Labview Resized Pic Becomes Big Again When Passed Out of Subvi

Debugging Segmentation Faults and Pointer Problems

Past Alex Allain

For new programmers, debugging errors associated with pointers can be a nightmare. "Segmentation Error (cadre dumped)" is a pretty vague error message, and it's fifty-fifty worse when foreign bugs commencement actualization that don't cause segmentation faults -- but that result in things like retentiveness getting overwritten in unexpected ways. Fortunately, tools like Cee Studio, from our sponsor, provide new, easier ways to debug retentivity errors and buffer overflows. Cee Studio is a web-based compiler designed to make finding segfaults easy by providing instant and informative feedback on misuses of memory. Only even without specialized tools, finding issues with pointers is easier than you think.

This tutorial assumes that you take a basic knowledge of pointers such as can be acquired by reading a pointer tutorial. It would help to exist running a system that has a debugger such as GDB, or to at to the lowest degree take sufficient familiarity with GDB-like debuggers to sympathize the examples presented.

What is a sectionalisation fault?

When your plan runs, it has access to certain portions of memory. First, you have local variables in each of your functions; these are stored in the stack. 2nd, yous may have some memory, allocated during runtime (using either malloc, in C, or new, in C++), stored on the heap (yous may too hear it called the "complimentary store"). Your program is only allowed to touch memory that belongs to it -- the retentiveness previously mentioned. Whatever access exterior that surface area will cause a segmentation fault. Division faults are commonly referred to equally segfaults.

There are iv common mistakes that lead to segmentation faults: dereferencing Nada, dereferencing an uninitialized pointer, dereferencing a pointer that has been freed (or deleted, in C++) or that has gone out of scope (in the example of arrays declared in functions), and writing off the terminate of an array.

A fifth way of causing a segfault is a recursive function that uses all of the stack space. On some systems, this will crusade a "stack overflow" study, and on others, it will merely announced as some other type of segmentation fault.

The strategy for debugging all of these problems is the aforementioned: load the core file into GDB, exercise a backtrace, motility into the scope of your code, and list the lines of code that caused the segmentation fault.

For instance, running on a Linux system, hither's an example session:

% gdb instance core        

This just loads the program called example using the core file called "core". The core file contains all the information needed by GDB to reconstruct the country of execution when the invalid functioning caused a segmentation fault.

Once we've loaded up gdb, we get the post-obit:

Some copyright info  Core was generated past `example'. Program terminated with signal 11, Partition fault.  Some information about loading symbols #0  0x0804838c in foo() () at t.cpp:4 4           *x = 3;        

So, execution stopped inside the function called foo() on line 4, which happened to be the assignment of the number 3 to the location pointed to past x. This is a goldmine of data: nosotros already know exactly where the problem happened and which pointer was involved.

(gdb) list 1       void foo() two       { 3           char *ten = 0; 4           *x = 3; 5       } 6        seven       int chief() 8       { nine           foo(); 10          return 0; (gdb)        

Since this is a somewhat contrived instance, we can immediately notice the error. The pointer x is initialized to 0, equivalent to Naught (in fact, Null is a stand-in for 0), and we know that information technology's a no-no to then try to access that arrow.

Only what if it weren't so obvious? Simply printing the value of the pointer can often lead to the solution. In this case:

(gdb) print ten $i = 0x0        

Printing out 10 reveals that it points to retentiveness address 0x0 (the 0x indicates that the value following it is in hexadecimal, traditional for printing memory addresses). The address 0x0 is invalid -- in fact, it's NULL. If you dereference a arrow that stores the location 0x0 and then you'll definitely go a partitioning mistake, just as we did.

If we'd gotten something more than complicated, such as execution crashing inside a arrangement phone call or library function (perhaps because we passed an uninitialized arrow to fgets), we'd need to effigy out where nosotros chosen the library function and what might have happened to crusade a segfault within it. Here's an example from another debugging session:

#0  0x40194f93 in strcat () from /lib/tls/libc.so.half-dozen (gdb)        

This fourth dimension, the segfault occurred because of something within strcat. Does this hateful the library function did something wrong? Nope! It ways that we probably passed a bad value to the function. To debug this, we need to see what we passed into strcat.

So allow'due south see what function call we fabricated that led to the segfault.

