错误消息：*** 检测到 glibc *** ./cube：双重释放或损坏 (!prev)：0x0a4c4420 ***

Question

在以下代码中，我收到错误：

333         glGenBuffers(surftotal, uiVBO);
334         {
335                 for(surfnum=0; surfnum<surftotal; ++surfnum)
336                 {
337                         glBindBuffer(GL_ARRAY_BUFFER, uiVBO[surfnum]);
338                         size_t buf_size = 9*sizeof(GLfloat)*triNum[surfnum];
339                         GLfloat* const pData = (GLfloat*)malloc(buf_size);
340                         for(i=0; i<triNum[surfnum]; ++i)
341                                 printf("%d...",triNum[surfnum]);
342                                 {
343                                 memcpy(pData+i*9,   triArray[surfnum][i].pt1, 3*sizeof(GLfloat));
344                                 memcpy(pData+i*9+3, triArray[surfnum][i].pt2, 3*sizeof(GLfloat));
345                                 memcpy(pData+i*9+6, triArray[surfnum][i].pt3, 3*sizeof(GLfloat));
346                                 }
347                                 glBufferData(GL_ARRAY_BUFFER, buf_size, pData, GL_STATIC_DRAW);
348                                 free(pData);
349                 }
350                 glBindBuffer(GL_ARRAY_BUFFER, 0);
351                 glEnableVertexAttribArray(VERTEX_ARRAY);
352                 for(surfnum=0; surfnum<surftotal; ++surfnum)
353                 {
354                         glBindBuffer(GL_ARRAY_BUFFER, uiVBO[surfnum]);
355                         glVertexAttribPointer(VERTEX_ARRAY, 3, GL_FLOAT, GL_FALSE, 0, 0);
356                         glDrawArrays(GL_TRIANGLES, 0, 3*triNum[surfnum]);
357                         if (!TestEGLError("glDrawArrays"))
358                         {
359                         goto cleanup;
360                         }
361                 }
362                 glBindBuffer(GL_ARRAY_BUFFER, 0);
363                 eglSwapBuffers(eglDisplay, eglSurface);
364 
365                 if (!TestEGLError("eglSwapBuffers"))
366                 {
367                         goto cleanup;
368                 }
369 
370                 int i32NumMessages = XPending( x11Display );
371                 for( int i = 0; i < i32NumMessages; i++ )
372                 {
373                         XEvent  event;
374                         XNextEvent( x11Display, &event );
375                 }
376         }
377         glDeleteBuffers(surftotal,uiVBO);

错误如下：

* glibc 检测到 ./cube: free(): 无效指针: 0x090c53a0 **

printf 收到错误，它会写入 7 7 7 7 7 7 7 1 aborted 然后出现此错误。

当我尝试在那里打印时，出现此错误。我尝试使用 valgrind ，它的输出是：

==8922== Memcheck, a memory error detector
==8922== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==8922== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==8922== Command: ./cube
==8922== 
libEGL warning: use software fallback
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391567 is 11 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391566 is 10 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391565 is 9 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A48F: main (Hello.cpp:343)
==8922==  Address 0x9391564 is 8 bytes after a block of size 252 alloc'd
==8922==    at 0x4025BD3: malloc (vg_replace_malloc.c:236)
==8922==    by 0x804A3EC: main (Hello.cpp:339)
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391573 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391572 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391571 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A4E3: main (Hello.cpp:344)
==8922==  Address 0x9391570 is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027418: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157f is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027420: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157e is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027429: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157d is not stack'd, malloc'd or (recently) free'd
==8922== 
==8922== Invalid write of size 1
==8922==    at 0x4027432: memcpy (mc_replace_strmem.c:497)
==8922==    by 0x804A539: main (Hello.cpp:345)
==8922==  Address 0x939157c is not stack'd, malloc'd or (recently) free'd
==8922== 
--8922-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--8922-- si_code=1;  Faulting address: 0xC8B91574;  sp: 0x62a5ce00

valgrind: the 'impossible' happened:
   Killed by fatal signal
==8922==    at 0x38031511: unlinkBlock (m_mallocfree.c:245)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==8922==    at 0x4024F12: calloc (vg_replace_malloc.c:467)
==8922==    by 0x48D068A: softpipe_resource_create (sp_texture.c:114)
==8922==    by 0x4A50D96: st_bufferobj_data (u_inlines.h:180)
==8922==    by 0x4A1BB4E: _mesa_BufferDataARB (bufferobj.c:1177)
==8922==    by 0x49BFFD7: _es_BufferData (api_exec_es2.c:391)
==8922==    by 0x804A561: main (Hello.cpp:347)

但我无法理解它。你能告诉我错误在哪里吗？ 如果我使用

导出MALLOC_CHECK_=0

这会产生分段错误。

（我已经编辑了问题）

Answer 1

for(i=0; i<triNum[surfnum]; ++i)
    printf("%d...",triNum[surfnum]);
    {
    memcpy(pData+i*9,   triArray[surfnum][i].pt1, 3*sizeof(GLfloat));
    memcpy(pData+i*9+3, triArray[surfnum][i].pt2, 3*sizeof(GLfloat));
    memcpy(pData+i*9+6, triArray[surfnum][i].pt3, 3*sizeof(GLfloat));
    }

您在这里的支架放置有问题。只有 printf 位于循环内，因此 memcpy 行只会运行一次，其值为 i太大了。

这将覆盖缓冲区边界之外的内存，从而导致您看到的内存损坏错误。