双重释放或损坏（输出） fclose

Question

*** glibc detected *** /home/ghoshs/workspace/Simulator/Debug/Simulator: double free or corruption (out): 0x00000000017e6030 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7e626)[0x7f34b8553626]
/lib/x86_64-linux-gnu/libc.so.6(fclose+0x155)[0x7f34b85432a5]
/home/ghoshs/workspace/Simulator/Debug/Simulator[0x40e7bf]
/home/ghoshs/workspace/Simulator/Debug/Simulator[0x40e94a]
/home/ghoshs/workspace/Simulator/Debug/Simulator[0x40e357]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f34b84f676d]
/home/ghoshs/workspace/Simulator/Debug/Simulator[0x405e19]
======= Memory map: ========
00400000-0128c000 r-xp 00000000 08:06 1576650                            /home/ghoshs/workspace/Simulator/Debug/Simulator
0148b000-0148c000 r-xp 00e8b000 08:06 1576650                            /home/ghoshs/workspace/Simulator/Debug/Simulator
0148c000-014bd000 rwxp 00e8c000 08:06 1576650                            /home/ghoshs/workspace/Simulator/Debug/Simulator
014bd000-014c7000 rwxp 00000000 00:00 0 
017e6000-01807000 rwxp 00000000 00:00 0                                  [heap]
7f34b84d5000-7f34b8688000 r-xp 00000000 08:06 4849816                    /lib/x86_64-linux-gnu/libc-2.15.so
7f34b8688000-7f34b8887000 ---p 001b3000 08:06 4849816                    /lib/x86_64-linux-gnu/libc-2.15.so
7f34b8887000-7f34b888b000 r-xp 001b2000 08:06 4849816                    /lib/x86_64-linux-gnu/libc-2.15.so
7f34b888b000-7f34b888d000 rwxp 001b6000 08:06 4849816                    /lib/x86_64-linux-gnu/libc-2.15.so
7f34b888d000-7f34b8892000 rwxp 00000000 00:00 0 
7f34b8892000-7f34b88a7000 r-xp 00000000 08:06 4853364                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f34b88a7000-7f34b8aa6000 ---p 00015000 08:06 4853364                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f34b8aa6000-7f34b8aa7000 r-xp 00014000 08:06 4853364                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f34b8aa7000-7f34b8aa8000 rwxp 00015000 08:06 4853364                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f34b8aa8000-7f34b8ac0000 r-xp 00000000 08:06 4855760                    /lib/x86_64-linux-gnu/libpthread-2.15.so
7f34b8ac0000-7f34b8cbf000 ---p 00018000 08:06 4855760                    /lib/x86_64-linux-gnu/libpthread-2.15.so
7f34b8cbf000-7f34b8cc0000 r-xp 00017000 08:06 4855760                    /lib/x86_64-linux-gnu/libpthread-2.15.so
7f34b8cc0000-7f34b8cc1000 rwxp 00018000 08:06 4855760                    /lib/x86_64-linux-gnu/libpthread-2.15.so
7f34b8cc1000-7f34b8cc5000 rwxp 00000000 00:00 0 
7f34b8cc5000-7f34b8dbe000 r-xp 00000000 08:06 4849815                    /lib/x86_64-linux-gnu/libm-2.15.so
7f34b8dbe000-7f34b8fbd000 ---p 000f9000 08:06 4849815                    /lib/x86_64-linux-gnu/libm-2.15.so
7f34b8fbd000-7f34b8fbe000 r-xp 000f8000 08:06 4849815                    /lib/x86_64-linux-gnu/libm-2.15.so
7f34b8fbe000-7f34b8fbf000 rwxp 000f9000 08:06 4849815                    /lib/x86_64-linux-gnu/libm-2.15.so
7f34b8fbf000-7f34b8fe1000 r-xp 00000000 08:06 4849818                    /lib/x86_64-linux-gnu/ld-2.15.so
7f34b91bd000-7f34b91c1000 rwxp 00000000 00:00 0 
7f34b91dd000-7f34b91e1000 rwxp 00000000 00:00 0 
7f34b91e1000-7f34b91e2000 r-xp 00022000 08:06 4849818                    /lib/x86_64-linux-gnu/ld-2.15.so
7f34b91e2000-7f34b91e4000 rwxp 00023000 08:06 4849818                    /lib/x86_64-linux-gnu/ld-2.15.so
7fffc3f01000-7fffc3fab000 rwxp 00000000 00:00 0                          [stack]
7fffc3fff000-7fffc4000000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

我正在做一个简单的 FILE* temp_dataset = fopen(dataset_filnames,"w"); 经过几次写操作后，我使用一个简单的方法关闭它 fclose(temp_dataset); 在这一点上，我得到了双重免费损坏错误。在函数中，我只是生成两个随机数，它们将充当源和目标，算法将进一步使用它们在图上查找路线。但那部分完全独立于这部分代码。 （抱歉，不相关的信息堆栈溢出不会让我发布问题。）

void generate_dataset(int number_of_src_dest,
        char dataset_filnames[],NI* network_info, int k, int network_set,int dataset_num)
{
    int i,j;

    printf("Generating Dataset for the Network Set...\n");
    sprintf(dataset_filnames,"src_dest_pair_#nodes_%d_#SDP_%d_NS_%d_DS_%d",NUMBER_OF_NODES,number_of_src_dest,network_set,dataset_num);
    printf("in file.. %s\n",dataset_filnames);
    int temp_topo[NUMBER_OF_NODES][NUMBER_OF_NODES];
    copy_2D_array(NUMBER_OF_NODES,NUMBER_OF_NODES,temp_topo,network_info->topology);
    FILE* temp_dataset = fopen(dataset_filnames,"w");
    int number_of_source_destination_generated = 0;
    int source_destination[_BIG_SIZE][2];
    for (i = 0; i < NUMBER_OF_NODES; ++i)
    {
        for (j = 0; j < NUMBER_OF_NODES; ++j)
        {

            if(i != j)
            {
                int shortestpath[NUMBER_OF_NODES];
                int dist = shortest_path(i,j,temp_topo,shortestpath);
                int paths[K][NUMBER_OF_NODES];
                initialize_two_d_array(K,NUMBER_OF_NODES,paths,-1);
                if(dist>=percentage_of(PERCENTAGE_LOWER_LIMIT,compute_optical_reach()) &&
                                        dist<=percentage_of(PERCENTAGE_UPPER_LIMIT,compute_optical_reach()))
                {
                    int paths_generated = k_shortest_path(i,j,K,
                            paths,temp_topo,compute_optical_reach());
                    if(paths_generated>=K)
                    {
                        source_destination[number_of_source_destination_generated][0] = i;
                        source_destination[number_of_source_destination_generated][1] = j;
                        number_of_source_destination_generated ++;
                    }


                }
            }
        }
    }
    if(number_of_source_destination_generated>=NUMBER_OF_SOURCE_DESTINATION)
    {
        int visited_demand[number_of_source_destination_generated];
        initialize_one_d_array(number_of_source_destination_generated,visited_demand,0);

        for (i = 0; i < NUMBER_OF_SOURCE_DESTINATION; ++i)
        {
            int next_demand = random_in_range(0,number_of_source_destination_generated);
            while(visited_demand[next_demand])
                next_demand = random_in_range(0,number_of_source_destination_generated);
            visited_demand[next_demand] = 1;
            fprintf(temp_dataset,"%d\t%d\n",source_destination[next_demand][0],source_destination[next_demand][1]);
        }
    }

    else
    {
        printf("Number of Source-Destination Pairs Generated: %d\n",number_of_source_destination_generated);
        printf("Cannot generate the required number of SD pairs\nExiting...");
        exit(1);
    }


    printf("Number of Source-Destination Pairs Generated: %d\n",number_of_source_destination_generated);
    printf("Freeing up memory and flushing all buffer...\n");
    fclose(temp_dataset);
    printf("Done Generating data-sets.\n");
}

我意识到，当我打开文件时，network_info 类型为 NI（struct）的数据已损坏。 network 结构有一个代表网络的二维数组。打开文件后，我看到数组中引入了垃圾值。 network_info 的大小使用(NI*) malloc(sizeof(NI*)) 进行初始化。

Answer 1

根据我的经验，双重释放或损坏错误通常是代码中更早出现错误的症状。我注意到您有以下 sn-ps 代码：

    int number_of_source_destination_generated = 0;
    int source_destination[NUMBER_OF_SOURCE_DESTINATION][2];

在循环内：

source_destination[number_of_source_destination_generated][0] = i;
source_destination[number_of_source_destination_generated][1] = j;
number_of_source_destination_generated ++;

您如何保证 number_of_source_destination_generated 始终小于 NUMBER_OF_SOURCE_DESTINATION？特别是你以后有：

if(number_of_source_destination_generated>=NUMBER_OF_SOURCE_DESTINATION)
{

这是不产生错误的情况。这使我相信小写变量应该大于大写变量。因此，我相信这意味着您正在写入未分配给您想要的数组的内存。这可能会在以后引起问题，可能是您要询问的问题。如果我这样做，我的实现不会总是向我抱怨，所以如果你的实现类似，你不能依赖编译器来捕获这些错误。

我还很缺乏经验，所以请带着怀疑的态度接受这个建议（你总是应该这样做的）。

编辑：我刚刚点击了“显示更多 cmets”，这已经得到解决。所以，这里没有什么新鲜事。