Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>There are runtime based solutions which instrument the code to check invalid pointer accesses. I've only used mudflap so far (which is integrated in GCC since version 4.0). mudflap tries to track each pointer (and reference) in the code and checks each access if the pointer/reference actually points to an alive object of its base type. Here is an example:</p> <pre><code>#include &lt;stdio.h&gt; struct S { S(int &amp; value): value_(value) {} int &amp; value_; }; S function() { int value = 0; return S(value); // implicitly returning reference to local value } int main() { S x=function(); printf("%s\n",x.value_); //&lt;-oh noes! } </code></pre> <p>Compile this with mudflap enabled:</p> <pre><code>g++ -fmudflap s.cc -lmudflap </code></pre> <p>and running gives:</p> <pre><code>$ ./a.out ******* mudflap violation 1 (check/read): time=1279282951.939061 ptr=0x7fff141aeb8c size=4 pc=0x7f53f4047391 location=`s.cc:14:24 (main)' /opt/gcc-4.5.0/lib64/libmudflap.so.0(__mf_check+0x41) [0x7f53f4047391] ./a.out(main+0x7f) [0x400c06] /lib64/libc.so.6(__libc_start_main+0xfd) [0x7f53f358aa7d] Nearby object 1: checked region begins 332B before and ends 329B before mudflap object 0x703430: name=`argv[]' bounds=[0x7fff141aecd8,0x7fff141aece7] size=16 area=static check=0r/0w liveness=0 alloc time=1279282951.939012 pc=0x7f53f4046791 Nearby object 2: checked region begins 348B before and ends 345B before mudflap object 0x708530: name=`environ[]' bounds=[0x7fff141aece8,0x7fff141af03f] size=856 area=static check=0r/0w liveness=0 alloc time=1279282951.939049 pc=0x7f53f4046791 Nearby object 3: checked region begins 0B into and ends 3B into mudflap dead object 0x7089e0: name=`s.cc:8:9 (function) int value' bounds=[0x7fff141aeb8c,0x7fff141aeb8f] size=4 area=stack check=0r/0w liveness=0 alloc time=1279282951.939053 pc=0x7f53f4046791 dealloc time=1279282951.939059 pc=0x7f53f4046346 number of nearby objects: 3 Segmentation fault </code></pre> <p>A couple of points to consider: </p> <ol> <li>mudflap can be fine tuned in what exactly it should check and do. read <a href="http://gcc.gnu.org/wiki/Mudflap_Pointer_Debugging" rel="noreferrer">http://gcc.gnu.org/wiki/Mudflap_Pointer_Debugging</a> for details.</li> <li>The default behaviour is to raise a SIGSEGV on a violation, this means you can find the violation in your debugger. </li> <li>mudflap can be a bitch, in particular when your are interacting with libraries that are not compiled with mudflap support. </li> <li>It wont't bark on the place where the dangling reference is created (return S(value)), only when the reference is dereferenced. If you need this, then you'll need a static analysis tool. </li> </ol> <p>P.S. one thing to consider was, to add a <strong>NON-PORTABLE</strong> check to the copy constructor of S(), which asserts that value_ is not bound to an integer with a shorter life span (for example, if *this is located on an "older" slot of the stack that the integer it is bound to). This is higly-machine specific and possibly tricky to get right of course, but should be OK as long it's only for debugging.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload