realloc 指针释放

Llllln · 发表于 2022-4-22 19:49:47

马上注册，结交更多好友，享用更多功能^_^

您需要登录才可以下载或查看，没有账号？立即注册

x

realloc处理的指针一般是malloc等返回的，而且如果realloc的长度大于malloc的长度的话，可能会找一块新的连续内存把旧数据拷贝过来，而且释放旧内存

我的问题是：
1、realloc成功之后那么释放旧内存是手动free还是会自动free？
2、需不需要分清况，如果realloc分配成功就释放，如果分配失败返回NULL就不需要释放？

感谢感谢！！！！！！

cjgank · 发表于 2022-4-22 21:45:02

1. realloc成功之后原来malloc申请的内存空间还在，如果不需要使用原来指向原来控制的指针，则需要释放
2.不管realloc申请内存是否成功，原来malloc申请的成功的空间肯定是在的。所以还是需要释放原来申请的空间
3.realloc申请更大的内存空间，并把原来malloc申请内存空间的值复制过来
代码如下：
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
char *ptr = (char *)malloc(2 * sizeof (char));
if (NULL == ptr)
      printf ("内存空间申请失败");
ptr[0] = 'a';
ptr[1] = 'b';
printf ("ptr[0]=%c  ptr[1]=%c\n", ptr[0], ptr[1]);
char *point = realloc (ptr, 4 * sizeof (char));
if (NULL == point)
      printf ("内存空间申请失败");
printf ("point[0]=%c  point[1]=%c  point[2]=%c  point[3]=%c\n", point[0], point[1], point[2], point[3]);  //realloc()申请空间成功，打印内存空间的值

printf ("ptr[0]=%c  ptr[1]=%c\n", ptr[0], ptr[1]);  //realloc()申请内存空间成功了，但是ptr指向的空间还在
free (ptr);
printf ("ptr[0]=%c  ptr[1]=%c\n", ptr[0], ptr[1]);
return 0;
}
验证如下：
ptr[0]=a  ptr[1]=b
point[0]=a  point[1]=b  point[2]=? point[3]=
ptr[0]=a  ptr[1]=b
ptr[0]=  ptr[1]=

人造人 · 发表于 2022-4-24 12:45:33

cjgank 发表于 2022-4-22 21:45
1. realloc成功之后原来malloc申请的内存空间还在，如果不需要使用原来指向原来控制的指针，则需要释放
...

不对吧？

$ cat main.c
#include <stdio.h>
#include <stdlib.h>
int main(void)
{
char *ptr = (char *)malloc(2 * sizeof (char));
if (NULL == ptr)
printf ("内存空间申请失败");
ptr[0] = 'a';
ptr[1] = 'b';
printf ("ptr[0]=%c ptr[1]=%c\n", ptr[0], ptr[1]);
char *point = realloc (ptr, 4 * sizeof (char));
if (NULL == point)
printf ("内存空间申请失败");
printf ("point[0]=%c point[1]=%c point[2]=%c point[3]=%c\n", point[0], point[1], point[2], point[3]); //realloc()申请空间成功，打印内存空间的值
printf ("ptr[0]=%c ptr[1]=%c\n", ptr[0], ptr[1]); //realloc()申请内存空间成功了，但是ptr指向的空间还在
free (ptr);
printf ("ptr[0]=%c ptr[1]=%c\n", ptr[0], ptr[1]);
return 0;
}
$ gcc-debug -o main main.c
$ ./main
ptr[0]=a ptr[1]=b
point[0]=a point[1]=b point[2]=¾ point[3]=¾
=================================================================
==132449==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000011 at pc 0x561444833646 bp 0x7fffb33ef480 sp 0x7fffb33ef470
READ of size 1 at 0x602000000011 thread T0
#0 0x561444833645 in main /tmp/main.c:17
#1 0x7fad402f930f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
#2 0x7fad402f93c0 in __libc_start_main@GLIBC_2.2.5 (/usr/lib/libc.so.6+0x2d3c0)
#3 0x561444833114 in _start (/tmp/main+0x2114)
0x602000000011 is located 1 bytes inside of 2-byte region [0x602000000010,0x602000000012)
freed by thread T0 here:
#0 0x7fad40f031b2 in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x5614448333bb in main /tmp/main.c:12
#2 0x7fad402f930f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
previously allocated by thread T0 here:
#0 0x7fad40f02dd9 in __interceptor_malloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x5614448331ff in main /tmp/main.c:6
#2 0x7fad402f930f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
SUMMARY: AddressSanitizer: heap-use-after-free /tmp/main.c:17 in main
Shadow bytes around the buggy address:
0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa[fd]fa fa fa 04 fa fa fa fa fa fa fa fa fa
0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==132449==ABORTING
$

