DAMAGE：after Normal block

先上代码：

#include <stdio.h>
#include <malloc.h>

class Test
{
private:
#define MAX_NUM 2
public:
Test()
{
printf("sizeof(Fct)=%d/n", sizeof(Fct));
printf("sizeof(&Test::Action1)=%d/n", sizeof(&Test::Action1));
printf("sizeof(&Test::Action2)=%d/n", sizeof(&Test::Action2));

int i;
//Init Action
Action = new Fct*[MAX_NUM];
for(i = 0; i < MAX_NUM; i++)
{
Action[i] = new Fct[MAX_NUM];
}

Action[0][0] = 0;
Action[0][1] = &Test::Action1;
Action[1][0] = 0;
Action[1][1] = &Test::Action2;
}
virtual ~Test()
{
int i;
for(i = 0; i < MAX_NUM; i++)
{
if(Action[i] != 0)
{
delete [] Action[i];
Action[i] = 0;
}
}
delete [] Action;
Action = 0;
}
private:
typedef void (Test::*Fct)(int);
Fct** Action;
void Action1(int x)
{
}
void Action2(int y)
{
}
};

int main(int argc, char* argv[])
{
Test tt;
return 0;
}

这段代码在析构函数时会抛出类似下面的错误：

DAMAGE：after Normal block (#73) at 0x003D1818

网上很多文章都说到这是内存越界或内存分配不足引起的。奇怪，将Fct换成char类型，一切OK。

最后在前面加如下代码，重载new，delete运算符

void* operator new(size_t sz) {
printf("operator new: %d Bytes/n", sz);
void* m = malloc(sz);
if(!m) puts("out of memory");
return m;
}

void* operator new[](size_t sz) {
printf("operator new[]: %d Bytes/n", sz);
void* m = malloc(sz);
if(!m) puts("out of memory");
return m;
}

void operator delete(void* m) {
puts("operator delete");
free(m);
}

void operator delete[](void* m) {
puts("operator delete[]");
free(m);
}

打印如下：

sizeof(Fct)=4
sizeof(&Test::Action1)=4
sizeof(&Test::Action2)=4
operator new[]: 8 Bytes
operator new[]: 0 Bytes
operator new[]: 0 Bytes
operator delete[]

Fct大小居然是0, 然而sizeof(Fct)=4，怪哉。更改Fct返回类型后发现，实际在new的时候Fct的大小是返回值的大小，void为0，int为4。

将

Action[i] = new Fct[MAX_NUM];

改为

Action[i] = (Fct*)new char[MAX_NUM * 4];

一切OK。内存大小分配正确。