\u5185\u5b58\u7684\u95ee\u9898\u662fc\/c++\u7684\u4f20\u7edf\u7684\u3001\u7ecf\u5178\u7684\u95ee\u9898\u3002\u4ece\u4e0d\u540c\u7684\u7ef4\u5ea6\u548c\u4e0d\u540c\u7684\u5c42\u6b21\u90fd\u53ef\u4ee5\u770b\u5230\u4e0d\u4e00\u6837\u7684\u60c5\u51b5\u3002\u5bf9\u4e8e\u4e00\u4e9b\u4e0d\u592a\u719f\u6089\u8c03\u8bd5\u7684\u5f00\u53d1\u8005\u6765\u8bf4，\u5806\u548c\u6808\u7684\u5d29\u6e83\u5728\u4ed6\u4eec\u773c\u4e2d\u90fd\u662f\u4e00\u6837\u7684，\u53cd\u6b63\u7ed3\u679c\u90fd\u662f\u5d29\u6e83\u7684\u3002\u4f46\u5728\u5b9e\u9645\u7684\u5e94\u7528\u4e2d，\u6709\u7ecf\u9a8c\u7684\u5f00\u53d1\u8005\u53ef\u4ee5\u8fc5\u901f\u7684\u6839\u636e\u60c5\u51b5\u5224\u522b\u662f\u5806\u8fd8\u662f\u6808\u5f15\u8d77\u7684\u8d8a\u754c\u5d29\u6e83\u3002
\n\u6b63\u5982\u524d\u9762\u53cd\u590d\u63d0\u5230\u7684，\u89e3\u51b3\u95ee\u9898\u7684\u5173\u952e\u4e0d\u662f\u4e00\u773c\u53d1\u73b0\u95ee\u9898，\u800c\u662f\u5b66\u4f1a\u9010\u6b65\u62bd\u4e1d\u5265\u8327\u7684\u80fd\u529b，\u4e00\u6b65\u6b65\u7684\u5b9a\u4f4d\u95ee\u9898\u7684\u7b56\u7565\u3002\u6709\u4e86\u89e3\u51b3\u95ee\u9898\u7684\u601d\u8def\u548c\u89e3\u51b3\u7684\u65b9\u5f0f，\u5c31\u53ef\u4ee5\u9002\u7528\u5230\u6240\u6709\u7684\u95ee\u9898\u5904\u7406\u4e0a，\u800c\u4e0d\u53ea\u662f\u5b66\u4f1a\u89e3\u51b3\u67d0\u4e2a\u95ee\u9898\u6216\u67d0\u7c7b\u95ee\u9898\u3002
\nc++\u4e2d\u5185\u5b58\u7684\u95ee\u9898\u5f80\u5f80\u6709\u4e00\u5b9a\u7684\u6ede\u540e\u6027，\u8fd9\u4e2a\u6ede\u540e\u6027\u548c\u5806\u548c\u6808\u7684\u95ee\u9898\u5f15\u8d77\u6709\u7740\u5bc6\u5207\u7684\u5173\u7cfb\u3002\u4e00\u822c\u6765\u8bf4，\u6808\u7684\u5185\u5b58\u8d8a\u754c\u5f15\u8d77\u7684\u5d29\u6e83\u5f80\u5f80\u5f88\u5bb9\u6613\u5feb\u901f\u5b9a\u4f4d；\u4f46\u5806\u5f15\u8d77\u7684\u5185\u5b58\u8d8a\u754c，\u76f8\u5bf9\u8981\u590d\u6742\u4e00\u4e9b，\u4e2a\u522b\u60c5\u51b5\u4e0b\u4f1a\u76f8\u5f53\u7684\u590d\u6742\u3002\u5982\u679c\u518d\u4f7f\u7528\u4e86\u6a21\u677f\u6216STL\u4e2d\u7684\u7ec4\u4ef6，\u6709\u53ef\u80fd\u6ee1\u5c4f\u7684\u9519\u8bef\u8ba9\u5f00\u53d1\u8005\u5f53\u573a\u5b95\u673a\u3002<\/p>\n
\u6808\u7531\u7cfb\u7edf\u7ba1\u7406\u800c\u5806\u7531\u5f00\u53d1\u8005\u81ea\u5df1\u7ba1\u7406\u3002\u65e2\u7136\u5806\u548c\u6808\u7684\u8d8a\u754c\u5bfc\u81f4\u95ee\u9898\u7684\u7ed3\u679c\u6392\u67e5\u6709\u6240\u4e0d\u540c，\u4e0b\u9762\u5c31\u5bf9\u4ed6\u4eec\u8fdb\u884c\u4e00\u4e0b\u8be6\u7ec6\u7684\u7ed3\u6bd4\u5206\u6790：<\/p>\n
\u901a\u8fc7\u4e0a\u9762\u7684\u5206\u6790，\u5176\u5b9e\u53ef\u4ee5\u53d1\u73b0，\u6808\u7531\u4e8e\u81ea\u8eab\u662f\u7cfb\u7edf\u7ba1\u7406，\u7a7a\u95f4\u6709\u9650，\u6240\u4ee5\u4e0d\u7ba1\u65f6\u8d8a\u754c\u5199\u8fd8\u662f\u8bfb，\u5176\u5f71\u54cd\u57fa\u672c\u90fd\u662f\u5c40\u90e8\u7684\u3001\u53ef\u4ee5\u8fc5\u901f\u7684\u5f15\u8d77\u5d29\u6e83\u5e76\u4e14\u5d29\u6e83\u70b9\u7684\u4f4d\u7f6e\u5f80\u5f80\u5728\u51fd\u6570\u8c03\u7528\u7684\u5f53\u524d\u4f4d\u7f6e\u6216\u8fd4\u56de\u4f4d\u7f6e；\u800c\u5806\u7531\u4e8e\u81ea\u884c\u7ba1\u7406，\u7a7a\u95f4\u8303\u56f4\u8f83\u5927，\u8c03\u7528\u5173\u7cfb\u76f8\u5bf9\u4e5f\u590d\u6742，\u6240\u4ee5\u5176\u5f71\u54cd\u8303\u56f4\u4e5f\u5927\u3001\u51fa\u73b0\u5d29\u6e83\u7684\u73b0\u8c61\u4f1a\u5ef6\u8fdf\u5e76\u4e14\u5d29\u6e83\u70b9\u5f80\u5f80\u4e0d\u662f\u5f15\u53d1\u5d29\u6e83\u7684\u4f4d\u7f6e\u3002<\/p>\n