复制代码

想入门的新人 · 发表于 2022-4-24 16:06:56

cjgank 发表于 2022-4-22 21:45
1. realloc成功之后原来malloc申请的内存空间还在，如果不需要使用原来指向原来控制的指针，则需要释放
...

realloc不是重新分配内存之后，将原空间拷贝到新空间并自动释放原空间的吗？

jhanker · 发表于 2022-4-24 17:38:52

realloc 用过很多次了。无非就是将已经存在的一块内存扩大。

char* p = malloc(1024);
char* q = realloc(p,2048);

现在的问题是我们应该如何处理指针 p。刚开始按照我最直观的理解，如果就是直接将 p = NULL;。到最后只需要释放 q的空间就可以了。

因为最近在做个封装。结果在做单元测试的时候发现。有时候我在 free(q); 的时候会出错。这样我就郁闷了。

后来仔细一跟踪，发现 realloc 完以后 q 和 p 的指针地址是一样。不过有时候又不一样。

仔细查了下资料。得到如下信息：

1.如果当前连续内存块足够 realloc 的话，只是将p所指向的空间扩大，并返回p的指针地址。这个时候 q 和 p 指向的地址是一样的。

2.如果当前连续内存块不够长度，再找一个足够长的地方，分配一块新的内存，q，并将 p指向的内容 copy到 q，返回 q。并将p所指向的内存空间删除。

这样也就是说 realloc 有时候会产生一个新的内存地址有的时候不会。所以在分配完成后。我们需要判断下 p 是否等于 q。并做相应的处理。

这里有点要注意的是要避免 p = realloc(p,2048); 这种写法。有可能会造成 realloc 分配失败后，p原先所指向的内存地址丢失。

cjgank · 发表于 2022-4-24 19:27:33

jhanker 发表于 2022-4-24 17:38
realloc 用过很多次了。无非就是将已经存在的一块内存扩大。

char* p = malloc(1024);

char* p = malloc(1024);
char* q = realloc(p,2048);
free (p);
p = NULL;
...操作指针q...
free (q);
return 0;

程序不应该有二义性，realloc()后，应该主动释放指针p，操作指针q后，释放q退出。
这种说法应该没有问题吧？

人造人 · 发表于 2022-4-24 19:43:55

cjgank 发表于 2022-4-24 19:27
char* p = malloc(1024);
char* q = realloc(p,2048);
free (p);

请解释一下这个代码为什么报错

$ cat main.c
#include <stdio.h>
#include <stdlib.h>
int main(void) {
char *p = malloc(5);
char *q = realloc(p, 4096);
free(p);
free(q);
return 0;
}
$ gcc-debug -o main main.c
$ ./main
=================================================================
==133969==ERROR: AddressSanitizer: attempting double-free on 0x602000000010 in thread T0:
#0 0x7f956125ba79 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x56220aed61af in main /tmp/main.c:7
#2 0x7f956065230f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
#3 0x7f95606523c0 in __libc_start_main@GLIBC_2.2.5 (/usr/lib/libc.so.6+0x2d3c0)
#4 0x56220aed60a4 in _start (/tmp/main+0x10a4)
0x602000000010 is located 0 bytes inside of 5-byte region [0x602000000010,0x602000000015)
freed by thread T0 here:
#0 0x7f956125c1b2 in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x56220aed619f in main /tmp/main.c:6
#2 0x7f956065230f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
previously allocated by thread T0 here:
#0 0x7f956125bdd9 in __interceptor_malloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x56220aed618a in main /tmp/main.c:5
#2 0x7f956065230f in __libc_start_call_main (/usr/lib/libc.so.6+0x2d30f)
SUMMARY: AddressSanitizer: double-free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127 in __interceptor_free
==133969==ABORTING
$

复制代码

jhanker · 发表于 2022-4-24 19:55:39

本帖最后由 jhanker 于 2022-4-24 19:57 编辑

人造人发表于 2022-4-24 19:43
请解释一下这个代码为什么报错

char *q = realloc(p, 4096);
这句执行后，估计原来p指向的空间已经回收
free（p）//屏蔽试试
直接改成 p=q；
然后 free（p）；free（q）；留一句就行

