCREMENT_SIZE;
	}
	int *p = &L->elem[i-1];
	int *q = &L->elem[L->length-1];
	for(; q >= p; q--)
	{
		*(q+1) = *q;
	}
	*p = e;
	L->length++;
	return OK;
}

int DeleteElem(SqList *L, int i)
{
	if(i <= 0 || i > L->length)
	{
		return ERR;
	}
	int *p = &L->elem[i];
	int e = L->elem[i -1];
	for(; p <= &L->elem[L->length-1]; p++)
	{
		*(p - 1) = *p;
	}
	L->length--;
	return e;
}

void VisitElem(int e)
{
	printf("%d\n", e);
}

const int TraverseList(SqList *L)
{
	int i;
	for(i = 0; i < L->length; i++)
	{
		printf("%d ",L->elem[i]);
	}
	printf("\n");
	return OK;
}

int main()
{
	printf("------The process run------\n");
	SqList L;
	if(InitList(&L))
	{
		int i;
		for(i = 0; i < 10; i++)
		{
			if(!InsertElem(&L,i+1,i))
			{
				printf("insert false!\n	");
			}
		}
		printf("the length is %d\n", GetLength(&L));
		TraverseList(&L);
		printf("insert 5 in 3!\n");
		InsertElem(&L, 3, 5);
		TraverseList(&L);
		printf("delete elem in 3!\n");
		DeleteElem(&L, 3);
		TraverseList(&L);
		int elem3 = GetElem(&L, 3);
		printf("the 3 elem is %d\n", elem3);
		int pre = FindPreElem(&L, 5);
		printf("the 5 pre is %d\n", pre);
		int next =FindNextElem(&L, 5);
		printf("the 5 next is %d\n", next);
		if(DestoryList(&L))
		{
			printf("destory ok\n");
		}
	}
	return TRUE;
}

以下是运行程序后的报错内容：

------The process run------
the length is 10
0 1 2 3 4 5 6 7 8 9
insert 5 in 3!
0 1 5 2 3 4 5 6 7 8 9
delete elem in 3!
0 1 2 3 4 5 6 7 8 9
the 3 elem is 2
the 5 pre is 4
the 5 next is 6

*** glibc detected *** ./linear: free(): invalid next size (fast): 0x00000000006f1010 ***

linear: malloc.c:2451: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.

Aborted (core dumped)

解决方法：

将初始化函数中的L->elem = (int *)malloc(sizeof(int) * INIT_SIZE);改为

L->elem = (int *)malloc(sizeof(int) * INIT_SIZE+1);就可以了，就是说在分配空间时多分配一个空间。