如何使用 C 中的动态数组解决 realloc() 无效的下一个大小错误？

Question

我将首先声明我对 C 非常陌生，并且在 malloc/realloc 等方面没有太多经验。我目前正在尝试为具有 800 个磁道的磁盘执行此分配模拟磁盘调度 (FCFS)数组作为跟踪请求队列。无论如何，当我运行程序时出现此错误：

`./a.out' 中的错误：realloc()：下一个大小无效：0x0000000000650010 中止

我并不感到惊讶，因为我知道动态数组确实不应该成为一件事，但不幸的是，这就是我的任务必须做的事情。非常感谢任何有关修复此错误的帮助。谢谢！

#include <stdio.h>
#include <math.h>
#include <stdlib.h>
#include <values.h>
#include <time.h>
#include <stdbool.h>

/* function declarations */
int trackReqs();
int numTrack();
void AddToList(int trackNum);
int RemoveFromList();

// global variable declarations/initializations
unsigned seed;
int fileReqs;
bool first = true;
int queue_size = 0;
int* req_queue = NULL; // dynamic array declaration to hold request queue.

void main(){
  printf("Seed for the random number generator: ");
  scanf("%d", &seed);
  srand(seed);
  printf("\n");
  printf("Number of file requests: ");
  scanf("%d", &fileReqs);
  printf("\n");

  req_queue = malloc(sizeof(int)); // allocate memory for the queue array (initially 4 bytes for 1 integer)

  // local variable declarations/initializations
  int totalReqs = 0;
  int numFileReqs = 0;
  float totalHeadMove = 0;
  int currTrack = 0;
  float diff;
  float average;

  do { // do this...
    int numTrackReqs = trackReqs(); // call function to get a random number between 1 and 5 to represent the number of track requests for the current file request
    for (int i = 0; i < numTrackReqs; i++) { // for each track request for the current file request...
      int trackNum = numTrack(); // call function to get a random number between 0 and 799 to represent the number of the track requested
      AddToList(trackNum); // call function to add the track request to the queue
      first = false;
    }
    int nextTrack = RemoveFromList(); // call function to remove the next (first) track request from the queue (signifying that the disk head will be moved to that track) and have that track returned
    diff = abs((float)nextTrack - (float)currTrack); // calculate the head movement for the current file request
    totalHeadMove += diff; // add the head movement for the current file request to the total head movement
    totalReqs++; // increase number of total requests by 1
    currTrack = nextTrack; // make the current track now the next track
    numFileReqs++; // increase number of file requests by 1
  } while(numFileReqs <= fileReqs); // ...for each file request
  average = totalHeadMove / (float) numFileReqs; // calculate the average total head movement for each file request and print the result
  printf("Average head movement: %5.2f", average);
}

int trackReqs(){
  int rand_num = (rand() % (5 - 1 + 1)) + 1; // generate random number from 1 to 5 representing number of track requests for the current file request
  return rand_num;
}

int numTrack(){
  int rand_num = rand() % 800; // generate random number from 0 to 799 representing
  return rand_num;
}

void AddToList(int trackNum){
  if(first != true){ // if it is not the first request being added to the queue...
    realloc(req_queue, sizeof(req_queue) + sizeof(int)); // increase capacity of queue array by 4 bytes (for 1 more integer)
    queue_size++; // increase size of queue by 1
  }
  req_queue[queue_size] = trackNum; // add request to the end of the queue
  return;
}

int RemoveFromList(){
  int first_req = req_queue[0]; // get first request in the queue
  if(queue_size == 0){ // if there is only 0 or 1 request in the queue...
    req_queue[0] = NULL; // make queue empty
  }
  else{
    for(int i = 0; i < queue_size - 1; i++){ // for each request in the queue...
      req_queue[i] = req_queue[i + 1]; // move up 1 position in the queue
    }
    realloc(req_queue, sizeof(req_queue) - sizeof(int)); // decrease capacity of queue array by 4 bytes (for 1 integer)
    queue_size--; // decrease size of queue by 1
  }
  return first_req;
}

Answer 1

根据男人的说法：

void *realloc(void *ptr, size_t size); [...]

realloc() 函数返回一个指向新分配内存的指针，该指针适合任何内置类型，并且可以是 与 ptr 不同，如果请求失败，则为 NULL。

你的电话是

realloc(req_queue, sizeof(req_queue) + sizeof(int))

因此您只需删除 realloc 的结果，并且由于旧指针可能变得无效，您正在访问无效内存。

在我的机器上，编译器警告过它：

 In function 'AddToList':
test.c:70:5: warning: ignoring return value of 'realloc', declared with attribute warn_unused_result [-Wunused-result]
   70 |     realloc(req_queue, sizeof(req_queue) + sizeof(int)); // increase capacity of queue array by 4 bytes (for 1 more integer)
      |     

^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~

顺便说一句，sizeof(req_queue)可能不符合您的预期，它返回 req_queue 的大小，它是一个指针，因此很可能是 4 或 8（取决于您的系统）

编辑： 当您询问更多详细信息时，这里是您的 add 函数的示例：

void AddToList(int trackNum) {
    int *temp = realloc(req_queue, (queue_size + 1) * sizeof(int));
    if (temp != NULL) 
        req_queue = temp;
    else 
        return; // FIXME would need to handle error correctly here

    queue_size++; // increase size of queue by 1
    req_queue[queue_size - 1] = trackNum; // add request to the end of the queue
    return;
}

这里有两点很重要： * 你需要一个临时的来获得 realloc 的返回值，因为如果分配失败，你需要保持旧的指针仍然有效（见realloc(): invalid next size - realloc dynamic struct） * 您需要跟踪您已经分配的 size，因此这里 queue_size 可以，但您可能会注意到，当您将它用作数组中的索引时，我将它用作大小。

你不能（在标准 C 中）知道你直接从指针分配的内存块的大小，你需要自己跟踪这个大小。 （在 BSD 上，有非标准 malloc_size() AFAIR）