人造人 · 发表于 2022-4-24 20:55:05

jhanker 发表于 2022-4-24 19:55
char *q = realloc(p, 4096);
这句执行后，估计原来p指向的空间已经回收
free（p）//屏蔽试试

嗯，这样就可以了

$ cat main.c
#include <stdio.h>
#include <stdlib.h>
int main(void) {
char *p = malloc(5);
char *q = realloc(p, 4096);
if(q) p = q;
free(p);
return 0;
}
$ gcc-debug -o main main.c
$ ./main
$

复制代码

cjgank · 发表于 2022-4-24 20:58:51

jhanker 发表于 2022-4-24 17:38
realloc 用过很多次了。无非就是将已经存在的一块内存扩大。

char* p = malloc(1024);

linux环境下，验证了说法1：q和p指向的内存空间是一样的。
但说法2没有办法验证。
说法1代码如下：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(void)
{
char *p = malloc(5);
if (NULL == p)
{
printf ("内存申请失败\n");
return -1;
}
strcpy (p, "hello world");
printf ("指针p指向内存空间内容：%s\n", p);
printf ("指针p的值：%p\n", p);
char *q = realloc(p, 4096);
if (NULL == q)
{
printf ("内存申请失败\n");
return -2;
}
printf ("指针q指向内存空间内容：%s\n", q);
strcat (q, " welcome to China");
printf ("操作指针q后，指针q指向的内存空间内容：%s\n", q);
printf ("realloc()并操作指针q后，指针p指向内存空间内容：%s\n", p);
printf ("指针q的值：%p\n", q);
free(q);
return 0;
}

复制代码

验证结果

指针p指向内存空间内容：hello world
指针p的值：0x660010
指针q指向内存空间内容：hello world
操作指针q后，指针q指向的内存空间内容：hello world welcome to China
realloc()并操作指针q后，指针p指向内存空间内容：hello world welcome to China
指针q的值：0x660010
[root@iZbp1fna3figga9ot6y4tvZ test]# vim realloc.c
[root@iZbp1fna3figga9ot6y4tvZ test]# gcc realloc.c && ./a.out
指针p指向内存空间内容：hello world
指针p的值：0xfbe010
指针q指向内存空间内容：hello world
操作指针q后，指针q指向的内存空间内容：hello world welcome to China
realloc()并操作指针q后，指针p指向内存空间内容：hello world welcome to China
指针q的值：0xfbe010

复制代码

人造人 · 发表于 2022-4-24 21:05:07

cjgank 发表于 2022-4-24 20:58
linux环境下，验证了说法1：q和p指向的内存空间是一样的。
但说法2没有办法验证。
说法1代码如下：

$ cat main.c
#include <stdio.h>
#include <stdlib.h>
int main(void) {
{
char *p = malloc(5);
char *q = realloc(p, 4096);
if(p == q) printf("8: p == q\n");
else printf("9: p != q\n");
if(q) p = q;
free(p);
}
{
char *p = malloc(5);
char *q = realloc(p, 8);
if(p == q) printf("16: p == q\n");
else printf("17: p != q\n");
if(q) p = q;
free(p);
}
return 0;
}
$ gcc-debug -o main main.c
$ ./main
9: p != q
17: p != q
$ gcc -g -Wall -o main main.c
$ ./main
8: p == q
16: p == q
$
$ cat main.c
#include <stdio.h>
#include <stdlib.h>
int main(void) {
{
char *p = malloc(5);
char *q = realloc(p, 409600);
if(p == q) printf("8: p == q\n");
else printf("9: p != q\n");
if(q) p = q;
free(p);
}
{
char *p = malloc(5);
char *q = realloc(p, 8);
if(p == q) printf("16: p == q\n");
else printf("17: p != q\n");
if(q) p = q;
free(p);
}
return 0;
}
$ gcc-debug -o main main.c
$ ./main
9: p != q
17: p != q
$ gcc -g -Wall -o main main.c
$ ./main
9: p != q
16: p == q
$

复制代码

cjgank · 发表于 2022-4-24 21:29:38

人造人发表于 2022-4-24 21:05

第一段代码，我每次输出结果都一样。
你的输出结果两次结果不一样

#include <stdio.h>
#include <stdlib.h>
int main(void) {
{
char *p = malloc(5);
printf ("p address:%p\n", p);
char *q = realloc(p, 4096);
printf ("q address:%p\n", q);
if(p == q)
printf("8: p == q\n");
else
printf("9: p != q\n");
if(q) p = q;
free(p);
}
printf ("\n");
{
char *p = malloc(5);
printf ("p address:%p\n", p);
char *q = realloc(p, 8);
printf ("q address:%p\n", q);
if(p == q)
printf("16: p == q\n");
else
printf("17: p != q\n");
if(q) p = q;
free(p);
}
return 0;
}

