{"id":2587,"date":"2018-12-21T19:01:36","date_gmt":"2018-12-21T11:01:36","guid":{"rendered":"https:\/\/damogame.cn:15443\/wordpress\/?p=2587"},"modified":"2018-12-21T19:01:36","modified_gmt":"2018-12-21T11:01:36","slug":"%e9%87%8ewild%e6%8c%87%e9%92%88%e4%b8%8e%e6%82%ac%e7%a9%badangling%e6%8c%87%e9%92%88","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/2587","title":{"rendered":"\u91ce(wild)\u6307\u9488\u4e0e\u60ac\u7a7a(dangling)\u6307\u9488"},"content":{"rendered":"
1. \u4ec0\u4e48\u662f\u91ce\u6307\u9488(wild pointer)?<\/strong><\/div>\n
\n
\n
\n
A pointer in c which has not been initialized is known as wild pointer.<\/pre>\n<\/div>\n
\u91ce\u6307\u9488(wild pointer)\u5c31\u662f\u6ca1\u6709\u88ab\u521d\u59cb\u5316\u8fc7\u7684\u6307\u9488\u3002\u4f8b\u5982\uff0c<\/p>\n
o foo1.c<\/p>\n
\n
1 int main(int argc, char *argv[])\r\n2 {\r\n3     int *p;\r\n4     return (*p & 0x7f); \/* XXX: p is a wild pointer *\/\r\n5 }<\/pre>\n<\/div>\n
\u5982\u679c\u7528”gcc -Wall”\u7f16\u8bd1, \u4f1a\u51fa\u73b0\u5982\u4e0b\u8b66\u544a\uff1a<\/p>\n
\n
1 $ gcc -Wall -g -m32 -o foo foo.c\r\n2 foo.c: In function \u2018main\u2019:\r\n3 foo.c:4:10: warning: \u2018p\u2019 is used uninitialized in this function [-Wuninitialized]\r\n4   return (*p & 0x7f); \/* XXX: p is a wild pointer *\/\r\n5           ^<\/pre>\n<\/div>\n
2. \u4ec0\u4e48\u662f\u60ac\u7a7a\u6307\u9488(dangling pointer)?<\/strong><\/p>\n
\n
If a pointer still references the original memory after it has been freed, it is called a dangling pointer.<\/pre>\n<\/div>\n
\u60ac\u7a7a\u6307\u9488\u662f\u6307\u9488\u6700\u521d\u6307\u5411\u7684\u5185\u5b58\u5df2\u7ecf\u88ab\u91ca\u653e\u4e86\u7684\u4e00\u79cd\u6307\u9488\u3002 \u5178\u578b\u7684\u60ac\u7a7a\u6307\u9488\u770b\u8d77\u6765\u662f\u8fd9\u6837\u7684\uff0c\uff08\u56fe\u7247\u6765\u6e90\u662f\u8fd9\u91cc<\/a>\uff09<\/p>\n
\"\"<\/p>\n
\u5982\u679c\u4e24\u4e2a\u6307\u9488(p1\u548cp2)\u6307\u5411\u540c\u4e00\u5757\u5185\u5b58\u533a\u57df, \u90a3\u4e48free(p1)\u540e\uff0cp1\u548cp2\u90fd\u6210\u4e3a\u60ac\u7a7a\u6307\u9488\u3002\u5982\u679c\u8fdb\u4e00\u6b65\u5c06p1\u8bbe\u7f6e\u4e3aNULL, \u90a3\u4e48p2\u8fd8\u662f\u60ac\u7a7a\u6307\u9488\u3002\u8bda\u7136\uff0c\u4f7f\u7528*p1\u4f1a\u5bfc\u81f4\u975e\u6cd5\u5185\u5b58\u8bbf\u95ee\uff0c\u4f46\u662f\u4f7f\u7528*p2\u5374\u4f1a\u51fa\u73b0\u65e0\u6cd5\u9884\u6599\u7684\u7ed3\u679c\uff0c\u53ef\u8c13\u9632\u4e0d\u80dc\u9632\u3002\u4f8b\u5982\uff1a<\/p>\n
o foo2.c<\/p>\n
\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n
1 #include <stdlib.h>\r\n2 int main(int argc, char *argv[])\r\n3 {\r\n4         int *p1 = (int *)malloc(sizeof (int));\r\n5         int *p2 = p1;        \/* p2 and p1 are pointing to the same memory *\/\r\n6         free(p1);            \/* p1 is       a dangling pointer, so is p2  *\/\r\n7         p1 = NULL;           \/* p1 is not   a dangling pointer any more   *\/\r\n8         return (*p2 & 0x7f); \/* p2 is still a dangling pointer            *\/\r\n9 }<\/pre>\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n<\/div>\n
3. \u4f7f\u7528\u91ce\u6307\u9488\u548c\u60ac\u7a7a\u6307\u9488\u7684\u5371\u5bb3<\/strong><\/p>\n
