runtime-error - 地址 sanitizer : heap-use-after-free ANSI C

Question

当我尝试清除链接列表时出现此错误

=================================================================
==4574==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000050 at pc 0x7fcb73b40682 bp 0x7ffffcfd8370 sp 0x7ffffcfd8368
READ of size 8 at 0x603000000050 thread T0
    #0 0x7fcb73b40681 in clear_dict ../src/utils_dict.c:83
    #1 0x7fcb73b4193c in morsec ../src/morsec.c:37
    #2 0x7fcb73b419e2 in main ../src/morsec.c:45
    #3 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308
    #4 0x7fcb73b40189 in _start (/mnt/c/Code/WEC-01/morsec+0x2189)

0x603000000050 is located 16 bytes inside of 24-byte region [0x603000000040,0x603000000058)
freed by thread T0 here:
    #0 0x7fcb72e18fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
    #1 0x7fcb73b405d7 in del_node ../src/utils_dict.c:70
    #2 0x7fcb73b40698 in clear_dict ../src/utils_dict.c:84
    #3 0x7fcb73b4193c in morsec ../src/morsec.c:37
    #4 0x7fcb73b419e2 in main ../src/morsec.c:45
    #5 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7fcb72e19330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
    #1 0x7fcb73b40266 in new_node ../src/utils_dict.c:20
    #2 0x7fcb73b416aa in get_dict ../src/parser.c:50
    #3 0x7fcb73b4186d in morsec ../src/morsec.c:19
    #4 0x7fcb73b419e2 in main ../src/morsec.c:45
    #5 0x7fcb72b8409a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../src/utils_dict.c:83 in clear_dict
Shadow bytes around the buggy address:
  0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c067fff8000: fa fa fd fd fd fa fa fa fd fd[fd]fa fa fa 00 00
  0x0c067fff8010: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 06 fa fa 00 00 00 fa
  0x0c067fff8030: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8040: 01 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4574==ABORTING

这是我写的函数，ASAN 说它在 clear_dict 中，我尝试调试它并且 ASAN 仅在运行 clear_dict 的第三或第四次触发，我真的无法解决这个错误

struct s_dict
{
    char            *word;
    char            *symb;
    struct s_dict   *next;
};
typedef struct s_dict t_dict;

t_dict  *new_node(char *word, char *symb)
{
    t_dict  *new;

    new = NULL;
    if (!(new = (t_dict*)malloc(sizeof(t_dict))))
        return (NULL);
    new->word = word;
    new->symb = symb;
    new->next = NULL;
    return (new);
}

void        del_node(t_dict *node)
{
    if (node->word)
        free(node->word);
    node->word = NULL;
    if (node->symb)
        free(node->symb);
    node->symb = NULL;
    if (node->next)
        free(node->next);
    node->next = NULL;
    if (node)
        free(node);
    node = NULL;
}

void        clear_dict(t_dict **chain)
{
    t_dict *tmp;

    while (chain && *chain)
    {
        tmp = (*chain)->next;            << line 83 in my code
        del_node(*chain);
        *chain = tmp;
    }
}

我不知道是什么导致了错误，它说

free(): double free detected in tcache 2
[1]    4601 abort (core dumped)

不使用时 -fsanitize=address

感谢您抽出宝贵时间。

Answer 1

该错误(实际上有几个)在您的 del_node() 中:它不应该触及 next节点。

照原样删除 node->next , 孤儿 node->next->word等，并在下一次迭代中设置双重删除。

附言此检查和分配在 del_node() :

    if (node)         // useless
      free(node);
    node = NULL;      // useless

没用:如果node是 NULL，你早就崩溃了。赋值是无用的，因为它会在从函数返回之前立即修改局部变量。