\u8981\u60f3\u8fdb\u884c\u5d29\u6e83\u7684\u5206\u6790，\u4e00\u4e2a\u6700\u7b80\u5355\u7684\u65b9\u6cd5\u5c31\u662f\u76f4\u63a5\u4f7f\u7528gdb\u5904\u7406Core\u6587\u4ef6\u3002\u5904\u7406\u7684\u673a\u5236\u4e00\u822c\u5982\u4e0b：<\/p>\n
\u4e00\u822c\u6765\u8bf4，\u901a\u8fc7\u4e0a\u9762\u7684\u5206\u6790，\u57fa\u7840\u7684\u5d29\u6e83\u95ee\u9898\u90fd\u53ef\u4ee5\u8f83\u4e3a\u5feb\u6377\u7684\u5b9a\u4f4d\u5230\u539f\u56e0\u3002\u590d\u6742\u7684\u60c5\u51b5\u5c31\u9700\u8981\u6839\u636e\u4e2a\u4eba\u7684\u7ecf\u9a8c\u6216\u501f\u52a9\u4e00\u4e9b\u5de5\u5177\u6765\u8fdb\u884c\u5206\u6790\u4e86\u3002\u81f3\u4e8e\u66f4\u590d\u6742\u548c\u96be\u4e8e\u53d1\u73b0\u7684\u95ee\u9898，\u5c31\u9700\u8981\u8ba4\u771f\u4ed4\u7ec6\u7684\u5bf9\u7a0b\u5e8f\u53cd\u590d\u7684\u5206\u6790\u548c\u8c03\u8bd5\u4e86\u3002<\/p>\n
\u4e0b\u9762\u7ed9\u51fa\u4e00\u4e2a\u5b9e\u4f8b，\u5148\u770b\u4ee3\u7801：<\/p>\n
#include <sys\/mman.h>
\n#include <unistd.h><\/p>\n
#include <cstdint>
\n#include <cstdio>
\n#include <cstdlib>
\n#include <cstring>
\n#include <iostream>
\n#include <string_view>
\n#include <thread><\/p>\n
#if defined(__GNUC__) || defined(__clang__)
\n#define NOINLINE __attribute__((noinline))
\n#else
\n#define NOINLINE
\n#endif<\/p>\n
static volatile std::uint64_t gSink = 0;<\/p>\n
static NOINLINE void stackOob() {
\n volatile int v[8]{};
\n v[8] = 0x1234;
\n gSink = static_cast<std::uint64_t>(v[0]);
\n}<\/p>\n
static NOINLINE void heapOob() {
\n int *v = new int[8]{};
\n v[8] = 0x1234;
\n gSink = static_cast<std::uint64_t>(v[0]);
\n delete[] v;
\n}<\/p>\n
static NOINLINE void recurse(std::size_t depth) {
\n volatile unsigned char pad[4096];
\n pad[depth % sizeof(pad)] = static_cast<unsigned char>(depth);
\n recurse(depth + 1);
\n gSink += pad[0]; \/\/ prevent tail-call elimination
\n}<\/p>\n
static NOINLINE int *returnLocalAddress() {
\n int local = 56;
\n int *result = &local;
\n#if defined(__GNUC__) || defined(__clang__)
\n asm volatile("" : "+r"(result) : : "memory");
\n#endif
\n return result; \/\/ dangling immediately after return
\n}<\/p>\n
static NOINLINE void returnedPointer() {
\n int *p = returnLocalAddress();
\n *p = 7;
\n gSink = static_cast<std::uint64_t>(*p);
\n}<\/p>\n
static NOINLINE void threadCrash() {
\n std::thread worker([] {
\n volatile int *p = nullptr;
\n *p = 1;
\n });
\n worker.join();
\n}<\/p>\n
static NOINLINE void opaqueFree(void *p) {
\n#if defined(__GNUC__) || defined(__clang__)
\n asm volatile("" : "+r"(p) : : "memory");
\n#endif
\n std::free(p);
\n}<\/p>\n
static NOINLINE void doubleFree() {
\n void *p = std::malloc(128);
\n if (p == nullptr) {
\n std::abort();
\n }
\n opaqueFree(p);
\n opaqueFree(p);
\n}<\/p>\n
static NOINLINE void invalidFree() {
\n char *base = static_cast<char *>(std::malloc(128));
\n if (base == nullptr) {
\n std::abort();
\n }
\n void *interior = base + 1;
\n#if defined(__GNUC__) || defined(__clang__)
\n asm volatile("" : "+r"(interior) : : "memory");
\n#endif
\n std::free(interior); \/\/ not the pointer returned by malloc
\n}<\/p>\n
static NOINLINE void invalidPointer() {
\n volatile std::uintptr_t raw = 0x1;
\n auto *p = reinterpret_cast<volatile int *>(raw);
\n *p = 9;
\n}<\/p>\n
static NOINLINE void corruptedDll() {
\n#if defined(__GLIBC__)
