Linux C/C++内存泄漏检测工具:Valgrind

Valgrind 是一款 Linux下(支持 x86、x86_64和ppc32)程序的内存调试工具，它可以对编译后的二进制程序进行内存使用监测(C语言中的malloc和free，以及C++中的new和delete)，找出内存泄漏问题。

　　Valgrind 中包含的 Memcheck 工具可以检查以下的程序错误：

　　使用未初始化的内存 (Use of uninitialised memory)

　　使用已经释放了的内存 (Reading/writing memory after it has been free’d)

　　使用超过malloc分配的内存空间(Reading/writing off the end of malloc’d blocks)

　　对堆栈的非法访问 (Reading/writing inappropriate areas on the stack)

　　申请的空间是否有释放 (Memory leaks - where pointers to malloc’d blocks are lost forever)

　　malloc/free/new/delete申请和释放内存的匹配(Mismatched use of malloc/new/new [] vs free/delete/delete [])

　　src和dst的重叠(Overlapping src and dst pointers in memcpy() and related functions)

　　重复free

　　1、编译安装 Valgrind：

        wget http://valgrind.org/downloads/valgrind-3.12.0.tar.bz2

        tar xvf valgrind-3.12.0.tar.bz2

       cd valgrind-3.12.0/

      ./configure --prefix=/usr/local/valgrind

       make

      make install

　　2、使用示例：对“ls”程序进程检查，返回结果中的“definitely lost: 0 bytes in 0 blocks.”表示没有内存泄漏。

 [test@gitserver test]$ /usr/local/valgrind/bin/valgrind --tool=memcheck --leak-check=full ls 

==17850== Memcheck, a memory error detector

==17850== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.

==17850== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info

==17850== Command: ls

==17850==

core.17834  core.3150  dump  hello    helloDump  test.c    testmem    testmemDump

core.3140   core.3385  he    hello.c  test       testDump  testmem.c

==17850==

==17850== HEAP SUMMARY:

==17850==     in use at exit: 15,420 bytes in 21 blocks

==17850==   total heap usage: 56 allocs, 35 frees, 50,691 bytes allocated

==17850==

==17850== LEAK SUMMARY:

==17850==    definitely lost: 0 bytes in 0 blocks

==17850==    indirectly lost: 0 bytes in 0 blocks

==17850==      possibly lost: 0 bytes in 0 blocks

==17850==    still reachable: 15,420 bytes in 21 blocks

==17850==         suppressed: 0 bytes in 0 blocks

==17850== Reachable blocks (those to which a pointer was found) are not shown.

==17850== To see them, rerun with: --leak-check=full --show-leak-kinds=all

==17850==

==17850== For counts of detected and suppressed errors, rerun with: -v

==17850== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 27 from 8)

　　3、使用示例：编写的“testmem”程序进程检查，返回结果中的“definitely lost: 512 bytes in 1 blocks.”表示发生内存泄漏。

[test@gitserver test]$ /usr/local/valgrind/bin/valgrind --tool=memcheck --leak-check=full ./testmem

==17882== Memcheck, a memory error detector

==17882== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.

==17882== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info

==17882== Command: ./testmem

==17882==

==17882== Invalid free() / delete / delete[] / realloc()

==17882==    at 0x40273B2: free (vg_replace_malloc.c:529)

==17882==    by 0x8048433: test (in /home/test/test/testmem)

==17882==    by 0x8048445: main (in /home/test/test/testmem)

==17882==  Address 0x41d5028 is 0 bytes inside a block of size 512 free'd

==17882==    at 0x40273B2: free (vg_replace_malloc.c:529)

==17882==    by 0x8048428: test (in /home/test/test/testmem)

==17882==    by 0x8048445: main (in /home/test/test/testmem)

==17882==  Block was alloc'd at

==17882==    at 0x40279C5: malloc (vg_replace_malloc.c:298)

==17882==    by 0x8048405: test (in /home/test/test/testmem)

==17882==    by 0x8048445: main (in /home/test/test/testmem)

==17882==

==17882==

==17882== HEAP SUMMARY:

==17882==     in use at exit: 512 bytes in 1 blocks

==17882==   total heap usage: 2 allocs, 2 frees, 1,024 bytes allocated

==17882==

==17882== 512 bytes in 1 blocks are definitely lost in loss record 1 of 1

==17882==    at 0x40279C5: malloc (vg_replace_malloc.c:298)

==17882==    by 0x8048414: test (in /home/test/test/testmem)

==17882==    by 0x8048445: main (in /home/test/test/testmem)

==17882==

==17882== LEAK SUMMARY:

==17882==    definitely lost: 512 bytes in 1 blocks

==17882==    indirectly lost: 0 bytes in 0 blocks

==17882==      possibly lost: 0 bytes in 0 blocks

==17882==    still reachable: 0 bytes in 0 blocks

==17882==         suppressed: 0 bytes in 0 blocks

==17882==

==17882== For counts of detected and suppressed errors, rerun with: -v

==17882== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 13 from 8)

       通过objdump -d ./testmem > testmemDump 反汇编部分内容：

080483f4 <test>:

 80483f4:       55                                      push   %ebp

 80483f5:       89 e5                                mov    %esp,%ebp

 80483f7:       83 ec 28                           sub    $0x28,%esp

 80483fa:       c7 04 24 00 02 00 00    movl   $0x200,(%esp)

 8048401:       e8 1e ff ff ff                      call   8048324 <malloc@plt>

 8048406:       89 45 f0                           mov    %eax,-0x10(%ebp)

 8048409:       c7 04 24 00 02 00 00   movl   $0x200,(%esp)

 8048410:       e8 0f ff ff ff                       call   8048324 <malloc@plt>

 8048415:       89 45 f4                          mov    %eax,-0xc(%ebp)

 8048418:       8b 45 f0                          mov    -0x10(%ebp),%eax

 804841b:       89 45 f4                          mov    %eax,-0xc(%ebp)

 804841e:       8b 45 f4                          mov    -0xc(%ebp),%eax

 8048421:       89 04 24                         mov    %eax,(%esp)

 8048424:       e8 eb fe ff ff                     call   8048314 <free@plt>

 8048429:       8b 45 f0                          mov    -0x10(%ebp),%eax

 804842c:       89 04 24                         mov    %eax,(%esp)

 804842f:       e8 e0 fe ff ff                     call   8048314 <free@plt>

 8048434:       b8 00 00 00 00             mov    $0x0,%eax

 8048439:       c9                                    leave

 804843a:       c3                                    ret

0804843b <main>:

 804843b:       55                                  push   %ebp

 804843c:       89 e5                            mov    %esp,%ebp

 804843e:       83 e4 f0                       and    $0xfffffff0,%esp

 8048441:       e8 ae ff ff ff                  call   80483f4 <test>

 8048446:       b8 00 00 00 00          mov    $0x0,%eax

 804844b:       89 ec                           mov    %ebp,%esp

 804844d:       5d                                pop    %ebp

 804844e:       c3                                ret

 804844f:       90                    
4000
             nop

　　检查testmem程序，发现有一处“ ptr2 = malloc(512);;”中的“ptr2”没有被free，修改程序后，再使用Valgrind检查，结果已经是“definitely lost: 0 bytes in 0 blocks.”。