To use this tool, you may specify

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

0 on the Valgrind command line. You don't have to, though, since Memcheck is the default tool.

4.1. Overview

Memcheck is a memory error detector. It can detect the following problems that are common in C and C++ programs.

• Accessing memory you shouldn't, e.g. overrunning and underrunning heap blocks, overrunning the top of the stack, and accessing memory after it has been freed.
• Using undefined values, i.e. values that have not been initialised, or that have been derived from other undefined values.
• Incorrect freeing of heap memory, such as double-freeing heap blocks, or mismatched use of Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  3 versus Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  4/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  5/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  6 Mismatches will also be reported for Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  7 and Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  8 allocation and deallocation functions if the deallocation value does not match the allocation value.
• Overlapping Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  9 and Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 0 pointers in Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 1 and related functions.
• Passing a fishy (presumably negative) value to the Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 2 parameter of a memory allocation function.
• Using a Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 2 value of 0 with realloc.
• Using an Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 4 value that is not a power of two.
• Memory leaks.

Problems like these can be difficult to find by other means, often remaining undetected for long periods, then causing occasional, difficult-to-diagnose crashes.

Memcheck also provides memory profiling using the command line option

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

5 and the monitor command

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

6.

4.2. Explanation of error messages from Memcheck

Memcheck issues a range of error messages. This section presents a quick summary of what error messages mean. The precise behaviour of the error-checking machinery is described in .

4.2.1. Illegal read / Illegal write errors

For example:

Invalid read of size 4 at 0x40F6BBCC: (within /usr/lib/libpng.so.2.1.0.9) by 0x40F6B804: (within /usr/lib/libpng.so.2.1.0.9) by 0x40B07FF4: read_png_image(QImageIO *) (kernel/qpngio.cpp:326) by 0x40AC751B: QImageIO::read() (kernel/qimage.cpp:3621) Address 0xBFFFF0E0 is not stack'd, malloc'd or free'd

This happens when your program reads or writes memory at a place which Memcheck reckons it shouldn't. In this example, the program did a 4-byte read at address 0xBFFFF0E0, somewhere within the system-supplied library libpng.so.2.1.0.9, which was called from somewhere else in the same library, called from line 326 of

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

7, and so on.

Memcheck tries to establish what the illegal address might relate to, since that's often useful. So, if it points into a block of memory which has already been freed, you'll be informed of this, and also where the block was freed. Likewise, if it should turn out to be just off the end of a heap block, a common result of off-by-one-errors in array subscripting, you'll be informed of this fact, and also where the block was allocated. If you use the

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

8 option Memcheck will run more slowly but may give a more detailed description of any illegal address.

In this example, Memcheck can't identify the address. Actually the address is on the stack, but, for some reason, this is not a valid stack address -- it is below the stack pointer and that isn't allowed. In this particular case it's probably caused by GCC generating invalid code, a known bug in some ancient versions of GCC.

Note that Memcheck only tells you that your program is about to access memory at an illegal address. It can't stop the access from happening. So, if your program makes an access which normally would result in a segmentation fault, you program will still suffer the same fate -- but you will get a message from Memcheck immediately prior to this. In this particular example, reading junk on the stack is non-fatal, and the program stays alive.

4.2.2. Use of uninitialised values

For example:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

An uninitialised-value use error is reported when your program uses a value which hasn't been initialised -- in other words, is undefined. Here, the undefined value is used somewhere inside the

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

9 machinery of the C library. This error was reported when running the following small program:

int main() { int x; printf ("x = %d\n", x); }

It is important to understand that your program can copy around junk (uninitialised) data as much as it likes. Memcheck observes this and keeps track of the data, but does not complain. A complaint is issued only when your program attempts to make use of uninitialised data in a way that might affect your program's externally-visible behaviour. In this example,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

0 is uninitialised. Memcheck observes the value being passed to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

1 and thence to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

2, but makes no comment. However,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

2 has to examine the value of

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

0 so it can turn it into the corresponding ASCII string, and it is at this point that Memcheck complains.

Sources of uninitialised data tend to be:

• Local variables in procedures which have not been initialised, as in the example above.
• The contents of heap blocks (allocated with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1, Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2, or a similar function) before you (or a constructor) write something there.

To see information on the sources of uninitialised data in your program, use the

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

7 option. This makes Memcheck run more slowly, but can make it much easier to track down the root causes of uninitialised value errors.

4.2.3. Use of uninitialised or unaddressable values in system calls

Memcheck checks all parameters to system calls:

• It checks all the direct parameters themselves, whether they are initialised.
• Also, if a system call needs to read from a buffer provided by your program, Memcheck checks that the entire buffer is addressable and its contents are initialised.
• Also, if the system call needs to write to a user-supplied buffer, Memcheck checks that the buffer is addressable.

After the system call, Memcheck updates its tracked information to precisely reflect any changes in memory state caused by the system call.

Here's an example of two system calls with invalid parameters:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

You get these complaints ...

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

... because the program has (a) written uninitialised junk from the heap block to the standard output, and (b) passed an uninitialised value to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

8. Note that the first error refers to the memory pointed to by

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

9 (not

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

9 itself), but the second error refers directly to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

8's argument

==27492== Source and destination overlap in memcpy(0xbffff294, 0xbffff280, 21) ==27492== at 0x40026CDC: memcpy (mc_replace_strmem.c:71) ==27492== by 0x804865A: main (overlap.c:40)

2.

4.2.4. Illegal frees

For example:

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

Memcheck keeps track of the blocks allocated by your program with

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1/

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2, so it can know exactly whether or not the argument to

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4/

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5 is legitimate or not. Here, this test program has freed the same block twice. As with the illegal read/write errors, Memcheck attempts to make sense of the address freed. If, as here, the address is one which has previously been freed, you wil be told that -- making duplicate frees of the same block easy to spot. You will also get this message if you try to free a pointer that doesn't point to the start of a heap block.

4.2.5. When a heap block is freed with an inappropriate deallocation function

In the following example, a block allocated with

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3 has wrongly been deallocated with

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4:

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

In

==27492== Source and destination overlap in memcpy(0xbffff294, 0xbffff280, 21) ==27492== at 0x40026CDC: memcpy (mc_replace_strmem.c:71) ==27492== by 0x804865A: main (overlap.c:40)

9 it's important to deallocate memory in a way compatible with how it was allocated.

Most of the time in C++ you will write code that uses

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

0 and

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

1 (see cppreference new expression and cppreference delete expression). A new expression will call

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

2 to perform the allocation and then call the constructor (if one exists) on the object. Similarly a delete expression will call the destructor on the object (if one exists) and then call

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

3. The array overloads call constructors/destructors for each object in the array.

The deal is:

• If allocated with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1, ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 5, ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6, ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 7 or ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 8, you must deallocate with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  4.
• If allocated with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2, you must deallocate with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  5.
• If allocated with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  3, you must deallocate with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  6.

Mixing types of allocators and deallocators is undefined behaviour. That means that on some platforms you might not have any problems, but the same program may then crash on a different platform, Solaris for example. So it's best to fix it properly. According to the KDE folks "it's amazing how many C++ programmers don't know this".

The reason behind the requirement is as follows. In some C++ implementations,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6 must be used for objects allocated by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3 because the compiler stores the size of the array and the pointer-to-member to the destructor of the array's content just before the pointer actually returned.

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5 doesn't account for this and will get confused, possibly corrupting the heap. Even if there is no corruption there are likely to be resource leaks since using the wrong delete may result in the wrong number of destructors being called.

C++ aligned allocations need to be freed using aligned delete with the same alignment.