\n constexpr std::size_t n = 0x500; \/\/ bypass tcache\/small fast paths
\n char *victim = static_cast<char *>(std::malloc(n));
\n void *guard = std::malloc(0x40); \/\/ prevent top-chunk coalescing
\n if (victim == nullptr || guard == nullptr) {
\n std::abort();
\n }
\n std::memset(victim, 0x41, n);
\n std::free(victim);<\/p>\n
void **links = reinterpret_cast<void **>(victim);
\n links[1] = victim – 2 * sizeof(std::size_t);
\n void *trigger = std::malloc(n + 0x100);
\n gSink = reinterpret_cast<std::uintptr_t>(trigger);
\n std::free(guard);
\n#else
\n std::cerr << "corruptedDll requires glibc" << std::endl;
\n std::exit(2);
\n#endif
\n}<\/p>\n
static NOINLINE void mmapOob() {
\n const long rawPageSize = ::sysconf(_SC_PAGESIZE);
\n if (rawPageSize <= 0) {
\n std::abort();
\n }
\n const std::size_t pageSize = static_cast<std::size_t>(rawPageSize);<\/p>\n
void *area = ::mmap(nullptr, pageSize * 2, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
\n if (area == MAP_FAILED) {
\n std::perror("mmap");
\n std::exit(2);
\n }
\n if (::mprotect(area, pageSize, PROT_READ | PROT_WRITE) != 0) {
\n std::perror("mprotect");
\n std::exit(2);
\n }<\/p>\n
auto *bytes = static_cast<volatile unsigned char *>(area);
\n bytes[pageSize – 1] = 0x11;
\n bytes[pageSize] = 0x22; \/\/ first byte in the PROT_NONE guard page
\n}<\/p>\n
struct Case {
\n std::string_view name;
\n void (*run)();
\n};<\/p>\n
static constexpr Case kCases[] = {
\n {"stackOob", stackOob}, {"heapOob", heapOob}, {"recursion", [] { recurse(0); }}, {"returnedPointer", returnedPointer},
\n {"threadCrash", threadCrash}, {"doubleFree", doubleFree}, {"invalidFree", invalidFree}, {"invalidPointer", invalidPointer},
\n {"corruptedDll", corruptedDll}, {"mmapOob", mmapOob},
\n};<\/p>\n
int main(int argc, char **argv) {
\n if (argc != 2) {
\n std::cerr << "usage: " << argv[0] << " <case>" << std::endl;
\n for (const auto &item : kCases) {
\n std::cerr << " " << item.name << std::endl;
\n }
\n return 2;
\n }
\n for (const auto &item : kCases) {
\n if (item.name == argv[1]) {
\n std::cerr << "running: " << item.name << std::endl;
\n item.run();
\n std::cerr << "returned without an immediate crash; use ASan\/Valgrind" << std::endl;
\n return 0;
\n }
\n }
\n std::cerr << "unknown case: " << argv[1] << std::endl;
\n return 2;
\n}<\/p>\n
\u8bf4\u660e：opaqueFree\u548cinvalidFree\u7b49\u51fd\u6570\u4e2d\u7684\u6c47\u7f16\u4ee3\u7801，\u4e3b\u8981\u662f\u7528\u6765\u5bf9\u7f16\u8bd1\u5668\u8fdb\u884c\u963b\u6b62\u6027\u5904\u7406，\u9632\u6b62\u76f4\u63a5\u7f16\u8bd1\u62a5\u5404\u79cd\u9519\u8bef
\n\u7f16\u8bd1\u65b9\u5f0f：<\/p>\n
g++ -std=c++17 -g3 -Og -fno-omit-frame-pointer -fno-optimize-sibling-calls -pthread main.cpp -o crash_demo<\/p>\n
\u4f1a\u751f\u6210\u76f8\u5173\u7684core\u6587\u4ef6，\u6ce8\u610f，\u4e0d\u540c\u7684\u7cfb\u7edf\u548c\u4e0d\u540c\u7684\u7248\u672c\u7684\u64cd\u4f5c\u7cfb\u7edf，\u53ef\u80fd\u751f\u6210\u7684\u4f4d\u7f6e\u6709\u6240\u4e0d\u540c，\u5927\u5bb6\u53ef\u6839\u636e\u81ea\u5df1\u7684\u60c5\u51b5\u5728\u5f53\u524d\u76ee\u5f55\u6216\u76f8\u5173\u76ee\u5f55\u4e0b\u67e5\u627e
\n\u4f7f\u7528GDB，\u5176\u5e38\u7528\u7684\u547d\u4ee4\u8bf4\u660e：<\/p>\n
set pagination off # \u5173\u95ed\u5206\u9875
\ninfo threads # \u770b\u6709\u54ea\u4e9b\u7ebf\u7a0b
