How to Fix Reading 0 Bytes After 5 Bytes Alloc'd

Using Valgrind to Find Memory Leaks and Invalid Retentiveness Use

By Alex Allain

Note: Valgrind is Linux only. If y'all aren't running Linux, or want a tool designed from the starting time to make debugging segfaults and retention issues easier, check out Cee Studio, a fully online C and C++ development environment from our sponsor. Cee Studio provides instant and informative feedback on memory problems.

Valgrind is a multipurpose code profiling and memory debugging tool for Linux when on the x86 and, as of version 3, AMD64, architectures. It allows yous to run your program in Valgrind'southward own surround that monitors retentiveness usage such as calls to malloc and free (or new and delete in C++). If y'all employ uninitialized memory, write off the stop of an array, or forget to complimentary a arrow, Valgrind can detect it. Since these are particularly common problems, this tutorial will focus mainly on using Valgrind to discover these types of simple memory problems, though Valgrind is a tool that can do a lot more.

Alternatively, for Windows users who want to develop Windows-specific software, you might be interested in IBM'southward Purify, which has features like to Valgrind for finding memory leaks and invalid memory accesses. A trial download is bachelor.

Getting Valgrind

If you're running Linux and you don't have a copy already, you can get Valgrind from the Valgrind download folio.

Installation should be as unproblematic as decompressing and untarring using bzip2 (XYZ is the version number in the below examples)

bzip2 -d valgrind-XYZ.tar.bz2 tar -xf valgrind-XYZ.tar        

which will create a directory chosen valgrind-XYZ; change into that directory and run

./configure make make install        

Now that you lot accept Valgrind installed, let's wait at how to use it.

Finding Memory Leaks With Valgrind

Memory leaks are amidst the almost difficult bugs to detect because they don't cause any outward problems until you've run out of memory and your phone call to malloc suddenly fails. In fact, when working with a language like C or C++ that doesn't have garbage collection, almost half your time might exist spent handling correctly freeing memory. And fifty-fifty one mistake can be costly if your program runs for long enough and follows that co-operative of code.

When y'all run your code, you'll need to specify the tool you desire to utilize; simply running valgrind volition give you the electric current list. Nosotros'll focus mainly on the memcheck tool for this tutorial as running valgrind with the memcheck tool will allow us to cheque correct memory usage. With no other arguments, Valgrind presents a summary of calls to gratuitous and malloc: (Note that 18490 is the process id on my organization; information technology will differ between runs.)

% valgrind --tool=memcheck program_name ... =18515== malloc/free: in employ at exit: 0 bytes in 0 blocks. ==18515== malloc/costless: 1 allocs, 1 frees, 10 bytes allocated. ==18515== For a detailed leak analysis,  rerun with: --leak-check=yeah        

If you have a memory leak, then the number of allocs and the number of frees will differ (you tin't use i free to release the memory belonging to more than 1 alloc). We'll come back to the fault summary later on, but for now, notice that some errors might be suppressed -- this is because some errors will be from standard library routines rather than your own code.

If the number of allocs differs from the number of frees, you'll want to rerun your program once again with the leak-check pick. This will evidence you lot all of the calls to malloc/new/etc that don't take a matching free.

For demonstration purposes, I'll use a really elementary programme that I'll compile to the executable called "example1"

#include <stdlib.h> int main() {     char *x = malloc(100); /* or, in C++, "char *ten = new char[100] */     return 0; }        

% valgrind --tool=memcheck --leak-cheque=yes example1        

This volition result in some information nigh the program showing upwardly, culminating in a list of calls to malloc that did not have subsequent calls to gratuitous:

==2116== 100 bytes in 1 blocks are definitely lost in loss record 1 of one ==2116==    at 0x1B900DD0: malloc (vg_replace_malloc.c:131) ==2116==    past 0x804840F: main (in /dwelling/cprogram/example1)        

This doesn't tell us quite as much as we'd like, though -- we know that the memory leak was acquired by a call to malloc in main, but we don't take the line number. The problem is that we didn't compile using the -one thousand choice of gcc, which adds debugging symbols. Then if we recompile with debugging symbols, we go the following, more than useful, output:

==2330== 100 bytes in 1 blocks are definitely lost in loss record 1 of one ==2330==    at 0x1B900DD0: malloc (vg_replace_malloc.c:131) ==2330==    past 0x804840F: main (example1.c:5)        

Now we know the exact line where the lost memory was allocated. Although it'southward still a question of tracking down exactly when yous desire to complimentary that memory, at to the lowest degree yous know where to start looking. And since for every call to malloc or new, you should have a program for treatment the memory, knowing where the memory is lost volition assistance you figure out where to commencement looking.

There volition be times when the --leak-check=yes pick will not effect in showing you all memory leaks. To find admittedly every unpaired call to free or new, you'll need to apply the --evidence-reachable=yeah option. Its output is almost exactly the same, but it will testify more unfreed memory.