Valgrind does not yet support C23

==77609== realloc() with size 0 ==77609== at 0x48502B8: realloc (vg_replace_malloc.c:1450) ==77609== by 0x201989: main (realloczero.c:8) ==77609== Address 0x5464040 is 0 bytes inside a block of size 4 alloc'd ==77609== at 0x484CBB4: malloc (vg_replace_malloc.c:397) ==77609== by 0x201978: main (realloczero.c:7)

7 or

==77609== realloc() with size 0 ==77609== at 0x48502B8: realloc (vg_replace_malloc.c:1450) ==77609== by 0x201989: main (realloczero.c:8) ==77609== Address 0x5464040 is 0 bytes inside a block of size 4 alloc'd ==77609== at 0x484CBB4: malloc (vg_replace_malloc.c:397) ==77609== by 0x201978: main (realloczero.c:7)

8

4.2.6. Overlapping source and destination blocks

The following C library functions copy some data from one memory block to another (or something similar):

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

1,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

00,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

01,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

02,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

03. The blocks pointed to by their

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

9 and

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

0 pointers aren't allowed to overlap. The POSIX standards have wording along the lines "If copying takes place between objects that overlap, the behavior is undefined." Therefore, Memcheck checks for this.

For example:

==27492== Source and destination overlap in memcpy(0xbffff294, 0xbffff280, 21) ==27492== at 0x40026CDC: memcpy (mc_replace_strmem.c:71) ==27492== by 0x804865A: main (overlap.c:40)

You don't want the two blocks to overlap because one of them could get partially overwritten by the copying.

You might think that Memcheck is being overly pedantic reporting this in the case where

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

0 is less than

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

9. For example, the obvious way to implement

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

1 is by copying from the first byte to the last. However, the optimisation guides of some architectures recommend copying from the last byte down to the first. Also, some implementations of

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

1 zero

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

0 before copying, because zeroing the destination's cache line(s) can improve performance.

The moral of the story is: if you want to write truly portable code, don't make any assumptions about the language implementation.

4.2.7. Fishy argument values

All memory allocation functions take an argument specifying the size of the memory block that should be allocated. Clearly, the requested size should be a non-negative value and is typically not excessively large. For instance, it is extremely unlikly that the size of an allocation request exceeds 2**63 bytes on a 64-bit machine. It is much more likely that such a value is the result of an erroneous size calculation and is in effect a negative value (that just happens to appear excessively large because the bit pattern is interpreted as an unsigned integer). Such a value is called a "fishy value". The

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

2 argument of the following allocation functions is checked for being fishy:

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

5,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

6,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

8,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

16,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

17,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

19.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

20,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

21, For

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

5 both arguments are checked.

For example:

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

In earlier Valgrind versions those values were being referred to as "silly arguments" and no back-trace was included.

4.2.8. Realloc size zero

The (ab)use or realloc to also do the job of

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4 has been poorly understood for a long time. In the C17 standard ISO/IEC 9899:2017] the behaviour of realloc when the size argument is zero is specified as implementation defined. Memcheck warns about the non-portable use or realloc.

For example:

==77609== realloc() with size 0 ==77609== at 0x48502B8: realloc (vg_replace_malloc.c:1450) ==77609== by 0x201989: main (realloczero.c:8) ==77609== Address 0x5464040 is 0 bytes inside a block of size 4 alloc'd ==77609== at 0x484CBB4: malloc (vg_replace_malloc.c:397) ==77609== by 0x201978: main (realloczero.c:7)

4.2.9. Alignment Errors

C and C++ have several functions that allow the user to obtain aligned memory. Typically this is done for performance reasons so that the memory will be cache line or memory page aligned. C has the functions

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

8,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

16 and

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

17. C++ has numerous overloads of

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

2 and

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

28. Of these, posix_memalign is quite clearly specified, the others vary quite widely between implementations. Valgrind will generate errors for values of alignment that are invalid on any platform.

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

8 will produce errors if the alignment is zero or not a multiple of two.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

16 will produce errors if the alignment is less than sizeof(size_t), not a multiple of two or if the size is zero.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

17 will produce errors if the alignment is not a multiple of two , if the size is zero or if the size is not an integral multiple of the alignment.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

32 will produce errors if the alignment is zero or not a multiple of two. The

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

33 overloads will return a NULL pointer. The non-nothrow overloads will abort Valgrind.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

34 will produce errors if the alignment is zero or not a multiple of two or if the alignment is not the same as that used by

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

32.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

36 will produce errors if the size is not the same as that used by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

38 combines the error conditions of the individual sized and aligned delete operators.

Example output:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

0

4.2.10. Memory leak detection

Memcheck keeps track of all heap blocks issued in response to calls to

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1/

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2 et al. So when the program exits, it knows which blocks have not been freed.

If

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

41 is set appropriately, for each remaining block, Memcheck determines if the block is reachable from pointers within the root-set. The root-set consists of (a) general purpose registers of all threads, and (b) initialised, aligned, pointer-sized data words in accessible client memory, including stacks.

There are two ways a block can be reached. The first is with a "start-pointer", i.e. a pointer to the start of the block. The second is with an "interior-pointer", i.e. a pointer to the middle of the block. There are several ways we know of that an interior-pointer can occur:

• The pointer might have originally been a start-pointer and have been moved along deliberately (or not deliberately) by the program. In particular, this can happen if your program uses tagged pointers, i.e. if it uses the bottom one, two or three bits of a pointer, which are normally always zero due to alignment, in order to store extra information.
• It might be a random junk value in memory, entirely unrelated, just a coincidence.
• It might be a pointer to the inner char array of a C++ Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 42. For example, some compilers add 3 words at the beginning of the std::string to store the length, the capacity and a reference count before the memory containing the array of characters. They return a pointer just after these 3 words, pointing at the char array.
• Some code might allocate a block of memory, and use the first 8 bytes to store (block size - 8) as a 64bit number. Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 43 does this.
• It might be a pointer to an array of C++ objects (which possess destructors) allocated with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  3. In this case, some compilers store a "magic cookie" containing the array length at the start of the allocated block, and return a pointer to just past that magic cookie, i.e. an interior-pointer. See this page for more information.
• It might be a pointer to an inner part of a C++ object using multiple inheritance.

You can optionally activate heuristics to use during the leak search to detect the interior pointers corresponding to the

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

45,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

46,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

47 and

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

48 cases. If the heuristic detects that an interior pointer corresponds to such a case, the block will be considered as reachable by the interior pointer. In other words, the interior pointer will be treated as if it were a start pointer.

With that in mind, consider the nine possible cases described by the following figure.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

1

Every possible case can be reduced to one of the above nine. Memcheck merges some of these cases in its output, resulting in the following four leak kinds.

• "Still reachable". This covers cases 1 and 2 (for the BBB blocks) above. A start-pointer or chain of start-pointers to the block is found. Since the block is still pointed at, the programmer could, at least in principle, have freed it before program exit. "Still reachable" blocks are very common and arguably not a problem. So, by default, Memcheck won't report such blocks individually.
• "Definitely lost". This covers case 3 (for the BBB blocks) above. This means that no pointer to the block can be found. The block is classified as "lost", because the programmer could not possibly have freed it at program exit, since no pointer to it exists. This is likely a symptom of having lost the pointer at some earlier point in the program. Such cases should be fixed by the programmer.
• "Indirectly lost". This covers cases 4 and 9 (for the BBB blocks) above. This means that the block is lost, not because there are no pointers to it, but rather because all the blocks that point to it are themselves lost. For example, if you have a binary tree and the root node is lost, all its children nodes will be indirectly lost. Because the problem will disappear if the definitely lost block that caused the indirect leak is fixed, Memcheck won't report such blocks individually by default.
• "Possibly lost". This covers cases 5--8 (for the BBB blocks) above. This means that a chain of one or more pointers to the block has been found, but at least one of the pointers is an interior-pointer. This could just be a random value in memory that happens to point into a block, and so you shouldn't consider this ok unless you know you have interior-pointers.