\nthread apply all bt # \u770b\u6240\u6709\u7ebf\u7a0b\u8c03\u7528\u6808
\nthread apply all bt full # \u9700\u8981\u65f6\u770b\u8be6\u7ec6\u5c40\u90e8\u53d8\u91cf
\nframe 0 # \u5207\u5230\u5d29\u6e83\u5e27
\nlist # \u67e5\u770b\u5d29\u6e83\u70b9\u6e90\u7801
\ninfo locals # \u67e5\u770b\u5c40\u90e8\u53d8\u91cf
\ninfo registers # \u67e5\u770b\u5bc4\u5b58\u5668<\/p>\n
\u542f\u52a8GDB\u8c03\u8bd5：<\/p>\n
gdb crash_demo core.1111
\n…\u5ffd\u7565\u8bf4\u660e
\nReading symbols from crash_demo…
\n[New LWP 2681680]
\n[New LWP 2681679]<\/p>\n
This GDB supports auto-downloading debuginfo from the following URLs:
\n <https:\/\/debuginfod.ubuntu.com>
\nEnable debuginfod for this session? (y or [n]) y
\nDebuginfod has been enabled.
\nTo make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
\n[Thread debugging using libthread_db enabled]
\nUsing host libthread_db library "\/usr\/lib\/x86_64-linux-gnu\/libthread_db.so.1".
\nCore was generated by `.\/crash_demo threadCrash'.
\nProgram terminated with signal SIGSEGV, Segmentation fault.
\n#0 operator() (__closure=<optimized out>) at main.cpp:58
\n58 *p = 1;
\n[Current thread is 1 (Thread 0x7605dc9ff6c0 (LWP 2681680))]<\/p>\n
(gdb) info thread
\n Id Target Id Frame
\n* 1 Thread 0x7605dc9ff6c0 (LWP 2681680) operator() (__closure=<optimized out>) at main.cpp:58
\n 2 Thread 0x7605dd180780 (LWP 2681679) __syscall_cancel_arch () at ..\/sysdeps\/unix\/sysv\/linux\/x86_64\/syscall_cancel.S:56
\nthread apply all bt<\/p>\n
Thread 2 (Thread 0x7605dd180780 (LWP 2681679)):
\n#0 __syscall_cancel_arch () at ..\/sysdeps\/unix\/sysv\/linux\/x86_64\/syscall_cancel.S:56
\n#1 0x00007605dcaa05ec in __internal_syscall_cancel (a1=a1@entry=129767548386536, a2=<optimized out>, a3=<optimized out>, a4=a4@entry=0, a5=a5@entry=0, a6=a6@entry=4294967295, nr=202) at .\/nptl\/cancellation.c:49
\n#2 0x00007605dcaa09c7 in __futex_abstimed_wait_common64 (private=128, futex_word=0x7605dc9ffce8, expected=<optimized out>, op=265, abstime=0x0, cancel=true) at .\/nptl\/futex-internal.c:57
\n#3 __futex_abstimed_wait_common (futex_word=0x7605dc9ffce8, expected=<optimized out>, clockid=0, abstime=0x0, private=128, cancel=true) at .\/nptl\/futex-internal.c:87
\n#4 __GI___futex_abstimed_wait_cancelable64 (futex_word=futex_word@entry=0x7605dc9ffce8, expected=<optimized out>, clockid=clockid@entry=0, abstime=abstime@entry=0x0, private=private@entry=128) at .\/nptl\/futex-internal.c:139
\n#5 0x00007605dcaa60b9 in __pthread_clockjoin_ex (threadid=129767548384960, thread_return=0x0, clockid=0, abstime=0x0, cancel=<optimized out>) at .\/nptl\/pthread_join_common.c:66
\n#6 0x00007605dcef5f73 in std::thread::join() () from \/usr\/lib\/x86_64-linux-gnu\/libstdc++.so.6
\n#7 0x00006241673de8b2 in threadCrash () at main.cpp:60
\n#8 0x00006241673dea0e in main (argc=2, argv=<optimized out>) at main.cpp:166<\/p>\n
Thread 1 (Thread 0x7605dc9ff6c0 (LWP 2681680)):
\n#0 operator() (__closure=<optimized out>) at main.cpp:58
\n#1 std::__invoke_impl<void, threadCrash()::<lambda()> > (__f=…) at \/usr\/include\/c++\/15\/bits\/invoke.h:63
\n……
\n(gdb) thread apply all bt full<\/p>\n
Thread 2 (Thread 0x7605dd180780 (LWP 2681679)):
\n#0 __syscall_cancel_arch () at ..\/sysdeps\/unix\/sysv\/linux\/x86_64\/syscall_cancel.S:56
\nNo locals.