复制代码

输出结果：

[root@iZbp1fna3figga9ot6y4tvZ test]# gcc eq.c && ./a.out
p address:0xa61010
q address:0xa61010
8: p == q
p address:0xa61010
q address:0xa61010
16: p == q
[root@iZbp1fna3figga9ot6y4tvZ test]# gcc eq.c && ./a.out
p address:0xf0d010
q address:0xf0d010
8: p == q
p address:0xf0d010
q address:0xf0d010
16: p == q
[root@iZbp1fna3figga9ot6y4tvZ test]# gcc eq.c && ./a.out
p address:0x24d1010
q address:0x24d1010
8: p == q
p address:0x24d1010
q address:0x24d1010
16: p == q

复制代码

人造人 · 发表于 2022-4-24 21:31:28

cjgank 发表于 2022-4-24 21:29
第一段代码，我每次输出结果都一样。
你的输出结果两次结果不一样

嗯，因为编译选项不一样
编译环境也不一样

cjgank · 发表于 2022-4-24 21:55:09

人造人发表于 2022-4-24 21:31
嗯，因为编译选项不一样
编译环境也不一样

1.如果当前连续内存块足够 realloc 的话，只是将p所指向的空间扩大，并返回p的指针地址。这个时候 q 和 p 指向的地址是一样的。

2.如果当前连续内存块不够长度，再找一个足够长的地方，分配一块新的内存，q，并将 p指向的内容 copy到 q，返回 q。并将p所指向的内存空间删除。

兄弟，有这两段话的资料出处吗？

人造人 · 发表于 2022-4-24 22:01:48

cjgank 发表于 2022-4-24 21:55
兄弟，有这两段话的资料出处吗？

这两句话标准文档中不是这么说的，但是意思一样

http://www.cplusplus.com/reference/cstdlib/realloc/?kw=realloc

The function may move the memory block to a new location (whose address is returned by the function).
The content of the memory block is preserved up to the lesser of the new and old sizes, even if the block is moved to a new location. If the new size is larger, the value of the newly allocated portion is indeterminate.

复制代码

man realloc

The realloc() function changes the size of the memory block pointed to
by ptr to size bytes. The contents will be unchanged in the range from
the start of the region up to the minimum of the old and new sizes. If
the new size is larger than the old size, the added memory will not be
initialized. If ptr is NULL, then the call is equivalent to mal‐
loc(size), for all values of size; if size is equal to zero, and ptr is
not NULL, then the call is equivalent to free(ptr) (this behavior is
nonportable; see NOTES). Unless ptr is NULL, it must have been re‐
turned by an earlier call to malloc(), calloc(), or realloc(). If the
area pointed to was moved, a free(ptr) is done.

复制代码

人造人 · 发表于 2022-4-24 22:03:39

cjgank 发表于 2022-4-24 21:55
兄弟，有这两段话的资料出处吗？

man realloc

The realloc() function returns a pointer to the newly allocated memory,
which is suitably aligned for any built-in type, or NULL if the request
failed. The returned pointer may be the same as ptr if the allocation
was not moved (e.g., there was room to expand the allocation in-place),
or different from ptr if the allocation was moved to a new address. If
size was equal to 0, either NULL or a pointer suitable to be passed to
free() is returned. If realloc() fails, the original block is left un‐
touched; it is not freed or moved.

复制代码

人造人 · 发表于 2022-4-24 22:31:13

cjgank 发表于 2022-4-24 21:55
兄弟，有这两段话的资料出处吗？

glibc-2.33 源码

if ((unsigned long) (oldsize) >= (unsigned long) (nb))
{
/* already big enough; split below */
newp = oldp;
newsize = oldsize;
}

复制代码

newmem = _int_malloc (av, nb - MALLOC_ALIGN_MASK);
if (newmem == 0)
return 0; /* propagate failure */
newp = mem2chunk (newmem);
newsize = chunksize (newp);
/*
Avoid copy if newp is next chunk after oldp.
*/
if (newp == next)
{
newsize += oldsize;
newp = oldp;
}
else
{
void *oldmem = chunk2mem (oldp);
newmem = TAG_NEW_USABLE (newmem);
memcpy (newmem, oldmem,
CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ);
(void) TAG_REGION (chunk2rawmem (oldp), oldsize);
_int_free (av, oldp, 1);
check_inuse_chunk (av, newp);
return chunk2mem (newp);
}