(Note: This mapping of the nine possible cases onto four leak kinds is not necessarily the best way that leaks could be reported; in particular, interior-pointers are treated inconsistently. It is possible the categorisation may be improved in the future.)

Furthermore, if suppressions exists for a block, it will be reported as "suppressed" no matter what which of the above four kinds it belongs to.

The following is an example leak summary.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

2

If heuristics have been used to consider some blocks as reachable, the leak summary details the heuristically reachable subset of 'still reachable:' per heuristic. In the below example, of the 95 bytes still reachable, 87 bytes (56+7+8+16) have been considered heuristically reachable.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

3

If

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

49 is specified, Memcheck will give details for each definitely lost or possibly lost block, including where it was allocated. (Actually, it merges results for all blocks that have the same leak kind and sufficiently similar stack traces into a single "loss record". The

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

50 lets you control the meaning of "sufficiently similar".) It cannot tell you when or how or why the pointer to a leaked block was lost; you have to work that out for yourself. In general, you should attempt to ensure your programs do not have any definitely lost or possibly lost blocks at exit.

For example:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

4

The first message describes a simple case of a single 8 byte block that has been definitely lost. The second case mentions another 8 byte block that has been definitely lost; the difference is that a further 80 bytes in other blocks are indirectly lost because of this lost block. The loss records are not presented in any notable order, so the loss record numbers aren't particularly meaningful. The loss record numbers can be used in the Valgrind gdbserver to list the addresses of the leaked blocks and/or give more details about how a block is still reachable.

The option

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

51 controls the set of leak kinds to show when

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

49 is specified.

The

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

53 of leak kinds is specified in one of the following ways:

• a comma separated list of one or more of Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 54.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 55 to specify the complete set (all leak kinds).
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 56 for the empty set.

The default value for the leak kinds to show is

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

57.

To also show the reachable and indirectly lost blocks in addition to the definitely and possibly lost blocks, you can use

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

58. To only show the reachable and indirectly lost blocks, use

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

59. The reachable and indirectly lost blocks will then be presented as shown in the following two examples.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

5

Because there are different kinds of leaks with different severities, an interesting question is: which leaks should be counted as true "errors" and which should not?

The answer to this question affects the numbers printed in the

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

60 line, and also the effect of the

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

61 option. First, a leak is only counted as a true "error" if

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

49 is specified. Then, the option

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

63 controls the set of leak kinds to consider as errors. The default value is

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

64

4.3. Memcheck Command-Line Options

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

65

When enabled, search for memory leaks when the client program finishes. If set to

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

66, it says how many leaks occurred. If set to

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

67 or

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

68, each individual leak will be shown in detail and/or counted as an error, as specified by the options

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

69 and

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

70.

If

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

71 is given, memcheck will automatically use the value

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

49. You can use

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

73 to reduce the size of the xml output if you are not interested in the leak results.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

74

When doing leak checking, determines how willing Memcheck is to consider different backtraces to be the same for the purposes of merging multiple leaks into a single leak report. When set to

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

75, only the first two entries need match. When

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

76, four entries have to match. When

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

77, all entries need to match.

For hardcore leak debugging, you probably want to use

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

78 together with

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

79 or some such large number.

Note that the

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

50 setting does not affect Memcheck's ability to find leaks. It only changes how the results are presented.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

81

Specifies the leak kinds to show in a

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

67 leak search, in one of the following ways:

• a comma separated list of one or more of Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 54.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 55 to specify the complete set (all leak kinds). It is equivalent to Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 85.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 56 for the empty set.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

87

Specifies the leak kinds to count as errors in a

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

67 leak search. The

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

53 is specified similarly to

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

69

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

91

Specifies the set of leak check heuristics to be used during leak searches. The heuristics control which interior pointers to a block cause it to be considered as reachable. The heuristic set is specified in one of the following ways:

• a comma separated list of one or more of Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 92.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 55 to activate the complete set of heuristics. It is equivalent to Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 94.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 56 for the empty set.

Note that these heuristics are dependent on the layout of the objects produced by the C++ compiler. They have been tested with some gcc versions (e.g. 4.4 and 4.7). They might not work properly with other C++ compilers.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

96 ,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

97

These options provide an alternative way to specify the leak kinds to show:

• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 98 is equivalent to Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 57.
• int main() { int x; printf ("x = %d\n", x); } 00 is equivalent to int main() { int x; printf ("x = %d\n", x); } 01.
• int main() { int x; printf ("x = %d\n", x); } 02 is equivalent to Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 58.

Note that

int main() { int x; printf ("x = %d\n", x); }

04 has no effect if

int main() { int x; printf ("x = %d\n", x); }

02 is specified.

int main() { int x; printf ("x = %d\n", x); }

06

If set to yes, the results for the leak search done at exit will be output in a 'Callgrind Format' execution tree file. Note that this automatically sets the options

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

49 and

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

58, to allow xtree visualisation tools such as kcachegrind to select what kind to leak to visualize. The produced file will contain the following events:

• int main() { int x; printf ("x = %d\n", x); } 09 : Reachable Bytes
• int main() { int x; printf ("x = %d\n", x); } 10 : Possibly lost Bytes
• int main() { int x; printf ("x = %d\n", x); } 11 : Indirectly lost Bytes
• int main() { int x; printf ("x = %d\n", x); } 12 : Definitely lost Bytes (direct plus indirect)
• int main() { int x; printf ("x = %d\n", x); } 13 : Definitely Indirectly lost Bytes (subset of DB)
• int main() { int x; printf ("x = %d\n", x); } 14 : reachable Blocks
• int main() { int x; printf ("x = %d\n", x); } 15 : Possibly lost Blocks
• int main() { int x; printf ("x = %d\n", x); } 16 : Indirectly lost Blocks
• int main() { int x; printf ("x = %d\n", x); } 17 : Definitely lost Blocks

The increase or decrease for all events above will also be output in the file to provide the delta (increase or decrease) between 2 successive leak searches. For example,

int main() { int x; printf ("x = %d\n", x); }

18 is the increase of the

int main() { int x; printf ("x = %d\n", x); }

09 event,

int main() { int x; printf ("x = %d\n", x); }

20 is the decrease of

int main() { int x; printf ("x = %d\n", x); }

15 event. The values for the increase and decrease events will be zero for the first leak search done.

See for a detailed explanation about execution trees.

int main() { int x; printf ("x = %d\n", x); }

22

Specifies that Valgrind should produce the xtree leak report in the specified file. Any

int main() { int x; printf ("x = %d\n", x); }

23,

int main() { int x; printf ("x = %d\n", x); }

24 or

int main() { int x; printf ("x = %d\n", x); }

25 sequences appearing in the filename are expanded in exactly the same way as they are for

int main() { int x; printf ("x = %d\n", x); }

26. See the description of for details.

See for a detailed explanation about execution trees formats.

int main() { int x; printf ("x = %d\n", x); }

27

Controls whether Memcheck reports uses of undefined value errors. Set this to

int main() { int x; printf ("x = %d\n", x); }

28 if you don't want to see undefined value errors. It also has the side effect of speeding up Memcheck somewhat. AddrCheck (removed in Valgrind 3.1.0) functioned like Memcheck with

int main() { int x; printf ("x = %d\n", x); }

29.

int main() { int x; printf ("x = %d\n", x); }

30

Controls whether Memcheck tracks the origin of uninitialised values. By default, it does not, which means that although it can tell you that an uninitialised value is being used in a dangerous way, it cannot tell you where the uninitialised value came from. This often makes it difficult to track down the root problem.