\n#1 0x00007605dcaa05ec in __internal_syscall_cancel (a1=a1@entry=129767548386536, a2=<optimized out>, a3=<optimized out>, a4=a4@entry=0, a5=a5@entry=0, a6=a6@entry=4294967295, nr=202) at .\/nptl\/cancellation.c:49
\n result = <optimized out>
\n pd = <optimized out>
\n ch = <optimized out>
\n#2 0x00007605dcaa09c7 in __futex_abstimed_wait_common64 (private=128, futex_word=0x7605dc9ffce8, expected=<optimized out>, op=265, abstime=0x0, cancel=true) at .\/nptl\/futex-internal.c:57
\n resultvar = <optimized out>
\n __arg6 = <optimized out>
\n…..<\/p>\n
(gdb) frame 0
\n#0 operator() (__closure=<optimized out>) at main.cpp:58
\n58 *p = 1;
\n(gdb) list
\n53}
\n54
\n55static NOINLINE void threadCrash() {
\n56 std::thread worker([] {
\n57 volatile int *p = nullptr;
\n58 *p = 1;
\n59 });
\n60 worker.join();
\n61}
\n62
\n(gdb) info locals
\np = 0x0
\n(gdb) info reg
\nrax 0x6241673e0b90 108033044515728
\nrbx 0x62417240b020 108033229238304
\nrcx 0x7605dcaa3f3d 129767549058877
\nrdx 0x0 0
\nrsi 0x7605dc9fffb0 129767548387248
\nrdi 0x62417240b020 108033229238304
\n(gdb) x\/20i $pc
\n=> 0x6241673de56a <std::thread::_State_impl<std::thread::_Invoker<std::tuple<threadCrash()::<lambda()> > > >::_M_run(void)+4>:movl $0x1,0x0
\n 0x6241673de575 <std::thread::_State_impl<std::thread::_Invoker<std::tuple<threadCrash()::<lambda()> > > >::_M_run(void)+15>:ret
\n 0x6241673de576 <mmapOob()>:endbr64
\n 0x6241673de57a <mmapOob()+4>:push %rbp
\n 0x6241673de57b <mmapOob()+5>:mov %rsp,%rbp
\n 0x6241673de57e <mmapOob()+8>:push %r12
\n 0x6241673de580 <mmapOob()+10>:push %rbx
\n 0x6241673de581 <mmapOob()+11>:mov $0x1e,%edi
\n 0x6241673de586 <mmapOob()+16>:call 0x6241673de220 <sysconf@plt>
\n 0x6241673de58b <mmapOob()+21>:test %rax,%rax
\n 0x6241673de58e <mmapOob()+24>:jle 0x6241673de5e7 <mmapOob()+113>
\n 0x6241673de590 <mmapOob()+26>:mov %rax,%r12
\n 0x6241673de593 <mmapOob()+29>:lea (%rax,%rax,1),%rsi
\n 0x6241673de597 <mmapOob()+33>:mov $0x0,%r9d
\n 0x6241673de59d <mmapOob()+39>:mov $0xffffffff,%r8d
\n 0x6241673de5a3 <mmapOob()+45>:mov $0x22,%ecx
\n 0x6241673de5a8 <mmapOob()+50>:mov $0x0,%edx
\n 0x6241673de5ad <mmapOob()+55>:mov $0x0,%edi
\n 0x6241673de5b2 <mmapOob()+60>:call 0x6241673de310 <mmap@plt>
\n 0x6241673de5b7 <mmapOob()+65>:mov %rax,%rbx
\n(gdb) p $_siginfo._sifields._sigfault.si_addr
\n$1 = (void *) 0x0
\n(gdb) <\/p>\n
\u7ebf\u7a0b\u547d\u4ee4\u5bf9\u5e94\u7740\u4e0a\u9762\u7684\u4e24\u4eba\u4e2a\u7ebf\u7a0bID，\u5e26\u661f\u53f7\u8868\u793a\u6b63\u5728\u6b64\u7ebf\u7a0b\u4e2d\u3002\u8fd9\u4e2a\u7ebf\u7a0b\u5d29\u6e83\u7684\u4ee3\u7801\u592a\u7b80\u5355\u6240\u4ee5\u76f4\u63a5\u5728GDB\u4e2d\u53ef\u4ee5\u770b\u51fa\u6765，\u800c\u4e0d\u5fc5\u5206\u6790\u5404\u79cd\u53d8\u91cf\u548c\u5185\u5b58\u3002\u4f46\u65b9\u6cd5\u7ed9\u51fa\u4e86，\u518d\u5305\u62ec\u524d\u9762\u7528AI\u5206\u6790\u8f85\u52a9\u7684\u65b9\u5f0f，\u5176\u5b9e\u5c31\u5f88\u5bb9\u6613\u5b9a\u4f4d\u76f8\u5173\u7684\u95ee\u9898\u6240\u5728\u4f4d\u7f6e\u4e86\u3002<\/p>\n