(gdb) backtrace #0  0x40194f93 in strcat () from /lib/tls/libc.so.vi #1  0x080483c9 in foo() () at t.cpp:half-dozen #two  0x080483e3 in main () at t.cpp:11 (gdb)        

Backtrace lists the part calls that had been made at the time the program crashed. Each part is straight above the role that called it. So foo was called by principal in this case. The numbers on the side (#0, #ane, #two) also signal the order of calls, from almost recent to longest ago.

To move from viewing the state within each function (encapsulated in the idea of a stack frame), we tin employ the up and down commands. Correct at present, we know nosotros're in the strcat stack frame, which contains all of the local variables of strcat, because it's the top function on the stack. We want to move "up" (toward the college numbers); this is the opposite of how the stack is printed.

(gdb) up #1  0x080483c9 in foo() () at t.cpp:6 half-dozen           strcat(x, "end"); (gdb)        

This helps a little -- we know that nosotros take a variable chosen ten and a constant string. We should probably lookup the strcat function at this indicate to make sure that nosotros got the order of arguments correct. Since we did, the problem must be with x.

(gdb) impress x $1 = 0x0        

At that place it is again: a NULL pointer. The strcat part must be derefencing a Cipher pointer that nosotros gave it, and even though it's a library part, it doesn't do annihilation magical.

NULL pointers are generally pretty easy to piece of work with -- once nosotros've plant 1, nosotros know that somewhere along the line, nosotros didn't allocate some memory that we should take. It's only a question of where. A common mistake is to not check the return from malloc to make sure that the system isn't out of memory. Another common fault is to presume that a role that calls malloc doesn't render Zero even though information technology returns the result of malloc. Note that in C++, when you call new, it will throw an exception, bad_alloc, if sufficient memory cannot be allocated. Your lawmaking should exist prepared to handle this situation cleanly, and if yous choose to take hold of the exception and return NULL inside a function that ordinarily returns a new'ed arrow, this communication all the same holds.

char *create_memory() {     char *ten = malloc(10);     if(10 == Zero)     {         return Aught;     }     strcpy(x, "a cord");     return x; }  void use_memory() {     char *new_memory = create_memory();     new_memory[0] = 'A'; /* make it a capital letter */ }        

Nosotros did a adept thing past checking to make sure that malloc succeeds before using the retentiveness in create_memory, but nosotros don't check to brand sure that create_memory returns a valid pointer! Shame on us. This is a issues that won't take hold of you until you lot're running your code on a real system unless you explicitly test your code in low memory situations.

Dereferencing an Uninitialized Pointer

Figuring out whether or non a pointer has been initialized is a chip harder than figuring out whether a pointer is NULL. The best fashion to avoid using an uninitialized arrow is to set your pointers to NULL when you declare them (or immediately initialize them). That mode, if yous practice use a arrow that hasn't had retentivity allocated for it, you volition immediately be able to tell.

If you don't gear up your pointers to Aught when you declare them, then y'all'll take a much harder fourth dimension of information technology (remember that non-static variables aren't automatically initialized to anything in C or C++). You might need to figure out if 0x4025e800 is valid memory. Ane way you can go a sense of this in GDB is by printing out the addresses stored in other pointers you've allocated. If they're fairly close together, you've probably correctly allocated memory. Of grade, there'south no guarantee that this rule of thumb volition concur on all systems.

In some cases, your debugger can tell you lot that an address is invalid based on the value stored in the pointer. For instance, in the post-obit instance, GDB indicates that the char* 10, which I ready to point to the memory accost "30", is non accessible.

(gdb) impress x $1 = 0x1e <out of premises> (gdb) print *ten Cannot access memory at address 0x1e        

Mostly, though, the best way to handle such a situation is simply to avoid having to rely on memory's beingness shut together or evidently invalid. Set your variables to Nix from the beginning.

Dereferencing Freed Retention

This is another tricky bug to notice because yous're working with retentivity addresses that look valid. The best way to handle such a situation is once again preventative: set up your pointer to point to Null as soon as you've freed information technology. That way, if you lot practice try to use it later, so yous'll have another "dereferencing Cypher" bug, which should be much easier to track.

Some other form of this bug is the trouble of dealing with retentiveness that has gone out of scope. If y'all declare a local array such equally

char *return_buffer() {     char x[10];     strncpy(x, "a cord", sizeof(x));     return x; }        

and then the array, ten, volition no longer be valid once the part returns. This is a really tricky bug to observe because once again the retentiveness address volition look valid when yous print it out in GDB. In fact, your code might fifty-fifty work sometimes (or simply brandish weird behavior by press whatsoever happens to be on the stack in the location that used to be the memory of the array 10). Generally, the style you'll know if yous take this kind of bug is that you lot'll get garbage when you print out the variable even though you lot know that it's initialized. Scout out for the pointers returned from functions. If that arrow is causing you trouble, check the function and await for whether the arrow is pointing to a local variable in the function. Note that information technology is perfectly fine to return a pointer to retentivity allocated in the role using new or malloc, but not to render a arrow to a statically alleged assortment (e.yard., char 10[ten]).