When set to

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

68, Memcheck keeps track of the origins of all uninitialised values. Then, when an uninitialised value error is reported, Memcheck will try to show the origin of the value. An origin can be one of the following four places: a heap block, a stack allocation, a client request, or miscellaneous other sources (eg, a call to

int main() { int x; printf ("x = %d\n", x); }

32).

For uninitialised values originating from a heap block, Memcheck shows where the block was allocated. For uninitialised values originating from a stack allocation, Memcheck can tell you which function allocated the value, but no more than that -- typically it shows you the source location of the opening brace of the function. So you should carefully check that all of the function's local variables are initialised properly.

Performance overhead: origin tracking is expensive. It halves Memcheck's speed and increases memory use by a minimum of 100MB, and possibly more. Nevertheless it can drastically reduce the effort required to identify the root cause of uninitialised value errors, and so is often a programmer productivity win, despite running more slowly.

Accuracy: Memcheck tracks origins quite accurately. To avoid very large space and time overheads, some approximations are made. It is possible, although unlikely, that Memcheck will report an incorrect origin, or not be able to identify any origin.

Note that the combination

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

7 and

int main() { int x; printf ("x = %d\n", x); }

29 is nonsensical. Memcheck checks for and rejects this combination at startup.

int main() { int x; printf ("x = %d\n", x); }

35

Controls how Memcheck handles 32-, 64-, 128- and 256-bit naturally aligned loads from addresses for which some bytes are addressable and others are not. When

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

68, such loads do not produce an address error. Instead, loaded bytes originating from illegal addresses are marked as uninitialised, and those corresponding to legal addresses are handled in the normal way.

When

int main() { int x; printf ("x = %d\n", x); }

28, loads from partially invalid addresses are treated the same as loads from completely invalid addresses: an illegal-address error is issued, and the resulting bytes are marked as initialised.

Note that code that behaves in this way is in violation of the ISO C/C++ standards, and should be considered broken. If at all possible, such code should be fixed.

int main() { int x; printf ("x = %d\n", x); }

38

Controls whether Memcheck should employ more precise but also more expensive (time consuming) instrumentation when checking the definedness of certain values. In particular, this affects the instrumentation of integer adds, subtracts and equality comparisons.

Selecting

int main() { int x; printf ("x = %d\n", x); }

39 causes Memcheck to use the most accurate analysis possible. This minimises false error rates but can cause up to 30% performance degradation.

Selecting

int main() { int x; printf ("x = %d\n", x); }

40 causes Memcheck to use the cheapest instrumentation possible. This maximises performance but will normally give an unusably high false error rate.

The default setting,

int main() { int x; printf ("x = %d\n", x); }

41, is strongly recommended. This causes Memcheck to use the minimum of expensive instrumentation needed to achieve the same false error rate as

int main() { int x; printf ("x = %d\n", x); }

39. It also enables an instrumentation-time analysis pass which aims to further reduce the costs of accurate instrumentation. Overall, the performance loss is generally around 5% relative to

int main() { int x; printf ("x = %d\n", x); }

40, although this is strongly workload dependent. Note that the exact instrumentation settings in this mode are architecture dependent.

int main() { int x; printf ("x = %d\n", x); }

44

Controls which stack trace(s) to keep for malloc'd and/or free'd blocks.

With

int main() { int x; printf ("x = %d\n", x); }

45, a stack trace is recorded at allocation time, and is associated with the block. When the block is freed, a second stack trace is recorded, and this replaces the allocation stack trace. As a result, any "use after free" errors relating to this block can only show a stack trace for where the block was freed.

With

int main() { int x; printf ("x = %d\n", x); }

46, both allocation and the deallocation stack traces for the block are stored. Hence a "use after free" error will show both, which may make the error easier to diagnose. Compared to

int main() { int x; printf ("x = %d\n", x); }

45, this setting slightly increases Valgrind's memory use as the block contains two references instead of one.

With

int main() { int x; printf ("x = %d\n", x); }

48, only the allocation stack trace is recorded (and reported). With

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4, only the deallocation stack trace is recorded (and reported). These values somewhat decrease Valgrind's memory and cpu usage. They can be useful depending on the error types you are searching for and the level of detail you need to analyse them. For example, if you are only interested in memory leak errors, it is sufficient to record the allocation stack traces.

With

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

56, no stack traces are recorded for malloc and free operations. If your program allocates a lot of blocks and/or allocates/frees from many different stack traces, this can significantly decrease cpu and/or memory required. Of course, few details will be reported for errors related to heap blocks.

Note that once a stack trace is recorded, Valgrind keeps the stack trace in memory even if it is not referenced by any block. Some programs (for example, recursive algorithms) can generate a huge number of stack traces. If Valgrind uses too much memory in such circumstances, you can reduce the memory required with the options

int main() { int x; printf ("x = %d\n", x); }

51 and/or by using a smaller value for the option

int main() { int x; printf ("x = %d\n", x); }

52.

If you want to use

int main() { int x; printf ("x = %d\n", x); }

53 memory profiling (see ), then you cannot specify

int main() { int x; printf ("x = %d\n", x); }

54 or

int main() { int x; printf ("x = %d\n", x); }

55.

int main() { int x; printf ("x = %d\n", x); }

56

When the client program releases memory using

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4 (in

int main() { int x; printf ("x = %d\n", x); }

58. or

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5 (

==27492== Source and destination overlap in memcpy(0xbffff294, 0xbffff280, 21) ==27492== at 0x40026CDC: memcpy (mc_replace_strmem.c:71) ==27492== by 0x804865A: main (overlap.c:40)

9), that memory is not immediately made available for re-allocation. Instead, it is marked inaccessible and placed in a queue of freed blocks. The purpose is to defer as long as possible the point at which freed-up memory comes back into circulation. This increases the chance that Memcheck will be able to detect invalid accesses to blocks for some significant period of time after they have been freed.

This option specifies the maximum total size, in bytes, of the blocks in the queue. The default value is twenty million bytes. Increasing this increases the total amount of memory used by Memcheck but may detect invalid uses of freed blocks which would otherwise go undetected.

int main() { int x; printf ("x = %d\n", x); }

61

When making blocks from the queue of freed blocks available for re-allocation, Memcheck will in priority re-circulate the blocks with a size greater or equal to

int main() { int x; printf ("x = %d\n", x); }

62. This ensures that freeing big blocks (in particular freeing blocks bigger than

int main() { int x; printf ("x = %d\n", x); }

63. does not immediately lead to a re-circulation of all (or a lot of) the small blocks in the free list. In other words, this option increases the likelihood to discover dangling pointers for the "small" blocks, even when big blocks are freed.

Setting a value of 0 means that all the blocks are re-circulated in a FIFO order.

int main() { int x; printf ("x = %d\n", x); }

64

When enabled, assume that reads and writes some small distance below the stack pointer are due to bugs in GCC 2.96, and does not report them. The "small distance" is 256 bytes by default. Note that GCC 2.96 is the default compiler on some ancient Linux distributions (RedHat 7.X) and so you may need to use this option. Do not use it if you do not have to, as it can cause real errors to be overlooked. A better alternative is to use a more recent GCC in which this bug is fixed.

You may also need to use this option when working with GCC 3.X or 4.X on 32-bit PowerPC Linux. This is because GCC generates code which occasionally accesses below the stack pointer, particularly for floating-point to/from integer conversions. This is in violation of the 32-bit PowerPC ELF specification, which makes no provision for locations below the stack pointer to be accessible.