\u4e5f\u53ef\u4ee5\u4f7f\u7528\u5de5\u5177：<\/p>\n
valgrind –tool=memcheck –track-origins=yes –leak-check=full –show-leak-kinds=all –keep-stacktraces=alloc-and-free –error-exitcode=99 .\/crash_demo heapOob
\n==2678521== Memcheck, a memory error detector
\n==2678521== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
\n==2678521== Using Valgrind-3.26.0 and LibVEX; rerun with -h for copyright info
\n==2678521== Command: .\/crash_demo heapOob
\n==2678521==
\nrunning: heapOob
\n==2678521== Invalid write of size 4
\n==2678521== at 0x40027B3: heapOob() (main.cpp:28)
\n==2678521== by 0x4002A0D: main (main.cpp:166)
\n==2678521== Address 0x4eab0a0 is 0 bytes after a block of size 32 alloc'd
\n==2678521== at 0x48535F3: operator new[](unsigned long) (vg_replace_malloc.c:730)
\n==2678521== by 0x4002779: heapOob() (main.cpp:27)
\n==2678521== by 0x4002A0D: main (main.cpp:166)
\n==2678521==
\nreturned without an immediate crash; use ASan\/Valgrind
\n==2678521==
\n==2678521== HEAP SUMMARY:
\n==2678521== in use at exit: 0 bytes in 0 blocks
\n==2678521== total heap usage: 2 allocs, 2 frees, 73,760 bytes allocated
\n==2678521==
\n==2678521== All heap blocks were freed — no leaks are possible
\n==2678521==
\n==2678521== For lists of detected and suppressed errors, rerun with: -s
\n==2678521== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)<\/p>\n
\u901a\u8fc7\u4e0a\u9762\u5206\u6790\u53ef\u4ee5\u770b\u51fa，\u7ed9\u51fa\u4e86\u201c2678521 Invalid write of size 4\u201d，\u5199\u5165\u4e86\u56db\u4e2a\u5b57\u8282\u3002\u4f4d\u7f6e\u5728main.cpp\u7684\u7b2c28\u884c\u7684heapOob\u51fd\u6570\u4e2d\u3002\u8d8a\u754c\u7684\u5730\u5740\u662f\u201c2678521 Address 0x4eab0a0 is 0 bytes after a block of size 32 alloc\u2019d\u201d\u3002\u7a0b\u5e8f\u8fd8\u6253\u5370\u4e86\u201creturned without an immediate crash; use ASan\/Valgrind\u201d\u3002\u8fd9\u662f\u56e0\u4e3a\u5c0f\u8303\u56f4\u8d8a\u754cglibc\u7684\u5806chunk\u6709\u5bf9\u9f50\u548c\u586b\u5145，\u5b9e\u9645\u5360\u7528\u7684\u7a7a\u95f4\u53ef\u80fd\u66f4\u5927，\u800c\u8fd9\u56db\u4e2a\u5b57\u8282\u53ef\u80fd\u5728\u8fd9\u5176\u4e2d，\u6240\u4ee5\u6ca1\u6709\u7834\u574f\u5230chunk\u6216\u4e0b\u4e00\u4e2a\u7684\u6307\u9488\u3002\u6545\u800c\u7a0b\u5e8f\u5f97\u4ee5\u6b63\u5e38\u7ec8\u6b62\u3002\u5f88\u6e05\u6670\u7684\u8bf4\u660e\u3002
\n\u5982\u679c\u662f\u4f7f\u7528ASan\u6216UBSan\u5206\u6790，\u5219\u5fc5\u987b\u4f7f\u7528\u4e0b\u9762\u7684\u7f16\u8bd1\u65b9\u5f0f\u91cd\u65b0\u7f16\u8bd1：<\/p>\n
g++ -std=c++17 \\\\
\n -g3 -O1 \\\\
\n -fno-omit-frame-pointer \\\\
\n -fno-optimize-sibling-calls \\\\
\n -fsanitize=address,undefined \\\\
\n -pthread \\\\
\n main.cpp \\\\
