我怎么在这里错误地使用malloc？

Question

我正在尝试学习如何在C99中在运行时正确分配内存。

我写的只是一个很小的例子，因为我认为这对我要做的事情有启发意义。由于某种原因，“内部”调用malloc，其中分配大小为sizeof(letter_t)的内存块仅执行我期望的（即，为数组中的第一个元素分配内存）。

#include <stdlib.h>
#include <stdio.h>

typedef struct letter_t {
    char *from;
    int lines;
} letter_t;

typedef struct letterbox_t {
    char *name;
    int n_letters;
    struct letter_t **letters;
} letterbox_t;

int main() {

    char *name[]    = { "amy", "bob", "claud" };
    int n_letters[] = { 1,     3,     2 };

    // layout memory and populate letterbox_t array
    struct letterbox_t *letterboxes;
    letterboxes = malloc(sizeof(letterbox_t) * 3);

    for (int i = 0; i < 3; i++) {
        letterboxes[i].name = name[i];
        letterboxes[i].n_letters = n_letters[i];

        struct letter_t *letters[n_letters[i]];
        for (int j = 0; j < n_letters[i]; j++) {
            letters[j] = malloc(sizeof(letter_t));
        }
        letterboxes[i].letters = letters;
    }

    // populate letter_t array for each letterbox_t
    for (int i = 0; i < 3; i++) {
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            // =========================================
            letterboxes[i].letters[j]->from = "spammer";
            // =========================================
            // the above line fails for i = 1, j = 1
        }
    }

    for (int i = 0; i < 3; i++) {
        printf("%s has %d letters from\n", letterboxes[i].name, letterboxes[i].n_letters);
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            printf("  %s\n", letterboxes[i].letters[j]->from);
        }
    }
    return 0;
};

当内环上的j到达1时，我看到的只是垃圾记忆。这里有一些GDB输出作为说明。

Breakpoint 1, main () at example.c:40
40            letterboxes[i].letters[j]->from = "spammer";
(gdb) p i
$1 = 1
(gdb) p j
$2 = 1
(gdb) p letterboxes[i].letters[j]
$3 = (struct letter_t *) 0x400604 <main+228>
(gdb) p *letterboxes[i].letters[j]
$4 = {from = 0x904d8b48ac7d6348 <error: Cannot access memory at address 0x904d8b48ac7d6348>, lines = -117143224}

Answer 1

你有很多小问题。首先，如我的评论所述，您为struct letter_t* letters[n_letters[i]];分配的尝试与struct letter_t** letters;不匹配

接下来，在进一步讨论之前，'*'属于变量名，而不是大多数情况下的类型。为什么？

int* a, b, c;

在上面，你肯定不会向int宣布三分球。相反，你声明整数指针a和整数b, c。更清楚的写作：

int *a, b, c;

分配内存时，必须验证分配是否成功 - 每次，例如，

    size_t n_people = sizeof name / sizeof *name;

    // layout memory and populate letterbox_t array
    struct letterbox_t *letterboxes;
    /* allocate letterboxes for each of the people */
    letterboxes = malloc (sizeof *letterboxes * n_people);
    if (!letterboxes) {     /* validate Every allocation */
        perror ("malloc-letterboxes");
        return 1;
    }

您现在已经分配了3个letterbox_t的存储空间，并且可以开始处理内容。您可以为每个分配名称和字母数：

    for (size_t i = 0; i < n_people; i++) {

        /* assigning pointer to string literal */
        letterboxes[i].name = name[i];
        letterboxes[i].n_letters = n_letters[i];    /* int assignment */

（注意：小心。了解你正在将name[i]中的String Literal分配给每个letterboxes[i].name。这意味着letterboxes[i].name无法修改且不应被释放。通常你应该为name分配存储并复制）

letterboxes[i].letters是指向letter_t的指针。这意味着您必须首先分配指针，然后为每个letter分配存储空间，并将该存储器块的起始地址分配给每个指针，例如： letterboxes[i].letters[j]。例如：

        /* allocate letterboxes[i].n_letters pointers */
        letterboxes[i].letters =
            malloc (sizeof *letterboxes[i].letters * letterboxes[i].n_letters);
        if (!letterboxes[i].letters) { /* validate allocation */
            perror ("malloc-letterboxes.letters");
            return 1;
        }

        /* allocate letters per-pointer */
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            letterboxes[i].letters[j] = 
                            malloc (sizeof *letterboxes[i].letters[j]);
            if (!letterboxes[i].letters[j]) {
                perror ("malloc-letterboxes[i].letters[j]");
                return 1;
            }
        }

现在，您的所有存储都已正确分配和验证，您可以将每个字母填充给每个人，然后输出结果，例如

    // populate letter_t array for each letterbox_t
    for (size_t i = 0; i < n_people; i++) {
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            letterboxes[i].letters[j]->from = "spammer";
            /* added lines just to complete assignments */
            letterboxes[i].letters[j]->lines = letterboxes[i].n_letters * 10;
        }
    }

    // output all letterboxes and letters
    for (size_t i = 0; i < n_people; i++) {
        printf("%s has %d letters from\n", 
                        letterboxes[i].name, letterboxes[i].n_letters);
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            printf("  %s  %d\n", letterboxes[i].letters[j]->from,
                                letterboxes[i].letters[j]->lines);
        }
    }