This option is deprecated as of version 3.12 and may be removed from future versions. You should instead use

int main() { int x; printf ("x = %d\n", x); }

65 to specify the exact range of offsets below the stack pointer that should be ignored. A suitable equivalent is

int main() { int x; printf ("x = %d\n", x); }

66.

int main() { int x; printf ("x = %d\n", x); }

67

This is a more general replacement for the deprecated

int main() { int x; printf ("x = %d\n", x); }

68 option. When specified, it causes Memcheck not to report errors for accesses at the specified offsets below the stack pointer. The two offsets must be positive decimal numbers and somewhat counterintuitively the first one must be larger, in order to imply a non-wraparound address range to ignore. For example, to ignore 4 byte accesses at 8192 bytes below the stack pointer, use

int main() { int x; printf ("x = %d\n", x); }

69. Only one range may be specified.

int main() { int x; printf ("x = %d\n", x); }

70

When enabled, Memcheck checks that heap blocks are deallocated using a function that matches the allocating function. That is, it expects

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4 to be used to deallocate blocks allocated by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5 for blocks allocated by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2, and

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6 for blocks allocated by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3. If a mismatch is detected, an error is reported. This is in general important because in some environments, freeing with a non-matching function can cause crashes.

There is however a scenario where such mismatches cannot be avoided. That is when the user provides implementations of

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2/

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3 that call

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1 and of

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5/

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6 that call

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4, and these functions are asymmetrically inlined. For example, imagine that

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6 is inlined but

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3 is not. The result is that Memcheck "sees" all

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6 calls as direct calls to

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4, even when the program source contains no mismatched calls.

This causes a lot of confusing and irrelevant error reports.

int main() { int x; printf ("x = %d\n", x); }

87 disables these checks. It is not generally advisable to disable them, though, because you may miss real errors as a result.

int main() { int x; printf ("x = %d\n", x); }

88

Any ranges listed in this option (and multiple ranges can be specified, separated by commas) will be ignored by Memcheck's addressability checking.

int main() { int x; printf ("x = %d\n", x); }

89

Fills blocks allocated by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2, etc, but not by

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

5, with the specified byte. This can be useful when trying to shake out obscure memory corruption problems. The allocated area is still regarded by Memcheck as undefined -- this option only affects its contents. Note that

int main() { int x; printf ("x = %d\n", x); }

93 does not affect a block of memory when it is used as argument to client requests VALGRIND_MEMPOOL_ALLOC or VALGRIND_MALLOCLIKE_BLOCK.

int main() { int x; printf ("x = %d\n", x); }

94

Fills blocks freed by

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5, etc, with the specified byte value. This can be useful when trying to shake out obscure memory corruption problems. The freed area is still regarded by Memcheck as not valid for access -- this option only affects its contents. Note that

int main() { int x; printf ("x = %d\n", x); }

97 does not affect a block of memory when it is used as argument to client requests VALGRIND_MEMPOOL_FREE or VALGRIND_FREELIKE_BLOCK.

4.4. Writing suppression files

The basic suppression format is described in .

The suppression-type (second) line should have the form:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

6

The Memcheck suppression types are as follows:

• int main()

  { int x; printf ("x = %d\n", x); } 98, int main() { int x; printf ("x = %d\n", x); } 99,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 00,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 01,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 02, meaning an uninitialised-value error when using a value of 1, 2, 4, 8 or 16 bytes.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 03 (or its old name,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 04), meaning use of an uninitialised CPU condition code.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 05,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 06,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 07,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 08,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 09, meaning an invalid address during a memory access of 1, 2, 4, 8 or 16 bytes respectively.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 10, meaning an jump to an unaddressable location error.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 11, meaning an invalid system call parameter error.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 12, meaning an invalid or mismatching free.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 13, meaning a Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  9 / Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 0 overlap in Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 1 or a similar function.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 17, meaning a memory leak.

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

11 errors have a mandatory extra information line at this point, which is the name of the offending system call parameter.

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

17 errors have an optional extra information line, with the following format:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

7

where

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

53 specifies which leak kinds are matched by this suppression entry.

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

53 is specified in the same way as with the option

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

69, that is, one of the following:

• a comma separated list of one or more of Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 54.
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 55 to specify the complete set (all leak kinds).
• Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 56 for the empty set.

If this optional extra line is not present, the suppression entry will match all leak kinds.

Be aware that leak suppressions that are created using

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

26 will contain this optional extra line, and therefore may match fewer leaks than you expect. You may want to remove the line before using the generated suppressions.

The other Memcheck error kinds do not have extra lines.

If you give the

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

27 option, Valgrind will print the list of used suppressions at the end of execution. For a leak suppression, this output gives the number of different loss records that match the suppression, and the number of bytes and blocks suppressed by the suppression. If the run contains multiple leak checks, the number of bytes and blocks are reset to zero before each new leak check. Note that the number of different loss records is not reset to zero.

In the example below, in the last leak search, 7 blocks and 96 bytes have been suppressed by a suppression with the name

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

28:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

8

For

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

29 and

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

30 errors, the first line of the calling context is either the name of the function in which the error occurred, or, failing that, the full path of the

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

31 file or executable containing the error location. For

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

12 errors, the first line is the name of the function doing the freeing (eg,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4,

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

34, etc). For

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

13 errors, the first line is the name of the function with the overlapping arguments (eg.

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

1,

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

00, etc).

The last part of any suppression specifies the rest of the calling context that needs to be matched.

4.5. Details of Memcheck's checking machinery

Read this section if you want to know, in detail, exactly what and how Memcheck is checking.

4.5.1. Valid-value (V) bits

It is simplest to think of Memcheck implementing a synthetic CPU which is identical to a real CPU, except for one crucial detail. Every bit (literally) of data processed, stored and handled by the real CPU has, in the synthetic CPU, an associated "valid-value" bit, which says whether or not the accompanying bit has a legitimate value. In the discussions which follow, this bit is referred to as the V (valid-value) bit.

Each byte in the system therefore has a 8 V bits which follow it wherever it goes. For example, when the CPU loads a word-size item (4 bytes) from memory, it also loads the corresponding 32 V bits from a bitmap which stores the V bits for the process' entire address space. If the CPU should later write the whole or some part of that value to memory at a different address, the relevant V bits will be stored back in the V-bit bitmap.

In short, each bit in the system has (conceptually) an associated V bit, which follows it around everywhere, even inside the CPU. Yes, all the CPU's registers (integer, floating point, vector and condition registers) have their own V bit vectors. For this to work, Memcheck uses a great deal of compression to represent the V bits compactly.

Copying values around does not cause Memcheck to check for, or report on, errors. However, when a value is used in a way which might conceivably affect your program's externally-visible behaviour, the associated V bits are immediately checked. If any of these indicate that the value is undefined (even partially), an error is reported.

Here's an (admittedly nonsensical) example:

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

9

Memcheck emits no complaints about this, since it merely copies uninitialised values from

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

38 into

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

39, and doesn't use them in a way which could affect the behaviour of the program. However, if the loop is changed to:

int main() { int x; printf ("x = %d\n", x); }

0

then Memcheck will complain, at the

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

40, that the condition depends on uninitialised values. Note that it doesn't complain at the

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

41, since at that point the undefinedness is not "observable". It's only when a decision has to be made as to whether or not to do the

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

9 an observable action of your program that Memcheck complains.

Most low level operations, such as adds, cause Memcheck to use the V bits for the operands to calculate the V bits for the result. Even if the result is partially or wholly undefined, it does not complain.