\n -o crash_demo_asan<\/p>\n
\u8fd0\u884c\u547d\u4ee4：<\/p>\n
ASAN_OPTIONS=detect_stack_use_after_return=1:abort_on_error=1:strict_string_checks=1 .\/crash_demo_asan doubleFree
\nrunning: doubleFree
\n=================================================================
\n==2679167==ERROR: AddressSanitizer: attempting double-free on 0x77f185be0040 in thread T0:
\n #0 0x7b318792a3ff in free ..\/..\/..\/..\/src\/libsanitizer\/asan\/asan_malloc_linux.cpp:51
\n #1 0x60b23926fc6d in opaqueFree \/home\/qt65_project\/crashDumpTest\/main.cpp:67
\n #2 0x60b23926fc9e in doubleFree \/home\/qt65_project\/crashDumpTest\/main.cpp:76
\n #3 0x60b239270fca in main \/home\/qt65_project\/crashDumpTest\/main.cpp:166
\n #4 0x7b318682a600 in __libc_start_call_main ..\/sysdeps\/nptl\/libc_start_call_main.h:59
\n #5 0x7b318682a717 in __libc_start_main_impl ..\/csu\/libc-start.c:360
\n #6 0x60b23926f664 in _start (\/home\/qt65_project\/crashDumpTest\/crash_demo_asan+0x6664) (BuildId: 4801c09f88806c865e61592e1cb0dbe35b9397c3)<\/p>\n
0x77f185be0040 is located 0 bytes inside of 128-byte region [0x77f185be0040,0x77f185be00c0)
\nfreed by thread T0 here:
\n #0 0x7b318792a3ff in free ..\/..\/..\/..\/src\/libsanitizer\/asan\/asan_malloc_linux.cpp:51
\n #1 0x60b23926fc6d in opaqueFree \/home\/qt65_project\/crashDumpTest\/main.cpp:67
\n #2 0x60b23926fc96 in doubleFree \/home\/qt65_project\/crashDumpTest\/main.cpp:75
\n #3 0x60b239270fca in main \/home\/qt65_project\/crashDumpTest\/main.cpp:166
\n #4 0x7b318682a600 in __libc_start_call_main ..\/sysdeps\/nptl\/libc_start_call_main.h:59
\n #5 0x7b318682a717 in __libc_start_main_impl ..\/csu\/libc-start.c:360
\n #6 0x60b23926f664 in _start (\/home\/qt65_project\/crashDumpTest\/crash_demo_asan+0x6664) (BuildId: 4801c09f88806c865e61592e1cb0dbe35b9397c3)<\/p>\n
previously allocated by thread T0 here:
\n #0 0x7b318792b60f in malloc ..\/..\/..\/..\/src\/libsanitizer\/asan\/asan_malloc_linux.cpp:67
\n #1 0x60b23926fc86 in doubleFree \/home\/qt65_project\/crashDumpTest\/main.cpp:71
\n #2 0x60b239270fca in main \/home\/qt65_project\/crashDumpTest\/main.cpp:166
\n #3 0x7b318682a600 in __libc_start_call_main ..\/sysdeps\/nptl\/libc_start_call_main.h:59
\n #4 0x7b318682a717 in __libc_start_main_impl ..\/csu\/libc-start.c:360
\n #5 0x60b23926f664 in _start (\/home\/qt65_project\/crashDumpTest\/crash_demo_asan+0x6664) (BuildId: 4801c09f88806c865e61592e1cb0dbe35b9397c3)<\/p>\n
SUMMARY: AddressSanitizer: double-free \/home\/qt65_project\/crashDumpTest\/main.cpp:67 in opaqueFree
\n==2679167==ABORTING
\n\u5df2\u4e2d\u6b62 ASAN_OPTIONS=detect_stack_use_after_return=1:abort_on_error=1:strict_string_checks=1 .\/crash_demo_asan doubleFree<\/p>\n