完成使用已分配的内存后，您可以看到它已正确释放。 （当你的程序增长并开始在函数内分配时，这变得至关重要）。未能释放您使用的内容会导致程序中的内存泄漏。为此，编写一个简单的函数来完全释放letterbox_t是有意义的，例如

/* simple function to free single letterbox_t completely */
void freeletterbox (letterbox_t *l)
{
    for (int i = 0; i < l->n_letters; i++)
        free (l->letters[i]);

    free (l->letters);
}

然后，当你完成了记忆，你可以free()它，例如，

    for (size_t i = 0; i < n_people; i++)   /* free each letterbox */
        freeletterbox (&letterboxes[i]);
    free (letterboxes);                     /* free pointers */

完全放在一起，你可以这样做：

#include <stdio.h>
#include <stdlib.h>

typedef struct letter_t {
    char *from;
    int lines;
} letter_t;

typedef struct letterbox_t {
    char *name;
    int n_letters;
    struct letter_t **letters;
} letterbox_t;

/* simple function to free single letterbox_t completely */
void freeletterbox (letterbox_t *l)
{
    for (int i = 0; i < l->n_letters; i++)
        free (l->letters[i]);

    free (l->letters);
}

int main (void) {

    char *name[]    = {"amy", "bob", "claud"};
    int n_letters[] = {1,     3,     2};
    size_t n_people = sizeof name / sizeof *name;

    // layout memory and populate letterbox_t array
    struct letterbox_t *letterboxes;
    /* allocate letterboxes for each of the people */
    letterboxes = malloc (sizeof *letterboxes * n_people);
    if (!letterboxes) {     /* validate Every allocation */
        perror ("malloc-letterboxes");
        return 1;
    }

    for (size_t i = 0; i < n_people; i++) {

        /* assigning pointer to string literal */
        letterboxes[i].name = name[i];
        letterboxes[i].n_letters = n_letters[i];    /* int assignment */

        /* allocate letterboxes[i].n_letters pointers */
        letterboxes[i].letters =
            malloc (sizeof *letterboxes[i].letters * letterboxes[i].n_letters);
        if (!letterboxes[i].letters) { /* validate allocation */
            perror ("malloc-letterboxes.letters");
            return 1;
        }

        /* allocate letters per-pointer */
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            letterboxes[i].letters[j] = 
                            malloc (sizeof *letterboxes[i].letters[j]);
            if (!letterboxes[i].letters[j]) {
                perror ("malloc-letterboxes[i].letters[j]");
                return 1;
            }
        }
    }

    // populate letter_t array for each letterbox_t
    for (size_t i = 0; i < n_people; i++) {
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            letterboxes[i].letters[j]->from = "spammer";
            /* added lines just to complete assignments */
            letterboxes[i].letters[j]->lines = letterboxes[i].n_letters * 10;
        }
    }

    // output all letterboxes and letters
    for (size_t i = 0; i < n_people; i++) {
        printf("%s has %d letters from\n", 
                        letterboxes[i].name, letterboxes[i].n_letters);
        for (int j = 0; j < letterboxes[i].n_letters; j++) {
            printf("  %s  %d\n", letterboxes[i].letters[j]->from,
                                letterboxes[i].letters[j]->lines);
        }
    }

    for (size_t i = 0; i < n_people; i++)   /* free each letterbox */
        freeletterbox (&letterboxes[i]);
    free (letterboxes);                     /* free pointers */

    return 0;
}

示例使用/输出

$ ./bin/letters
amy has 1 letters from
  spammer  10
bob has 3 letters from
  spammer  30
  spammer  30
  spammer  30
claud has 2 letters from
  spammer  20
  spammer  20

内存使用/错误检查

在您编写的任何动态分配内存的代码中，您对分配的任何内存块都有2个职责：（1）始终保留指向内存块起始地址的指针，因此，（2）当它为no时可以释放它需要更久。

您必须使用内存错误检查程序，以确保您不会尝试访问内存或写入超出/超出已分配块的范围，尝试读取或基于未初始化值的条件跳转，最后，确认你释放了你分配的所有内存。

对于Linux，valgrind是正常的选择。每个平台都有类似的记忆检查器。它们都很简单易用，只需通过它运行程序即可。

$ valgrind ./bin/letters
==4735== Memcheck, a memory error detector
==4735== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==4735== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==4735== Command: ./bin/letters
==4735==
amy has 1 letters from
  spammer  10
bob has 3 letters from
  spammer  30
  spammer  30
  spammer  30
claud has 2 letters from
  spammer  20
  spammer  20
==4735==
==4735== HEAP SUMMARY:
==4735==     in use at exit: 0 bytes in 0 blocks
==4735==   total heap usage: 10 allocs, 10 frees, 216 bytes allocated
==4735==
==4735== All heap blocks were freed -- no leaks are possible
==4735==
==4735== For counts of detected and suppressed errors, rerun with: -v
==4735== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

始终确认已释放已分配的所有内存并且没有内存错误。

仔细看看，如果您有其他问题，请告诉我。

Answer 2

改变这个：

struct letter_t* letters[n_letters[i]];

对此：

struct letter_t** letters = malloc(n_letters[i] * sizeof(struct letter_t*));

因为，正如@TomKarzes评论的那样，你在for循环体内创建了letters，因此一旦循环结束它就会超出范围。

因此，您需要为其动态分配内存，以便在循环终止后不会释放内存。

PS：不要忘记在程序结束时按照与动态内存分配时的顺序相反的顺序释放内存。