\u7cfb\u7edf<\/a>\u7684malloc\/free\u8fdb\u884chook\uff0c\u7528\u6211\u4eec\u81ea\u5df1\u7684malloc\/free\u66ff\u4ee3\u7cfb\u7edf\u8c03\u7528\uff0c\u5c06free\u7684\u5730\u5740\u548cmalloc\u7684\u5730\u5740\u8fdb\u884c\u5339\u914d\uff0c\u67e5\u770b\u6700\u540e\u53c8\u4ec0\u4e48malloc\u6ca1\u6709\u8fdb\u884cfree\uff0c\u5e76\u5c06\u6ca1\u6709free\u7684malloc\u64cd\u4f5c\u7684\u4ee3\u7801\u6bb5\u5730\u5740\u8fdb\u884c\u8bb0\u5f55\uff0c\u901a\u8fc7\u4ee3\u7801\u6bb5\u5b9a\u4f4d\u6240\u5728\u7684\u6587\u4ef6\u3001\u51fd\u6570\u3001\u4ee3\u7801\u884c\u3002<\/p>\n\u65b9\u6848\u4e00<\/p>\n
\u91c7\u7528__libc_malloc,libc_free\u4e0e__builtin_return_address\u3002\u5b83\u4eec\u662fgcc\u63d0\u4f9b\u7684\u51fd\u6570\u3002<\/p>\n
__libc_malloc,libc_free\u62ff\u6765\u66ff\u4ee3malloc\/free\u3002\u53ef\u4ee5\u62ff\u6765\u5b9e\u73b0hook\u3002\u987b\u8981\u6ce8\u610f\u7684\u662f\uff0c\u6211\u4eec\u5b9e\u73b0\u7684malloc\/free\u51fd\u6570\uff0c\u5185\u90e8\u4f1a\u6709\u4e00\u4e9b\u51fd\u6570\u5982printf\uff0cfopen\uff0c\u987b\u8981\u907f\u514d\u5b83\u4eec\u4f1a\u5d4c\u5957\u8c03\u7528malloc\/free\u3002<\/p>\n
<\/p>\n
__builtin_return_address\uff0c\u624d\u80fd\u8fd4\u56de\u8c03\u7528\u6240\u5728\u51fd\u6570\u7684\u4ee3\u7801\u6bb5\u7684\u5730\u5740\u3002\u624d\u80fd\u5b9a\u4f4d\u663e\u5b58\u6cc4\u9732\u7684\u5177\u4f53\u4f4d\u7f6e\u3002<\/p>\n
malloc\u7684\u65f6\u4faf\uff0c\u521b\u5efa\u4e00\u4e2a\u6587\u4ef6\uff0c\u6587\u4ef6\u540d\u4f7f\u7528\u7533\u8bf7\u663e\u5b58\u7684\u5730\u5740\uff0c\u5e76\u8bb0\u5f55\u7533\u8bf7\u8be5\u663e\u5b58\u7684\u4ee3\u7801\u6bb5\u7684\u5730\u5740\uff1bfree\u7684\u65f6\u4faf\uff0c\u5220\u6389\u5bf9\u5e94\u7684\u6587\u4ef6\u3002<\/p>\n
\n
#include <\/span>
#include <\/span>
#include <\/span>
int<\/span> enable_malloc_hook = 1<\/span>;
extern<\/span> void<\/span> *__libc_malloc(size_t<\/span> size);
int<\/span> enable_free_hook = 1<\/span>;
extern<\/span> void<\/span> *__libc_free(void<\/span> *p);
void *malloc(size_t size) <\/span>{
if<\/span> (enable_malloc_hook) {
enable_malloc_hook = 0<\/span>;
void<\/span> *p = __libc_malloc(size);
void<\/span> *caller = __builtin_return_address(0<\/span>);
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, p);
FILE *fp = fopen(buff, \"w\"<\/span>);
fprintf<\/span>(fp, \"[+%p]malloc --> addr:%p size:%lun\"<\/span>, caller, p, size);
fflush(fp);
enable_malloc_hook = 1<\/span>;
return<\/span> p;
} else<\/span> {
return<\/span> __libc_malloc(size);
}
return<\/span> NULL<\/span>;
}
void free(void *p) <\/span>{
if<\/span> (enable_free_hook) {
enable_free_hook = 0<\/span>;
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, p);
if<\/span> (unlink(buff) < 0<\/span>) {
printf<\/span>(\"double free: %pn\"<\/span>, p);
}
__libc_free(p);
enable_free_hook = 1<\/span>;
} else<\/span> {
__libc_free(p);
}
}