\u8fd0\u884c\u7ed3\u679c\u7684\u5f00\u59cb\u5c31\u544a\u8bc9\u8fd9\u662f\u4e00\u4e2a\u4e8c\u6b21\u91ca\u653e\u7684\u95ee\u9898，\u95ee\u9898\u7684\u4f4d\u7f6e\u5728opaqueFree\u51fd\u6570\u5373main.cpp\u768467\u884c\u3002\u7b2c\u4e8c\u6b21\u91ca\u653e\u572876\u884c，\u4e5f\u662f\u8c03\u7528\u8fd9\u4e2a\u51fd\u6570\u3002\u800c\u7b2c\u4e00\u6b21\u91ca\u653e\u5219\u5728doubleFree\u51fd\u6570\u7684\u7b2c75\u884c\u3002\u4e0a\u9762\u7684\u63d0\u793a\u975e\u5e38\u6e05\u6670\u3002
\n\u66f4\u591a\u7684\u5de5\u5177\u5982TSan（\u6027\u80fd\u5f00\u9500\u5927，\u5185\u5b58\u9700\u8981\u9ad8，\u4e00\u822c\u63a8\u8350\u53ea\u5728\u5f00\u53d1\u548c\u6d4b\u8bd5\u73af\u5883\u4e2d\u4f7f\u7528）\u5219\u7b49\u8bf7\u81ea\u884c\u67e5\u9605\u76f8\u5173\u8d44\u6599\u5904\u7406\u3002<\/p>\n
\u5185\u5b58\u95ee\u9898\u867d\u7136\u662f\u4e00\u4e2a\u5927\u95ee\u9898，\u4f46\u5728\u5b9e\u8df5\u4e2d\u5df2\u7ecf\u79ef\u805a\u4e86\u5f88\u591a\u5e74\u7684\u5e94\u5bf9\u7ecf\u9a8c，\u5de5\u5177\u4e5f\u5341\u5206\u4e30\u5bcc\u3002\u8fd9\u6837，\u5728\u89e3\u51b3\u5185\u5b58\u7684\u5806\u6808\u6ea2\u51fa\u8d8a\u754c\u7684\u95ee\u9898\u65f6，\u53ef\u4ee5\u91c7\u7eb3\u7684\u65b9\u6cd5\u6709\u5f88\u591a\u3002\u800c\u4e14\u4e0d\u540c\u7684\u5e73\u53f0\u53ef\u80fd\u4e5f\u6709\u4e0d\u540c\u7684\u5de5\u5177\u548c\u673a\u5236，\u8fd9\u5c31\u9700\u8981\u5f00\u53d1\u8005\u56e0\u5730\u5236\u5b9c\u7684\u9009\u62e9\u548c\u4f7f\u7528\u6070\u5f53\u7684\u5de5\u5177，\u5c31\u80fd\u591f\u8f83\u4e3a\u5feb\u901f\u7684\u5b9a\u4f4d\u548c\u89e3\u51b3\u5185\u5b58\u7684\u95ee\u9898\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001\u5185\u5b58\u8d8a\u754c
\n\u5185\u5b58\u7684\u95ee\u9898\u662fc\/c\u7684\u4f20\u7edf\u7684\u3001\u7ecf\u5178\u7684\u95ee\u9898\u3002\u4ece\u4e0d\u540c\u7684\u7ef4\u5ea6\u548c\u4e0d\u540c\u7684\u5c42\u6b21\u90fd\u53ef\u4ee5\u770b\u5230\u4e0d\u4e00\u6837\u7684\u60c5\u51b5\u3002\u5bf9\u4e8e\u4e00\u4e9b\u4e0d\u592a\u719f\u6089\u8c03\u8bd5\u7684\u5f00\u53d1\u8005\u6765\u8bf4，\u5806\u548c\u6808\u7684\u5d29\u6e83\u5728\u4ed6\u4eec\u773c\u4e2d\u90fd\u662f\u4e00\u6837\u7684，\u53cd\u6b63\u7ed3\u679c\u90fd\u662f\u5d29\u6e83\u7684\u3002\u4f46\u5728\u5b9e\u9645\u7684\u5e94\u7528\u4e2d，\u6709\u7ecf\u9a8c\u7684\u5f00\u53d1\u8005\u53ef\u4ee5\u8fc5\u901f\u7684\u6839\u636e\u60c5\u51b5\u5224\u522b\u662f\u5806\u8fd8\u662f\u6808\u5f15\u8d77\u7684\u8d8a\u754c\u5d29\u6e83\u3002
\n\u6b63\u5982\u524d\u9762\u53cd\u590d\u63d0\u5230\u7684，\u89e3\u51b3\u95ee\u9898\u7684\u5173\u952e\u4e0d\u662f\u4e00\u773c\u53d1\u73b0\u95ee\u9898，\u800c\u662f\u5b66\u4f1a\u9010\u6b65\u62bd\u4e1d\u5265\u8327\u7684\u80fd\u529b，\u4e00\u6b65\u6b65\u7684\u5b9a\u4f4d\u95ee\u9898\u7684\u7b56\u7565\u3002\u6709\u4e86\u89e3\u51b3\u95ee\u9898\u7684\u601d\u8def\u548c<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[55],"topic":[],"class_list":["post-115170","post","type-post","status-publish","format-standard","hentry","category-server","tag-c"],"yoast_head":"\n