ERROR: AddressSanitizer: heap-buffer-overflow on address X at pc Y bp Z sp W

Question

我对动态内存管理和使用 Fsanitise 标志查找内存管理问题还很陌生。我不能使用向量来存储数据 - 我需要使用原始数组，以及 "new" 和 "delete" 来管理堆对象。

当我尝试运行 EuclideanVectorTester 编译程序时出现以下错误，但不确定问题出在哪里，请大神赐教？

weill % make
g++ -std=c++14 -Wall -Werror -O2 -fsanitize=address -c EuclideanVectorTester.cpp
g++ -std=c++14 -Wall -Werror -O2 -fsanitize=address -c EuclideanVector.cpp
g++ -fsanitize=address EuclideanVectorTester.o EuclideanVector.o -o EuclideanVectorTester
weill % ./EuclideanVectorTester
1
=================================================================
==15341==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb59007e0 at pc 0x8048ca7 bp 0xbfb47388 sp 0xbfb4737c
WRITE of size 8 at 0xb59007e0 thread T0
    #0 0x8048ca6 in main (/tmp_amd/kamen/export/kamen/3/z3386180/cs6771/evec/EuclideanVectorTester+0x8048ca6)
    #1 0xb6ecae45 in __libc_start_main (/lib/i386-linux-gnu/i686/cmov/libc.so.6+0x16e45)

0xb59007e0 is located 0 bytes to the right of 16-byte region [0xb59007d0,0xb59007e0)
allocated by thread T0 here:
    #0 0xb722a4c4 in operator new[](unsigned int) (/usr/lib/libasan.so.1+0x524c4)
    #1 0x8048b9a in main (/tmp_amd/kamen/export/kamen/3/z3386180/cs6771/evec/EuclideanVectorTester+0x8048b9a)
    #2 0xb6ecae45 in __libc_start_main (/lib/i386-linux-gnu/i686/cmov/libc.so.6+0x16e45)
    #3 0x8048d8c (/tmp_amd/kamen/export/kamen/3/z3386180/cs6771/evec/EuclideanVectorTester+0x8048d8c)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 main
Shadow bytes around the buggy address:
  0x36b200a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b200b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b200c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b200d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b200e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x36b200f0: fa fa fa fa fa fa fa fa fa fa 00 00[fa]fa 04 fa
  0x36b20100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==15341==ABORTING
weill %

EuclideanVector.h 文件是这样的：

#ifndef _EuclideanVector_h
#define _EuclideanVector_h

#include <iostream>
#include <algorithm>


namespace even {
    class EuclideanVector {

        public:

            /*
             * A constructor that takes the number of dimensions (as an unsigned int) but no magnitudes, 
             * sets the magnitude in each dimension as 0.0. This is the default constructor, with the default value being 1.
             */
            template <typename NUM>
            EuclideanVector(const NUM dimensions = 1): 
                  EuclideanVector(dimensions, 0.0) {}; // delegating constructor; default constructor that takes in dimensions if there is user input, otherwise dimensions = 1 if it is an empty constructor

            // target constructor for delegating constructor
            template <typename NUM1, typename NUM2> // any numeric types of user input for dimensions and magnitude will be static_cast to unsigned int and double respectively
            EuclideanVector(const NUM1 dimensions, const NUM2 magnitude){

                        // static cast to unsigned int and assign dimensions_ to that
                        dimensions_ = new unsigned int (static_cast<unsigned int>(dimensions));

                        // assign pointer "magnitude_" to dynamically-allocated memory of new unnamed array<double> object of size "dimensions_"
                        magnitude_  =  new double [*dimensions_];

                        // fill the array<double> object "magnitude_" a number of "dimensions_" times, with the <double> value of "magnitude_" for each dimension
                        std::fill_n(magnitude_, dimensions_, static_cast<double>(magnitude));

                  }

            /*
             * Destructor: ~EuclideanVector
             * The destructor deallocates any memory acquired by the constructors. 
             */
            ~EuclideanVector();


            /*
             * Member function: getMagnitude()
             * Returns a double containing the number of dimensions in a particular array.
             */
            const double& getMagnitude () const;


            /*
             * Member function: getNumDimensions()
             * Returns an unsigned int containing the number of dimensions in a particular vector.
             */
            unsigned int getNumDimensions() const;


        private:
        /* Everything from here to the end of the class is private, so
         * not accessible or intended for use for the client */

            unsigned int *dimensions_;
            double *magnitude_;
            //double normal_;
        };
}

#endif

EuclideanVector.cpp 文件是这样的：

#include "EuclideanVector.h"
#include <algorithm>
#include <cmath> // for sqrt
#include <sstream>
#include <iterator>

namespace even {

    unsigned int EuclideanVector::getNumDimensions () const
    {
        return *dimensions_;
    }

    const double& EuclideanVector::getMagnitude () const
    {
        return *magnitude_;
    }

    // destructor
    EuclideanVector::~EuclideanVector() {
        delete dimensions_;
        delete [] magnitude_;
    }
}

EuclideanVectorTester.cpp 文件是这样的：

#include <iostream>
#include <vector>
#include <list>

#include "EuclideanVector.h"

int main() {

    std::cout << "1" << std::endl;

    evec::EuclideanVector a(2); 


    std::cout << "2" << std::endl;
    std::cout << "3" << std::end;

}

Answer 1

我只想说你的教授所说的有很多不准确之处（至少可以这么说）。

话虽如此，问题是您已将 dimensions 声明为 unsigned int*，但您在这里使用它就好像它是普通的 unsigned int :

std::fill_n(magnitude_, dimensions_, static_cast<double>(magnitude));

立即解决方法是：

std::fill_n(magnitude_, *dimensions_, static_cast<double>(magnitude));

然而，这就引出了一个问题，即为什么一个简单的 unsigned int 需要是一个指针，然后使用 new 进行分配。没有理由这样做，因为使用 new 比您现在所做的低效率。

如果您这样声明 dimensions_：

unsigned int dimensions_;

而不是它是一个指针，然后分配给 dimensons_ 的代码变成这样：

// no call to new is done
dimensions_ = static_cast<unsigned int>(dimensions);

// no dereference of a pointer needs to be done on the two lines below 
magnitude_ = new double[dimensions_];
std::fill_n(magnitude_, dimensions_, static_cast<double>(magnitude));

无需额外调用分配器，因此代码立即变得更加高效。

此外，析构函数现在看起来像这样：

EuclideanVector::~EuclideanVector() 
{
    delete [] magnitude_;
}

但即使说明了所有这些，如果您使用完全相同的 main 程序进行测试，给出的答案也只能解决问题。如果您将 main 更改为：

even::EuclideanVector a(2);
even::EuclideanVector b = a;

您现在运行复制语义不正确。同样，上述修复只需要使您的 main 功能正常工作。将 main 更改为如上例所示非常简单的内容，您运行会遇到更多问题。

ERROR: AddressSanitizer: heap-buffer-overflow on address X at pc Y bp Z sp W

ERROR: AddressSanitizer: heap-buffer-overflow on address X at pc Y bp Z sp W

c++

constructor

heap-memory

dynamic-memory-allocation

address-sanitizer