\u65e0\u8bba\u662f\u91ce\u6307\u9488\u8fd8\u662f\u60ac\u7a7a\u6307\u9488\uff0c\u90fd\u662f\u6307\u5411\u65e0\u6548\u5185\u5b58\u533a\u57df(\u8fd9\u91cc\u7684\u65e0\u6548\u6307\u7684\u662f”\u4e0d\u5b89\u5168\u4e0d\u53ef\u63a7”)\u7684\u6307\u9488<\/strong>\u3002 \u8bbf\u95ee”\u4e0d\u5b89\u5168\u53ef\u63a7”(invalid)\u7684\u5185\u5b58\u533a\u57df\u5c06\u5bfc\u81f4”Undefined Behavior”\u3002<\/p>\n
\u5173\u4e8e”Undefined Behavior”, \u5b9a\u4e49\uff08\u53c2\u8003\u6765\u6e90:A Guide to Undefined Behavior in C and C++, Part 1<\/a>\uff09\u5982\u4e0b\uff1a<\/p>\n
Anything at all can happen; the Standard imposes no requirements. The program may fail to compile, or it may execute incorrectly (either crashing or silently generating incorrect results), or it may fortuitously do exactly what the programmer intended.<\/strong><\/div>\n
\u4e5f\u5c31\u662f\u8bf4\uff1a\u4efb\u4f55\u53ef\u80fd\u90fd\u4f1a\u53d1\u751f\u3002\u8981\u4e48\u7f16\u8bd1\u5931\u8d25\uff0c\u8981\u4e48\u6267\u884c\u5f97\u4e0d\u6b63\u786e(\u5d29\u6e83(e.g. segmentation fault)\u6216\u8005\u6084\u65e0\u58f0\u606f\u5730\u4ea7\u751f\u4e0d\u6b63\u786e\u7684\u6267\u884c\u7ed3\u679c)\uff0c\u6216\u8005\u5076\u5c14\u4f1a\u6b63\u786e\u5730\u4ea7\u751f\u7a0b\u5e8f\u5458\u5e0c\u671b\u8fd0\u884c\u7684\u7ed3\u679c\u3002<\/p>\n
4. \u5982\u4f55\u907f\u514d\u4f7f\u7528\u91ce\u6307\u9488\u548c\u60ac\u7a7a\u6307\u9488\uff1f<\/strong><\/p>\n
\u5982\u4f55\u907f\u514d\u4f7f\u7528\u91ce\u6307\u9488\uff1f \u597d\u529e\uff01\u00a0\u517b\u6210\u5728\u5b9a\u4e49\u6307\u9488\u540e\u4e14\u5728\u4f7f\u7528\u4e4b\u524d\u5b8c\u6210\u521d\u59cb\u5316<\/strong>\u7684\u4e60\u60ef\u5c31\u597d\u3002<\/p>\n
\u7136\u800c\uff0c\u5982\u4f55\u907f\u514d\u4f7f\u7528\u60ac\u7a7a\u6307\u9488\uff0c\u5c31\u6bd4\u8f83\u9ebb\u70e6\u4e86\u3002 Solaris\u5f15\u5165\u4e86ADI(Application Data Integrity)\u6280\u672f\u907f\u514d\u8bbf\u95ee\u5df2\u7ecf\u91ca\u653e\u7684\u5185\u5b58\u533a\u57df\uff0c\u4f8b\u5982\uff1a \u6700\u65b0\u7684SPARC\u5e73\u53f0\u5df2\u7ecf\u652f\u6301KADI\uff0c\u4e00\u65e6\u8bbf\u95ee\u67d0\u4e2a\u5df2\u7ecf\u91ca\u653e\u6389\u7684\u5185\u6838\u5185\u5b58\u533a\u57df\uff0c\u5c31\u4f1a\u5f15\u53d1\u64cd\u4f5c\u7cfb\u7edfpanic\u3002\u8fd9\u91cc\u7b80\u5355\u4ecb\u7ecd\u4e00\u4e0b\u4ec0\u4e48\u662fADI\u3002<\/p>\n
\n
ADI (Application Data Integrity) is a software layer built on\r\nMCD (Memory Corruption Detection), a SPARC hardware feature that provides\r\nstatistical protection against memory corruption errors such as buffer\r\noverflows, use-after-frees, and use-after-reallocs.\r\n\r\nKADI allows kernel memory to use ADI.<\/pre>\n<\/div>\n
\u8fd9\u6709\u6548\u7684\u907f\u514d\u4e86foo2.c\u793a\u4f8b\u4ee3\u7801\u4e2dp2\u53d8\u6210\u60ac\u7a7a\u6307\u9488\u8fd8\u88ab\u4f7f\u7528\u7684\u60c5\u51b5\u3002 \u90a3\u4e48\u95ee\u9898\u6765\u4e86\uff0c\u5982\u679c\u6ca1\u6709ADI\/KADI\u8fd9\u79cd\u9ad8\u5927\u4e0a\u7684\u6280\u672f\uff0c\u5982\u4f55\u907f\u514d\u4f7f\u7528\u60ac\u7a7a\u6307\u9488\uff1f<\/strong><\/p>\n