\/\/ gcc -o memleak_0 memleak_0.c -g<\/span>
\/\/ addr2line -f -e memleak_0 -a 0x4006d8<\/span>
int main() <\/span>{
void<\/span> *p1 = malloc<\/span>(10<\/span>);
void<\/span> *p2 = malloc<\/span>(20<\/span>);
free<\/span>(p1);
void<\/span> *p3 = malloc<\/span>(30<\/span>);
void<\/span> *p4 = malloc<\/span>(40<\/span>);
free<\/span>(p2);
free<\/span>(p4);
return<\/span> 0<\/span>;
}<\/span><\/code><\/pre>\n<\/p>\n\u65b9\u6848\u4e8c<\/p>\n
\u4f7f\u7528\u5b8f\u5b9a\u4e49,\u5f00\u542f\u5b8f\u5b9a\u4e49\u4f7f\u7528\u6211\u4eec\u7684\u7248\u672c\u5d4c\u5165\u5f0flinux\u9a71\u52a8\u7a0b\u5e8f\u8bbe\u8ba1\u4ece\u5165\u95e8\u5230\u7cbe\u901a\uff0c\u4e0d\u5f00\u542f\u5c31\u4f7f\u7528\u7cfb\u7edf\u7684\u3002\u53ef\u4ee5\u4fbf\u6377debug\u3002<\/p>\n
\u663e\u5b58\u6cc4\u9732\u6d4b\u91cf\u4f7f\u7528malloc_hook\/free_hook,\u5b9a\u4f4d\u663e\u5b58\u6cc4\u9732\u4f4d\u7f6elinux\u670d\u52a1\u5668\u5f00\u53d1<\/strong>\uff0c\u4f7f\u7528__FILE__,__LINE__.<\/p>\n\n
#define<\/span> malloc<\/span>(size) malloc_hook<\/span>(size, __FILE__, __LINE__)
#define<\/span> free<\/span>(p) free_hook<\/span>(p, __FILE__, __LINE__)<\/span><\/code><\/pre>\n<\/p>\n\u53ef\u4ee5\u4f7f\u7528fclose\uff0c\u6ca1\u6709doublefree\u7684\u95ee\u9898\u4e86<\/p>\n
<\/p>\n
\n
#include <\/span>
#include <\/span>
#include <\/span>
void *malloc_hook(size_t size, const char *file, int line) <\/span>{
void<\/span> *p = malloc<\/span>(size);
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, p);
FILE *fp = fopen(buff, \"w\"<\/span>);
fprintf<\/span>(fp, \"[+%s:%d]malloc --> addr:%p size:%lun\"<\/span>, file, line, p, size);
fflush(fp);
fclose(fp);
return<\/span> p;
}
void free_hook(void *p, const char *file, int line) <\/span>{
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, p);
if<\/span> (unlink(buff) < 0<\/span>) {
printf<\/span>(\"double free: %pn\"<\/span>, p);
return<\/span>;
}
free<\/span>(p);
}
#define malloc(size) malloc_hook(size, __FILE__, __LINE__)<\/span>
#define free(p) free_hook(p, __FILE__, __LINE__)<\/span>
\/\/ gcc -o memleak_0 memleak_0.c -g<\/span>
\/\/ addr2line -f -e memleak_0 -a 0x4006d8<\/span>
int main() <\/span>{
void<\/span> *p1 = malloc<\/span>(10<\/span>);
void<\/span> *p2 = malloc<\/span>(20<\/span>);
free<\/span>(p1);
void<\/span> *p3 = malloc<\/span>(30<\/span>); \/\/ memory leak<\/span>
void<\/span> *p4 = malloc<\/span>(40<\/span>);
free<\/span>(p2);
free<\/span>(p4);
free<\/span>(p4); \/\/ double free<\/span>
return<\/span> 0<\/span>;
}<\/span><\/code><\/pre>\n<\/p>\n\u6d4b\u91cf\u51fa\u4e24\u4e2a\u95ee\u9898\uff0c\u4e00\u6b21\u663e\u5b58\u6cc4\u9732p3\uff0c\u4e00\u6b21doublefreep4\u3002\u7ed3\u679cOK\u3002<\/p>\n
<\/p>\n
\u65b9\u6848\u4e09<\/p>\n
\u4f7f\u7528malloc.h\u4e2d\u63d0\u4f9b\u7684hook:__malloc_hook,__free_hook.<\/p>\n
\u8fd9\u4e24\u4e2ahook\uff0c\u9ed8\u8ba4\u662fmalloc\uff0cfree\u3002<\/p>\n