Checks on definedness only occur in three places: when a value is used to generate a memory address, when control flow decision needs to be made, and when a system call is detected, Memcheck checks definedness of parameters as required.

If a check should detect undefinedness, an error message is issued. The resulting value is subsequently regarded as well-defined. To do otherwise would give long chains of error messages. In other words, once Memcheck reports an undefined value error, it tries to avoid reporting further errors derived from that same undefined value.

This sounds overcomplicated. Why not just check all reads from memory, and complain if an undefined value is loaded into a CPU register? Well, that doesn't work well, because perfectly legitimate C programs routinely copy uninitialised values around in memory, and we don't want endless complaints about that. Here's the canonical example. Consider a struct like this:

int main() { int x; printf ("x = %d\n", x); }

1

The question to ask is: how large is

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

43, in bytes? An

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

44 is 4 bytes and a

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

45 one byte, so perhaps a

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

46 occupies 5 bytes? Wrong. All non-toy compilers we know of will round the size of

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

43 up to a whole number of words, in this case 8 bytes. Not doing this forces compilers to generate truly appalling code for accessing arrays of

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

43's on some architectures.

So

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

49 occupies 8 bytes, yet only 5 of them will be initialised. For the assignment

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

50, GCC generates code to copy all 8 bytes wholesale into

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

51 without regard for their meaning. If Memcheck simply checked values as they came out of memory, it would yelp every time a structure assignment like this happened. So the more complicated behaviour described above is necessary. This allows GCC to copy

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

49 into

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

51 any way it likes, and a warning will only be emitted if the uninitialised values are later used.

As explained above, Memcheck maintains 8 V bits for each byte in your process, including for bytes that are in shared memory. However, the same piece of shared memory can be mapped multiple times, by several processes or even by the same process (for example, if the process wants a read-only and a read-write mapping of the same page). For such multiple mappings, Memcheck tracks the V bits for each mapping independently. This can lead to false positive errors, as the shared memory can be initialised via a first mapping, and accessed via another mapping. The access via this other mapping will have its own V bits, which have not been changed when the memory was initialised via the first mapping. The bypass for these false positives is to use Memcheck's client requests

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

54 and

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

55 to inform Memcheck about what your program does (or what another process does) to these shared memory mappings.

4.5.2. Valid-address (A) bits

Notice that the previous subsection describes how the validity of values is established and maintained without having to say whether the program does or does not have the right to access any particular memory location. We now consider the latter question.

As described above, every bit in memory or in the CPU has an associated valid-value (V) bit. In addition, all bytes in memory, but not in the CPU, have an associated valid-address (A) bit. This indicates whether or not the program can legitimately read or write that location. It does not give any indication of the validity of the data at that location that's the job of the V bits only whether or not the location may be accessed.

Every time your program reads or writes memory, Memcheck checks the A bits associated with the address. If any of them indicate an invalid address, an error is emitted. Note that the reads and writes themselves do not change the A bits, only consult them.

So how do the A bits get set/cleared? Like this:

• When the program starts, all the global data areas are marked as accessible.
• When the program does Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2, the A bits for exactly the area allocated, and not a byte more, are marked as accessible. Upon freeing the area the A bits are changed to indicate inaccessibility.
• When the stack pointer register (

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  }
• moves up or down, A bits are set. The rule is that the area from

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 58 up to the base of the stack is marked as accessible, and below

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 58 is inaccessible. (If that sounds illogical, bear in mind that the stack grows down, not up, on almost all Unix systems, including GNU/Linux.) Tracking

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 58 like this has the useful side-effect that the section of stack used by a function for local variables etc is automatically marked accessible on function entry and inaccessible on exit.
• When doing system calls, A bits are changed appropriately. For example,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 62 magically makes files appear in the process' address space, so the A bits must be updated if

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 62 succeeds.
• Optionally, your program can tell Memcheck about such changes explicitly, using the client request mechanism described above.

4.5.3. Putting it all together

Memcheck's checking machinery can be summarised as follows:

• Each byte in memory has 8 associated V (valid-value) bits, saying whether or not the byte has a defined value, and a single A (valid-address) bit, saying whether or not the program currently has the right to read/write that address. As mentioned above, heavy use of compression means the overhead is typically around 25%.
• When memory is read or written, the relevant A bits are consulted. If they indicate an invalid address, Memcheck emits an Invalid read or Invalid write error.
• When memory is read into the CPU's registers, the relevant V bits are fetched from memory and stored in the simulated CPU. They are not consulted.
• When a register is written out to memory, the V bits for that register are written back to memory too.
• When values in CPU registers are used to generate a memory address, or to determine the outcome of a conditional branch, the V bits for those values are checked, and an error emitted if any of them are undefined.
• When values in CPU registers are used for any other purpose, Memcheck computes the V bits for the result, but does not check them.
• Once the V bits for a value in the CPU have been checked, they are then set to indicate validity. This avoids long chains of errors.
• When values are loaded from memory, Memcheck checks the A bits for that location and issues an illegal-address warning if needed. In that case, the V bits loaded are forced to indicate Valid, despite the location being invalid.

  This apparently strange choice reduces the amount of confusing information presented to the user. It avoids the unpleasant phenomenon in which memory is read from a place which is both unaddressable and contains invalid values, and, as a result, you get not only an invalid-address (read/write) error, but also a potentially large set of uninitialised-value errors, one for every time the value is used. There is a hazy boundary case to do with multi-byte loads from addresses which are partially valid and partially invalid. See details of the option

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 64 for details.

Memcheck intercepts calls to

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

5,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

6,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

7,

==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23)

8,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

2,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

3,

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

5 and

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

6. The behaviour you get is:

• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  3: the returned memory is marked as addressable but not having valid values. This means you have to write to it before you can read it.
• ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 5: returned memory is marked both addressable and valid, since ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 5 clears the area to zero.
• ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6: if the new size is larger than the old, the new section is addressable but invalid, as with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1. If the new size is smaller, the dropped-off section is marked as unaddressable. You may only pass to ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6 a pointer previously issued to you by Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1/ ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 5/ ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  4/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  5/ Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  6: you may only pass to these functions a pointer previously issued to you by the corresponding allocation function. Otherwise, Memcheck complains. If the pointer is indeed valid, Memcheck marks the entire area it points at as unaddressable, and places the block in the freed-blocks-queue. The aim is to defer as long as possible reallocation of this block. Until that happens, all attempts to access it will elicit an invalid-address error, as you would hope.

4.6. Memcheck Monitor Commands

The Memcheck tool provides monitor commands handled by Valgrind's built-in gdbserver (see ). Valgrind python code provides GDB front end commands giving an easier usage of the memcheck monitor commands (see ). To launch a memcheck monitor command via its GDB front end command, instead of prefixing the command with "monitor", you must use the GDB

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

89 command (or the shorter aliases

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

90). Using the memcheck GDB front end command provide a more flexible usage, such as evaluation of address and length arguments by GDB. In GDB, you can use

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

91 to get help about the memcheck front end monitor commands and you can use

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

92 to get all the commands mentionning the word "memcheck" in their name or on-line help.