Tools such as Valgrind tin can exist immensely helpful in tracking downward these bugs because they watch memory to ensure that information technology's valid. If it isn't, Valgrind volition alarm yous. Our Valgrind tutorial goes into more particular about finding this sort of bug.

Of course, the best solution is merely to avoid ever doing anything like this. Technically, yous could use a static buffer, which would allow you lot to have a permanent buffer yous could pass around. But this is simply asking for trouble if y'all later make up one's mind, for whatever reason, that you lot don't need it to be static (if you forget why you made information technology static in the start place, for case).

Writing off the stop of the array

More often than not, if you're writing off the bounds of an array, and then the line that caused the segfault in the first place should be an array admission. (There are a few times when this won't actually be the case -- notably, if the fact that y'all wrote off an array causes the stack to exist smashed -- basically, overwriting the pointer that stores where to return later on the role completes.)

Of course, sometimes, you won't actually cause a segfault writing off the end of the array. Instead, you might just notice that some of your variable values are changing periodically and unexpectedly. This is a tough bug to scissure; one option is to prepare up your debugger to watch a variable for changes and run your program until the variable's value changes. Your debugger volition break on that instruction, and you tin can poke around to figure out if that behavior is unexpected.

(gdb) watch [variable name] Hardware watchpoint 1: [variable name] (gdb) keep ... Hardware watchpoint 1: [variable name]  Old value = [value1] New value = [value2]        

This approach can get catchy when you're dealing with a lot of dynamically allocated memory and it'due south non entirely clear what you lot should watch. To simplify things, use simple test cases, continue working with the same inputs, and turn off randomized seeds if you're using random numbers!

Stack Overflows

A stack overflow isn't the same type of pointer-related trouble equally the others. In this case, you don't need to have a single explicit pointer in your programme; you lot merely need a recursive function without a base of operations example. However, this is a tutorial about segmentation faults, and on some systems, a stack overflow will be reported every bit a segmentation fault. (This makes sense because running out of memory on the stack will violate retentivity partition.)

To diagnose a stack overflow in GDB, typically you just need to practice a backtrace:

(gdb) backtrace #0  foo() () at t.cpp:5 #1  0x08048404 in foo() () at t.cpp:5 #2  0x08048404 in foo() () at t.cpp:5 #3  0x08048404 in foo() () at t.cpp:five [...] #20 0x08048404 in foo() () at t.cpp:5 #21 0x08048404 in foo() () at t.cpp:5 #22 0x08048404 in foo() () at t.cpp:5 ---Type                      to go along, or q                          to quit---                              

If you notice a unmarried function call piling upwards an awfully large number of times, this is a good indication of a stack overflow.

Typically, you demand to analyze your recursive function to brand certain that all the base cases (the cases in which the function should not phone call itself) are covered correctly. For instance, in computing the factorial function

int factorial(int n) {     // What about n < 0?     if(due north == 0)     {         render 1;     }     return factorial(n-ane) * n; }        

In this example, the base of operations instance of n being zero is covered, but what most n < 0? On "valid" inputs, the function will work fine, but not on "invalid" inputs like -1.

You also have to make certain that your base of operations case is reachable. Fifty-fifty if yous take the correct base case, if you don't correctly progress toward the base case, your role will never terminate.

int factorial(int n) {     if(n <= 0)     {         return 1;     }     // Ooops, nosotros forgot to subtract 1 from n     return factorial(northward) * n; }        

Summary

While segmentation faults tin can be nasty and difficult to rails downwards when y'all are outset learning to program, over time you volition kickoff to see them as falling into a small number of patterns that are relatively easy to track down. This tutorial hasn't covered every possible scenario for causing partitioning faults, but it touches on many of the bones problems yous may come across.

---

Related articles

Read more than about debugging strategies

Learn more about using GDB

Using Valgrind to hunt retentiveness errors

Read more than about the psychological aspects of programming

Learn more about secure coding and avoiding pointer bug

mintermaland64.blogspot.com

Source: https://www.cprogramming.com/debugging/segfaults.html

Share this post