\u53c2\u8003mtrace\u7684\u505a\u6cd5\uff0c\u901a\u8fc7\u6539\u53d8\u8fd9\u4e24\u4e2a\u503c\u6765\u8fdb\u884c\u6d4b\u91cf\u3002<\/p>\n
\n
#include <\/span>
#include <\/span>
#include <\/span>
#include <\/span>
typedef<\/span> void<\/span> *(*malloc_hoot_t<\/span>)(size_t<\/span> size, const<\/span> void<\/span> *caller);
malloc_hoot_t<\/span> malloc_f;
typedef void (*free_hook_t)(void *p, const void *caller)<\/span>;
free_hook_t<\/span> free_f;
void mem_trace(void)<\/span>;
void mem_untrace(void)<\/span>;
void *malloc_hook_f(size_t size, const void *caller) <\/span>{
mem_untrace();
void<\/span> *ptr = malloc<\/span>(size);
\/\/ printf(\"+%p: addr[%p]n\", caller, ptr);<\/span>
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, ptr);
FILE *fp = fopen(buff, \"w\"<\/span>);
fprintf<\/span>(fp, \"[+%p]malloc --> addr:%p size:%lun\"<\/span>, caller, ptr, size);
fflush(fp);
fclose(fp);
mem_trace();
return<\/span> ptr;
}
void free_hook_f(void *p, const void *caller) <\/span>{
mem_untrace();
\/\/ printf(\"-%p: addr[%p]n\", caller, p);<\/span>
char<\/span> buff[128<\/span>] = {0<\/span>};
sprintf<\/span>(buff, \".\/mem\/%p.mem\"<\/span>, p);
if<\/span> (unlink(buff) < 0<\/span>) {
printf<\/span>(\"double free: %pn\"<\/span>, p);
}
free<\/span>(p);
mem_trace();
}
void mem_trace(void) <\/span>{
malloc_f = __malloc_hook;
free_f = __free_hook;
__malloc_hook = malloc_hook_f;
__free_hook = free_hook_f;
}
void mem_untrace(void) <\/span>{
__malloc_hook = malloc_f;
__free_hook = free_f;
}
\/\/ gcc -o memleak_0 memleak_0.c -g<\/span>
\/\/ addr2line -f -e memleak_0 -a 0x4006d8<\/span>
int main() <\/span>{
mem_trace();
void<\/span> *p1 = malloc<\/span>(10<\/span>);
void<\/span> *p2 = malloc<\/span>(20<\/span>);
free<\/span>(p1);
void<\/span> *p3 = malloc<\/span>(30<\/span>);
void<\/span> *p4 = malloc<\/span>(40<\/span>);
free<\/span>(p2);
free<\/span>(p4);
mem_untrace();
return<\/span> 0<\/span>;
}<\/span><\/code><\/pre>\n<\/p>\n\u65b9\u6848\u56db<\/p>\n
\u4f7f\u7528mtrace<\/p>\n
\n
#include <\/span>
#include <\/span>
#include <\/span>
#include <\/span>
#include <\/span>
\/\/ gcc -o memleak_0 memleak_0.c -g<\/span>
\/\/ addr2line -f -e memleak_0 -a 0x4006d8<\/span>
int main() <\/span>{
\/\/ export MALLOC_TRACE=.\/test.log<\/span>
mtrace();
void<\/span> *p1 = malloc<\/span>(10<\/span>);
void<\/span> *p2 = malloc<\/span>(20<\/span>);
free<\/span>(p1);
void<\/span> *p3 = malloc<\/span>(30<\/span>);
void<\/span> *p4 = malloc<\/span>(40<\/span>);
free<\/span>(p2);
free<\/span>(p4);
muntrace();
#endif<\/span>
return<\/span> 0<\/span>;
}<\/span><\/code><\/pre>\n<\/p>\n\u65b9\u6848\u4e94<\/p>\n
\u4f7f\u7528dlsym\u5bf9malloc\uff0cfree\u8fdb\u884chook\u3002<\/p>\n
\n
#define _GNU_SOURCE<\/span>
#include <\/span>
#include <\/span>
#include <\/span>
#include <\/span>