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 93 shows the definedness (V) bits and values for (default 1) bytes starting at . For each 8 bytes, two lines are output. The first line shows the validity bits for 8 bytes. The definedness of each byte in the range is given using two hexadecimal digits. These hexadecimal digits encode the validity of each bit of the corresponding byte, using 0 if the bit is defined and 1 if the bit is undefined. If a byte is not addressable, its validity bits are replaced by

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 94 (a double underscore). The second line shows the values of the bytes below the corresponding validity bits. The format used to show the bytes data is similar to the GDB command 'x /xb '. The value for a non addressable bytes is shown as ?? (two question marks). In the following example,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 95 is an array of 10 characters, in which the even numbered bytes are undefined. In the below example, the byte corresponding to

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 96 is not addressable. int main() { int x; printf ("x = %d\n", x); } 2 The GDB memcheck front end command

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 97 accepts any address expression for its first ADDR argument. The second optional argument is any integer expression. Note that these 2 arguments must be separated by a space. The following example shows how to get the definedness of

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 95 using the memcheck xb front end command. int main() { int x; printf ("x = %d\n", x); } 3 The command xb cannot be used with registers. To get the validity bits of a register, you must start Valgrind with the option

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 99. The validity bits of a register can then be obtained by printing the 'shadow 1' corresponding register. In the below x86 example, the register eax has all its bits undefined, while the register ebx is fully defined. int main() { int x; printf ("x = %d\n", x); } 4
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  00 shows the definedness (V) bits for (default 1) bytes starting at using the same convention as the

  Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  01 command. Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  02 only shows the V bits (grouped by 4 bytes). It does not show the values. If you want to associate V bits with the corresponding byte values, the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  01 command will be easier to use, in particular on little endian computers when associating undefined parts of an integer with their V bits values. The following example shows the result of Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  02 on the

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 95 used in the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  01 command explanation. The GDB memcheck equivalent front end command Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  07accepts any ADDR expression and any LEN expression (separated by a space). int main() { int x; printf ("x = %d\n", x); } 5
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  08 marks the range of (default 1) bytes at as having the given status. Parameter

  Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  09 marks the range as non-accessible, so Memcheck will report an error on any access to it. Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  10 or Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  11 mark the area as accessible, but Memcheck regards the bytes in it respectively as having undefined or defined values. Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  12 marks as defined, bytes in the range which are already addressible, but makes no change to the status of bytes in the range which are not addressible. Note that the first letter of Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  12 is an uppercase D to avoid confusion with Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  

• The GDB equivalent memcheck front end commands Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  15 accept any address expression for their first ADDR argument. The second optional argument is any integer expression. Note that these 2 arguments must be separated by a space. In the following example, the first byte of the

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 95 is marked as defined and then is marked noaccess: int main() { int x; printf ("x = %d\n", x); } 6
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  17 checks that the range of (default 1) bytes at has the specified accessibility. It then outputs a description of . In the following example, a detailed description is available because the option Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  18 was given at Valgrind startup: int main() { int x; printf ("x = %d\n", x); } 7 The GDB equivalent memcheck front end commands Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  19 accept any address expression for their first ADDR argument. The second optional argument is any integer expression. Note that these 2 arguments must be separated by a space.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  20 performs a leak check. The Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  21 in the arguments indicates the default values. If the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  22 argument is Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 66, only a summary of the leak search is given; otherwise a full leak report is produced. A full leak report gives detailed information for each leak: the stack trace where the leaked blocks were allocated, the number of blocks leaked and their total size. When a full report is requested, the next two arguments further specify what kind of leaks to report. A leak's details are shown if they match both the second and third argument. A full leak report might output detailed information for many leaks. The nr of leaks for which information is output can be controlled using the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  24 argument followed by the maximum nr of leak records to output. If this maximum is reached, the leak search outputs the records with the biggest number of bytes. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  25 also produces a full leak report, but output it as an xtree in a file xtleak.kcg.%p.%n (see ). See for a detailed explanation about execution trees formats. See for the description of the events in a xtree leak file. The Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  26 argument controls what kind of blocks are shown for a Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 67 leak search. The set of leak kinds to show can be specified using a Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 53 similarly to the command line option Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 69. Alternatively, the value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  30 is equivalent to Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  31, the value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  32 is equivalent to Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  33 : it will also show possibly leaked blocks, .i.e those for which only an interior pointer was found. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  34 will show all block categories (i.e. is equivalent to Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  35). The Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  36 argument controls the heuristics used during the leak search. The set of heuristics to use can be specified using a Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 53 similarly to the command line option Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  38. The default value for the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  36 argument is Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  

• The Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  41 argument controls what kinds of changes are shown for a Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 67 leak search. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  43 specifies that only block allocation stacks with an increased number of leaked bytes or blocks since the previous leak check should be shown. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  44 specifies that allocation stacks with any change since the previous leak check should be shown. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2 specifies to show only the block allocation stacks that are new since the previous leak search. The value Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  46 specifies that all leak entries should be shown, regardless of any increase or decrease. If Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  2 or Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  43 or Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  44 are specified, the leak report entries will show the delta relative to the previous leak report and the new loss records will have a "new" marker (even when Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  43 or Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  44 were specified). The following example shows usage of the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  52 monitor command on the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  53 regression test. The first command outputs one entry having an increase in the leaked bytes. The second command is the same as the first command, but uses the abbreviated forms accepted by GDB and the Valgrind gdbserver. It only outputs the summary information, as there was no increase since the previous leak search. int main() { int x; printf ("x = %d\n", x); } 8 Note that when using Valgrind's gdbserver, it is not necessary to rerun with Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8) 49 int main() { int x; printf ("x = %d\n", x); } 02 to see the reachable blocks. You can obtain the same information without rerunning by using the GDB command Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  56 (or, using abbreviation: Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  57). The GDB equivalent memcheck front end command Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  58 auto-completes the user input by providing the full list of keywords still relevant according to what is already typed. For example, if the "summary" keyword has been provided, the following TABs to auto-complete other items will not propose anymore "full" and "xtleak". Note that KIND and HEUR values are not part of auto-completed elements.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  59 shows the list of blocks belonging to

  Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  60 (or to the loss records range Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  61). The nr of blocks to print can be controlled using the Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  24 argument followed by the maximum nr of blocks to output. If one or more heuristics are given, only prints the loss records and blocks found via one of the given Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  63 heuristics. A leak search merges the allocated blocks in loss records : a loss record re-groups all blocks having the same state (for example, Definitely Lost) and the same allocation backtrace. Each loss record is identified in the leak search result by a loss record number. The Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  64 command shows the loss record information followed by the addresses and sizes of the blocks which have been merged in the loss record. If a block was found using an heuristic, the block size is followed by the heuristic. If a directly lost block causes some other blocks to be indirectly lost, the block_list command will also show these indirectly lost blocks. The indirectly lost blocks will be indented according to the level of indirection between the directly lost block and the indirectly lost block(s). Each indirectly lost block is followed by the reference of its loss record. The block_list command can be used on the results of a leak search as long as no block has been freed after this leak search: as soon as the program frees a block, a new leak search is needed before block_list can be used again. In the below example, the program leaks a tree structure by losing the pointer to the block A (top of the tree). So, the block A is directly lost, causing an indirect loss of blocks B to G. The first block_list command shows the loss record of A (a definitely lost block with address 0x4028028, size 16). The addresses and sizes of the indirectly lost blocks due to block A are shown below the block A. The second command shows the details of one of the indirect loss records output by the first command. int main() { int x; printf ("x = %d\n", x); } 9

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 0
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  65 shows all the locations where a pointer to addr is found. If len is equal to 1, the command only shows the locations pointing exactly at addr (i.e. the "start pointers" to addr). If len is > 1, "interior pointers" pointing at the len first bytes will also be shown.

