【C++】C++代码动态检查
代码动态检查方式
- AddressSanitizer (ASan) 内存地址溢出检测器
- LeakSanitizer (LSan) 内存泄露检测器
- ThreadSanitizer (TSan) 线程互斥检测器
- UndefinedBehaviorSanitizer (UBSsan) 没有定义的行为检测器
- MemorySanitizer (MSan) 内存未初始化读取检测器
一、内存地址溢出检测器
1. 安装内存地址溢出检测库
yum install libasan Installed: libasan.x86_64 0:4.8.5-36.el7_6.2
2. 错误例子代码：
#include <stdio.h>
#define kBufSize 10
char gArr[kBufSize];
int main(int argc, char **argv) {
char localArr[kBufSize];
localArr[12] = 0x31;
gArr[11] = 0x32;
return gArr[11];
}
3. 编译代码（增加内存溢出检测）
gcc -o a1 addresss.c -fsanitize=address -g
4. 执行代码（检测内存溢出）
[root@VM_93_229_centos test]# ./a1
=================================================================
==6766== ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc4c525bac at pc 0x4006c6 bp 0x7ffc4c525b60 sp 0x7ffc4c525b50
WRITE of size 1 at 0x7ffc4c525bac thread T0
#0 0x4006c5 (/home/dev/test/a1+0x4006c5)
#1 0x7f5167e1c444 (/usr/lib64/libc-2.17.so+0x22444)
#2 0x400588 (/home/dev/test/a1+0x400588)
Address 0x7ffc4c525bac is located at offset 44 in frame <main> of T0's stack:
This frame has 1 object(s):
[32, 42) 'localArr'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
Shadow bytes around the buggy address:
0x10000989cb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cb30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cb40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cb50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cb60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10000989cb70: f1 f1 f1 f1 00[02]f4 f4 f3 f3 f3 f3 00 00 00 00
0x10000989cb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cb90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cbb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10000989cbc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap righ redzone: fb
Freed Heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==6766== ABORTING
5. 分析内存溢出信息
错误信息显示变量 localArr 在内存指针 0x4006c6 处发生内存溢出错误。
通过内存地址找到源码错误行。
[root@VM_93_229_centos test]# addr2line -e ./a1 0x4006c6
/home/dev/test/addresss.c:9
[root@VM_93_229_centos test]# cat -n addresss.c
1 #include <stdio.h>
2
3 #define kBufSize 10
4
5 char gArr[kBufSize];
6
7 int main(int argc, char **argv) {
8 char localArr[kBufSize];
9 localArr[12] = 0x31;
10 gArr[11] = 0x32;
11 return gArr[11];
12 }
总结：修改localArr的内存溢出错误后，使用同样的方法监测gArr的内存溢出错误并修改。
二、内存泄露检测器
1. 安装内存泄露检测库
2. 错误例子代码
#include <stdio.h>
int main(){
int *ptr= new int(10);
return 0;
}
3. 编译代码（增加内存泄露检测器）
gcc leak.c -fsanitize=leak
4. 执行代码（检测内存泄露）
5. 分析
三、线程安全检测器
1. 安装线程安全检测库
yum install libtsan Package libtsan-4.8.5-36.el7_6.2.x86_64 already installed and latest version
2. 错误例子代码
#include <pthread.h>
#include <stdio.h>
int global;
void *Thread1(void *x) {
global++;
return NULL;
}
void *Thread2(void *x) {
global--;
return NULL;
}
int main() {
pthread_t t[2];
pthread_create(&t[0], NULL, Thread1, NULL);
pthread_create(&t[1], NULL, Thread2, NULL);
pthread_join(t[0], NULL);
pthread_join(t[1], NULL);
}
3. 编译代码（增加线程安全检测器）
gcc -o t tt.c -fsanitize=thread -fPIE -pie -g
4. 执行代码（检测内存泄露）
[root@centos test]# ./t
==================
WARNING: ThreadSanitizer: data race (pid=9271)
Read of size 4 at 0x7fc3c0c85068 by thread T1:
#0 Thread1 /home/dev/test/tt.c:7 (exe+0x0000000009ed)
#1 __tsan_write_range ??:0 (libtsan.so.0+0x00000001b1d9)
Previous write of size 4 at 0x7fc3c0c85068 by thread T2:
#0 Thread2 /home/dev/test/tt.c:12 (exe+0x000000000a68)
#1 __tsan_write_range ??:0 (libtsan.so.0+0x00000001b1d9)
Thread T1 (tid=9272, running) created by main thread at:
#0 pthread_create ??:0 (libtsan.so.0+0x00000001f42b)
#1 main /home/dev/test/tt.c:18 (exe+0x000000000ab5)
Thread T2 (tid=9273, running) created by main thread at:
#0 pthread_create ??:0 (libtsan.so.0+0x00000001f42b)
#1 main /home/dev/test/tt.c:19 (exe+0x000000000ad6)
SUMMARY: ThreadSanitizer: data race /home/dev/test/tt.c:7 Thread1
==================
ThreadSanitizer: reported 1 warnings
5. 错误分析
错误显示文件tt.c的第7行和第12行有线程对data race操作（即：线程不安全操作）。
#0 Thread1 /home/dev/test/tt.c:7 (exe+0x0000000009ed) #0 Thread2 /home/dev/test/tt.c:12 (exe+0x000000000a68)
四、内存未初始化之前读取检测器
1. 安装检测库
2. 错误例子代码
#include <iostream>
int main(int argc, char** argv) {
int* a = new int[10];
a[5] = 0;
if (a[argc])
std::cout << a[3];
return 0;
}
3. 编译代码（增加内存泄露检测器）
gcc mm.c -fsanitize=memory -fPIE -pie -fno-omit-frame-pointer -g
4. 执行代码（检测内存泄露）
5. 分析
----
未完待续