\u529e\u6cd5\u8fd8\u662f\u6709\u7684\uff0c\u76f4\u63a5\u907f\u514d\u4e0d\u4e86\u5c31\u95f4\u63a5\u907f\u514d\uff0c\u90a3\u5c31\u662f\u6240\u8c13\u7684\u667a\u80fd\u6307\u9488(smart pointer)\u3002\u667a\u80fd\u6307\u9488\u7684\u672c\u8d28\u662f\u4f7f\u7528\u5f15\u7528\u8ba1\u6570\uff08reference counting\uff09\u6765\u5ef6\u8fdf\u5bf9\u6307\u9488\u7684\u91ca\u653e\u3002<\/strong><\/p>\n
o \u5173\u4e8e\u667a\u80fd\u6307\u9488<\/a>\uff0c\u8bf7\u53c2\u8003\u7ef4\u57fa\u767e\u79d1\u3002<\/p>\n
\n
Smart pointers eliminate dangling pointers by postponing destruction until \r\nan object is no longer in use.<\/pre>\n<\/div>\n
o \u5173\u4e8e\u5f15\u7528\u8ba1\u6570<\/a>\uff0c\u4e5f\u8bf7\u53c2\u8003\u7ef4\u57fa\u767e\u79d1\u3002<\/p>\n
\n
Reference counting is a technique of storing the number of references, \r\npointers, or handles to a resource such as an object, block of memory, \r\ndisk space or other resource.<\/pre>\n<\/div>\n
\u7279\u522b\u8bf4\u660e\uff1a<\/strong>\u00a0\u5f15\u7528\u8ba1\u6570\u4e0d\u4f46\u5728\u57fa\u4e8e\u5783\u573e\u56de\u6536\u6280\u672f\u7684\u5185\u5b58\u7ba1\u7406\u4e2d\u88ab\u5e7f\u6cdb\u4f7f\u7528\uff0c\u800c\u4e14\u5728\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\u5b9e\u73b0\u4e2d\u4e5f\u88ab\u5e7f\u6cdb\u4f7f\u7528\u3002 \u4f8b\u5982\uff1a \u7d22\u5f15\u7ed3\u70b9(inode)\u5c31\u6709\u4f7f\u7528\u5f15\u7528\u8ba1\u6570\uff0c\u4ece\u800c\u4fdd\u8bc1\u4e86\u786c\u94fe\u63a5\u6587\u4ef6\u7684\u5b9e\u73b0\u3002<\/p>\n
\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n
1 $ stat foo | egrep Inode\r\n2 Device: 23000000002h\/2405181685762d     Inode: 210756182<\/pre>\n
Links: 1<\/strong><\/p>\n
3 \r\n4 $ ln foo foo9 && stat foo  | egrep Inode\r\n5 Device: 23000000002h\/2405181685762d     Inode: 210756182<\/pre>\n
Links: 2<\/strong><\/p>\n
6 \r\n7 $ rm -f foo   && stat foo9 | egrep Inode\r\n8 Device: 23000000002h\/2405181685762d     Inode: 210756182<\/pre>\n
Links: 1<\/strong><\/p>\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n<\/div>\n
\u5173\u4e8e\u667a\u80fd\u6307\u9488\uff0cC++11\u6709\u5f88\u597d\u7684\u652f\u6301\u3002 \u4e3a\u4e86\u65b9\u4fbf\u7406\u89e3\u667a\u80fd\u6307\u9488\u672c\u8d28\u4e0a\u662f\u5ef6\u8fdf\u91ca\u653e\u5185\u5b58\uff0c\u4e0b\u9762\u7ed9\u51fa\u4e00\u4e2a\u7b80\u5355\u7684C\u4ee3\u7801\u5b9e\u73b0\uff08\u4f7f\u7528proxy(\u4ee3\u7406) + refcnt\uff08\u5f15\u7528\u8ba1\u6570\uff09\uff09\u3002<\/p>\n
o foo3.c<\/p>\n
\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n
 1 #include <stdio.h>\r\n 2 #include <stdlib.h>\r\n 3 \r\n 4 typedef struct proxy_s {\r\n 5     int *object;\r\n 6     int refcnt;\r\n 7 } proxy_t;\r\n 8 \r\n 9 static int *create(proxy_t **proxy)\r\n10 {\r\n11     if (*proxy == NULL) {\r\n12         proxy_t *p = (proxy_t *)malloc(sizeof (proxy_t));\r\n13         p->object = (int *)malloc(sizeof (int));\r\n14         p->refcnt = 1;\r\n15         *proxy = p;\r\n16     } else {\r\n17         ((*proxy)->refcnt)++;\r\n18     }\r\n19 \r\n20     return (*proxy)->object;\r\n21 }\r\n22 \r\n23 static void destroy(proxy_t *proxy)\r\n24 {\r\n25     (proxy->refcnt)--;\r\n26 \r\n27     if (proxy->refcnt == 0) {\r\n28         free(proxy->object);\r\n29         free(proxy);\r\n30     }\r\n31 }\r\n32 \r\n33 static void dump(proxy_t *proxy, int i)\r\n34 {\r\n35     printf(\"%02d\\tobject: %p (0x%02x) refcnt: %d\\n\", i,\r\n36         proxy->object, *(proxy->object), proxy->refcnt);\r\n37 }\r\n38 \r\n39 int main(int argc, char *argv[])\r\n40 {\r\n41     proxy_t *proxy = NULL;\r\n42 #define NEW()        create(&proxy)\r\n43 #define DELETE(p)    do { destroy(proxy); p = NULL; } while (0)\r\n44 #define DUMP(i)      dump(proxy, i)\r\n45     int *p1 = NEW();\r\n46     int *p2 = NEW();\r\n47     *p1  = 0xab; DUMP(1);\r\n48     DELETE(p1);  DUMP(2);\r\n49     *p2 += 0x21; DUMP(3);\r\n50     DELETE(p2);  DUMP(4);\r\n51     return (0);\r\n52 }<\/pre>\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n<\/div>\n
o \u7f16\u8bd1\u5e76\u6267\u884c<\/p>\n
\n
$ gcc -Wall -m32 -g -o foo3 foo3.c\r\n$ .\/foo3\r\n01    object: 0x8d0d018 (0xab) refcnt: 2\r\n02    object: 0x8d0d018 (0xab) refcnt: 1\r\n03    object: 0x8d0d018 (0xcc) refcnt: 1\r\n04    object: 0x8d0d010 (0x00) refcnt: 0<\/pre>\n<\/div>\n
\u4e00\u53e5\u8bdd\u603b\u7ed3\uff1a<\/strong>\u00a0\u660e\u767d\u4e86\u91ce\u6307\u9488\u548c\u60ac\u7a7a\u6307\u9488\u7684\u5f62\u6210\u539f\u7406\u53ca\u5176\u5371\u5bb3\uff0c\u90a3\u4e48\u5728\u7f16\u7a0b\u7684\u65f6\u5019\u5c31\u80fd\u6709\u7684\u653e\u77e2\uff0c\u5199\u51fa\u5b89\u5168\u53ef\u63a7\u7684\u4f18\u8d28\u4ee3\u7801\u3002<\/p>\n
\u9644\uff1a<\/strong>\u00a0\u5173\u4e8ewild pointer\uff08\u91ce\u6307\u9488\uff09\u548cdangling pointer(\u60ac\u7a7a\u6307\u9488), \u8fd9\u91cc\u63f4\u5f15\u4e00\u6bb5\u6765\u81eayahoo answer\u7684\u89e3\u91ca<\/a>\u4ee5\u5e2e\u52a9\u66f4\u597d\u7684\u7406\u89e3\u3002<\/p>\n
\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n
A dangling pointer is a pointer that used to point to a valid address but now no longer does.<\/strong><\/p>\n
 This is usually due to that memory location being freed up and \r\nno longer available. There is nothing wrong with having a dangling pointer \r\nunless you try to access the memory location pointed at by that pointer. \r\n<\/pre>\n
It is always best practice not to have or leave dangling pointers.<\/strong><\/p>\n
\r\n<\/pre>\n
A wild pointer is a pointer that has not been correctly initialized and therefore points to some random piece of memory. It is a serious error to have wild pointers.<\/strong><\/p>\n
\"\u590d\u5236\u4ee3\u7801\"<\/a><\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
1. \u4ec0\u4e48\u662f\u91ce\u6307\u9488(wild point<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[],"tags":[119],"class_list":["post-2587","post","type-post","status-publish","format-standard","hentry","tag-03-"],"_links":{"self":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/2587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/comments?post=2587"}],"version-history":[{"count":0,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/2587\/revisions"}],"wp:attachment":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/media?parent=2587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/categories?post=2587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/tags?post=2587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}