Finding Invalid Pointer Use With Valgrind

Valgrind can also find the use of invalid heap retentiveness using the memcheck tool. For instance, if you allocate an assortment with malloc or new then effort to access a location past the end of the array:

char *x = malloc(ten); x[ten] = 'a';        

Valgrind will detect it. For instance, running the following program, example2, through Valgrind

#include <stdlib.h>  int main() {     char *x = malloc(10);     x[ten] = 'a';     return 0; }        

with

valgrind --tool=memcheck --leak-check=yeah example2        

results in the post-obit warning

==9814==  Invalid write of size one ==9814==    at 0x804841E: main (example2.c:six) ==9814==  Address 0x1BA3607A is 0 bytes afterward a cake of size 10 alloc'd ==9814==    at 0x1B900DD0: malloc (vg_replace_malloc.c:131) ==9814==    by 0x804840F: main (example2.c:five)        

What this tell u.s. is that we're using a pointer allocated room for ten bytes, outside that range -- consequently, we accept an 'Invalid write'. If nosotros were to try to read from that memory, we'd be alerted to an 'Invalid read of size Ten', where 10 is the amount of retentivity we effort to read. (For a char, it'll be 1, and for an int, it would be either 2 or 4, depending on your system.) As usual, Valgrind prints the stack trace of function calls and then that nosotros know exactly where the mistake occurs.

Detecting The Use Of Uninitialized Variables

Another type of operation that Valgrind will detect is the utilise of an uninitialized value in a provisional statement. Although you should be in the addiction of initializing all variables that you create, Valgrind will assist detect those cases where you don't. For instance, running the post-obit code equally example3

#include <stdio.h>  int master() {     int 10;     if(x == 0)     {         printf("10 is zero"); /* supplant with cout and include                                  iostream for C++ */     }     render 0; }        

through Valgrind volition upshot in

==17943== Conditional jump or move depends on uninitialised value(s) ==17943==    at 0x804840A: primary (example3.c:half dozen)        

Valgrind is fifty-fifty smart enough to know that if a variable is assigned the value of an uninitialized variable, that that variable is still in an "uninitialized" country. For instance, running the post-obit code:

#include <stdio.h>  int foo(int x) {     if(x < ten)     {         printf("x is less than 10\n");     } }  int main() {     int y;     foo(y); }        

in Valgrind as example4 results in the following warning:

==4827== Provisional jump or move depends on uninitialised value(s) ==4827==    at 0x8048366: foo (example4.c:v) ==4827==    by 0x8048394: master (example4.c:fourteen)        

Y'all might remember that the problem was in foo, and that the remainder of the phone call stack probably isn't that of import. But since master passes in an uninitialized value to foo (we never assign a value to y), it turns out that that's where nosotros take to start looking and trace back the path of variable assignments until we discover a variable that wasn't initialized.

This will but help y'all if yous actually test that branch of lawmaking, and in particular, that conditional statement. Make sure to cover all execution paths during testing!

What else will Valgrind Find

Valgrind will notice a few other improper uses of memory: if you telephone call free twice on the same arrow value, Valgrind will detect this for you; you'll get an fault:

Invalid costless()        

along with the corresponding stack trace.

Valgrind also detects improperly chosen methods of freeing retentiveness. For instance, in C++ there are three basic options for freeing dynamic retentiveness: costless, delete, and delete[]. The complimentary function should but be matched with a call to malloc rather than a call to, say, delete -- on some systems, you might be able to get abroad with not doing this, but it's not very portable. Moreover, the delete keyword should simply be paired with the new keyword (for allocation of unmarried objects), and the delete[] keyword should just be paired with the new[] keyword (for allocation of arrays). (Though some compilers volition let y'all to get away with using the wrong version of delete, there's no guarantee that all of them volition. Information technology's only not part of the standard.)

If you lot do trigger one of these issues, you'll get this error:

          Mismatched free() / delete / delete []        

which really should exist stock-still fifty-fifty if your code happens to exist working.

What Won't Valgrind Discover?

Valgrind doesn't perform bounds checking on static arrays (allocated on the stack). So if you declare an array inside your role:

int main() {     char x[10];     x[11] = 'a'; }        

then Valgrind won't warning you lot! One possible solution for testing purposes is merely to change your static arrays into dynamically allocated memory taken from the heap, where you will go bounds-checking, though this could be a mess of unfreed memory.

A Few More Caveats

What'due south the drawback of using Valgrind? Information technology'south going to consume more than memory -- up to twice as much as your plan commonly does. If you're testing an absolutely huge retentivity pig, you might accept bug. It's as well going to take longer to run your code when yous're using Valgrind to exam it. This shouldn't be a problem about of the time, and it only affects you during testing. Simply if you're running an already slow programme, this might bear upon y'all.

Finally, Valgrind isn't going to detect every error you have -- if yous don't test for buffer overflows past using long input strings, Valgrind won't tell you that your code is capable of writing over memory that it shouldn't be touching. Valgrind, like another other tool, needs to exist used intelligently as a way of illuminating issues.

Summary

Valgrind is a tool for the x86 and AMD64 architectures and currently runs under Linux. Valgrind allows the developer to run the executable inside its own environment in which it checks for unpaired calls to malloc and other uses of invalid retentivity (such as ininitialized memory) or invalid memory operations (such every bit freeing a cake of memory twice or calling the wrong deallocator function). Valgrind does not check use of statically allocated arrays.

Related manufactures

Dynamic Retention Allocation, Part 1: Advanced Memory Management

Dynamic Memory Allocation, Part 2: Dynamic Memory Allocation and Virtual Memory

Dynamic Retentivity Resource allotment, Part 3: Customized Allocators with Operator New and Operator Delete

Dynamic Memory Resource allotment, Part 4: Mutual Memory Direction Issues in C++

Agreement Pointers

Using auto_ptr to avoid retentivity leaks

foxworthdindoutiors.blogspot.com

Source: https://www.cprogramming.com/debugging/valgrind.html

Share this post