复制代码

void*
_int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize,
INTERNAL_SIZE_T nb)
{
mchunkptr newp; /* chunk to return */
INTERNAL_SIZE_T newsize; /* its size */
void* newmem; /* corresponding user mem */
mchunkptr next; /* next contiguous chunk after oldp */
mchunkptr remainder; /* extra space at end of newp */
unsigned long remainder_size; /* its size */
/* oldmem size */
if (__builtin_expect (chunksize_nomask (oldp) <= CHUNK_HDR_SZ, 0)
|| __builtin_expect (oldsize >= av->system_mem, 0))
malloc_printerr ("realloc(): invalid old size");
check_inuse_chunk (av, oldp);
/* All callers already filter out mmap'ed chunks. */
assert (!chunk_is_mmapped (oldp));
next = chunk_at_offset (oldp, oldsize);
INTERNAL_SIZE_T nextsize = chunksize (next);
if (__builtin_expect (chunksize_nomask (next) <= CHUNK_HDR_SZ, 0)
|| __builtin_expect (nextsize >= av->system_mem, 0))
malloc_printerr ("realloc(): invalid next size");
if ((unsigned long) (oldsize) >= (unsigned long) (nb))
{
/* already big enough; split below */
newp = oldp;
newsize = oldsize;
}
else
{
/* Try to expand forward into top */
if (next == av->top &&
(unsigned long) (newsize = oldsize + nextsize) >=
(unsigned long) (nb + MINSIZE))
{
set_head_size (oldp, nb | (av != &main_arena ? NON_MAIN_ARENA : 0));
av->top = chunk_at_offset (oldp, nb);
set_head (av->top, (newsize - nb) | PREV_INUSE);
check_inuse_chunk (av, oldp);
return TAG_NEW_USABLE (chunk2rawmem (oldp));
}
/* Try to expand forward into next chunk; split off remainder below */
else if (next != av->top &&
!inuse (next) &&
(unsigned long) (newsize = oldsize + nextsize) >=
(unsigned long) (nb))
{
newp = oldp;
unlink_chunk (av, next);
}
/* allocate, copy, free */
else
{
newmem = _int_malloc (av, nb - MALLOC_ALIGN_MASK);
if (newmem == 0)
return 0; /* propagate failure */
newp = mem2chunk (newmem);
newsize = chunksize (newp);
/*
Avoid copy if newp is next chunk after oldp.
*/
if (newp == next)
{
newsize += oldsize;
newp = oldp;
}
else
{
void *oldmem = chunk2mem (oldp);
newmem = TAG_NEW_USABLE (newmem);
memcpy (newmem, oldmem,
CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ);
(void) TAG_REGION (chunk2rawmem (oldp), oldsize);
_int_free (av, oldp, 1);
check_inuse_chunk (av, newp);
return chunk2mem (newp);
}
}
}
/* If possible, free extra space in old or extended chunk */
assert ((unsigned long) (newsize) >= (unsigned long) (nb));
remainder_size = newsize - nb;
if (remainder_size < MINSIZE) /* not enough extra to split off */
{
set_head_size (newp, newsize | (av != &main_arena ? NON_MAIN_ARENA : 0));
set_inuse_bit_at_offset (newp, newsize);
}
else /* split remainder */
{
remainder = chunk_at_offset (newp, nb);
/* Clear any user-space tags before writing the header. */
remainder = TAG_REGION (remainder, remainder_size);
set_head_size (newp, nb | (av != &main_arena ? NON_MAIN_ARENA : 0));
set_head (remainder, remainder_size | PREV_INUSE |
(av != &main_arena ? NON_MAIN_ARENA : 0));
/* Mark remainder as inuse so free() won't complain */
set_inuse_bit_at_offset (remainder, remainder_size);
_int_free (av, remainder, 1);
}
check_inuse_chunk (av, newp);
return TAG_NEW_USABLE (chunk2rawmem (newp));
}

复制代码

cjgank · 发表于 2022-4-25 09:55:55

人造人发表于 2022-4-24 22:01
这两句话标准文档中不是这么说的，但是意思一样

http://www.cplusplus.com/reference/cstdlib/realloc ...

Thanks

账号		自动登录	找回密码
密码			立即注册