  The locations searched for are the same as the locations used in the leak search. So, Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  66 can a.o. be used to show why the leak search still can reach a block, or can search for dangling pointers to a freed block. Each location pointing at addr (or pointing inside addr if interior pointers are being searched for) will be described. The GDB equivalent memcheck front end command Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  67 accept any address expression for its first ADDR argument. The second optional argument is any integer expression. Note that these 2 arguments must be separated by a space. In the below example, the pointers to the 'tree block A' (see example in command Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  

• is shown before the tree was leaked. The descriptions are detailed as the option Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  18 was given at Valgrind startup. The second call shows the pointers (start and interior pointers) to block G. The block G (0x40281A8) is reachable via block C (0x40280a8) and register ECX of tid 1 (tid is the Valgrind thread id). It is "interior reachable" via the register EBX.

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 1 When Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  66 finds an interior pointer, it will report the heuristic(s) with which this interior pointer will be considered as reachable. Note that this is done independently of the value of the option Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  38. In the below example, the loss record 6 indicates a possibly lost block. Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  66 reports that there is an interior pointer pointing in this block, and that the block can be considered reachable using the heuristic Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

• include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 2
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  74 requests Memcheck tool to produce an xtree heap memory report. See for a detailed explanation about execution trees.

4.7. Client Requests

The following client requests are defined in

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

75. See

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

75 for exact details of their arguments.

• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  77,

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 55 and

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 54. These mark address ranges as completely inaccessible, accessible but containing undefined data, and accessible and containing defined data, respectively. They return -1, when run on Valgrind and 0 otherwise.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  80. This is just like

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 54 but only affects those bytes that are already addressable.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  82 and Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  83: check immediately whether or not the given address range has the relevant property, and if not, print an error message. Also, for the convenience of the client, returns zero if the relevant property holds; otherwise, the returned value is the address of the first byte for which the property is not true. Always returns 0 when not run on Valgrind.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  84: a quick and easy way to find out whether Valgrind thinks a particular value (lvalue, to be precise) is addressable and defined. Prints an error message if not. It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  85: does a full memory leak check (like Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)
• right now. This is useful for incrementally checking for leaks between arbitrary places in the program's execution. It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  87: same as Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  88 but only shows the entries for which there was an increase in leaked bytes or leaked number of blocks since the previous leak search. It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  89: same as Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  85 but only shows the entries for which there was an increase or decrease in leaked bytes or leaked number of blocks since the previous leak search. It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  91: same as Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  88 but only shows the new entries since the previous leak search. It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  93: like Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  85, except it produces only a leak summary (like Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  95). It has no return value.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  96: fills in the four arguments with the number of bytes of memory found by the previous leak check to be leaked (i.e. the sum of direct leaks and indirect leaks), dubious, reachable and suppressed. This is useful in test harness code, after calling Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  85 or Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  93.
• Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  99: identical to Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  96 except that it returns the number of blocks rather than the number of bytes in each category.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 01 and Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 02: allow you to get and set the V (validity) bits for an address range. You should probably only set V bits that you have got with Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 01. Only for those who really know what they are doing.
• Invalid free()

  at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 04 and Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 05. Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 04 takes an address, a number of bytes and a character string. The specified address range is then associated with that string. When Memcheck reports an invalid access to an address in the range, it will describe it in terms of this block rather than in terms of any other block it knows about. Note that the use of this macro does not actually change the state of memory in any way -- it merely gives a name for the range. At some point you may want Memcheck to stop reporting errors in terms of the block named by Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 04. To make this possible, Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 04 returns a "block handle", which is a C

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 44 value. You can pass this block handle to Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 05. After doing so, Valgrind will no longer relate addressing errors in the specified range to the block. Passing invalid handles to Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 05 is harmless.

4.8. Memory Pools: describing and working with custom allocators

Some programs use custom memory allocators, often for performance reasons. Left to itself, Memcheck is unable to understand the behaviour of custom allocation schemes as well as it understands the standard allocators, and so may miss errors and leaks in your program. What this section describes is a way to give Memcheck enough of a description of your custom allocator that it can make at least some sense of what is happening.

There are many different sorts of custom allocator, so Memcheck attempts to reason about them using a loose, abstract model. We use the following terminology when describing custom allocation systems:

• Custom allocation involves a set of independent "memory pools".
• Memcheck's notion of a a memory pool consists of a single "anchor address" and a set of non-overlapping "chunks" associated with the anchor address.
• Typically a pool's anchor address is the address of a book-keeping "header" structure.
• Typically the pool's chunks are drawn from a contiguous "superblock" acquired through the system

  Syscall param write(buf) points to uninitialised byte(s)

   at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)  
   by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)  
   by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)  
  

  Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

   at 0x259852B0: malloc (vg_replace_malloc.c:130)  
   by 0x80483F1: main (a.c:5)  
  

  Syscall param exit(error_code) contains uninitialised byte(s)

   at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)  
   by 0x8048426: main (a.c:8)  
  

  1 or

  include

  include

  int main( void ) {

  char* arr  = malloc(10);  
  int*  arr2 = malloc(sizeof(int));  
  write( 1 / stdout /, arr, 10 );  
  exit(arr2[0]);  
  

  } 62.

Keep in mind that the last two points above say "typically": the Valgrind mempool client request API is intentionally vague about the exact structure of a mempool. There is no specific mention made of headers or superblocks. Nevertheless, the following picture may help elucidate the intention of the terms in the API:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

3

Note that the header and the superblock may be contiguous or discontiguous, and there may be multiple superblocks associated with a single header; such variations are opaque to Memcheck. The API only requires that your allocation scheme can present sensible values of "pool", "addr" and "size".

Typically, before making client requests related to mempools, a client program will have allocated such a header and superblock for their mempool, and marked the superblock NOACCESS using the

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

77 client request.

When dealing with mempools, the goal is to maintain a particular invariant condition: that Memcheck believes the unallocated portions of the pool's superblock (including redzones) are NOACCESS. To maintain this invariant, the client program must ensure that the superblock starts out in that state; Memcheck cannot make it so, since Memcheck never explicitly learns about the superblock of a pool, only the allocated chunks within the pool.

Once the header and superblock for a pool are established and properly marked, there are a number of client requests programs can use to inform Memcheck about changes to the state of a mempool:

• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 15: This request registers the address Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16 as the anchor address for a memory pool. It also provides a size Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 17, specifying how large the redzones placed around chunks allocated from the pool should be. Finally, it provides an Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 18 argument that specifies whether the pool's chunks are zeroed (more precisely: defined) when allocated. Upon completion of this request, no chunks are associated with the pool. The request simply tells Memcheck that the pool exists, so that subsequent calls can refer to it as a pool.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 19: Create a memory pool with some flags (that can be OR-ed together) specifying extended behaviour. When flags is zero, the behaviour is identical to Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)
• • The flag Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    21 specifies that the pieces of memory associated with the pool using Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    22 will be used by the application as superblocks to dole out MALLOC_LIKE blocks using Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    23. In other words, a meta pool is a "2 levels" pool : first level is the blocks described by Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    22. The second level blocks are described using Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    23. Note that the association between the pool and the second level blocks is implicit : second level blocks will be located inside first level blocks. It is necessary to use the Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    21 flag for such 2 levels pools, as otherwise valgrind will detect overlapping memory blocks, and will abort execution (e.g. during leak search).
  • Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    27. Such a meta pool can also be marked as an 'auto free' pool using the flag Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    27, which must be OR-ed together with the Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    21. For an 'auto free' pool, Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    30 will automatically free the second level blocks that are contained inside the first level block freed with Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    30. In other words, calling Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    30 will cause implicit calls to Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    33 for all the second level blocks included in the first level block. Note: it is an error to use the Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    27 flag without the Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    21 flag.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 36: This request tells Memcheck that a pool is being torn down. Memcheck then removes all records of chunks associated with the pool, as well as its record of the pool's existence. While destroying its records of a mempool, Memcheck resets the redzones of any live chunks in the pool to NOACCESS.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 37: This request informs Memcheck that a Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 2-byte chunk has been allocated at Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 39, and associates the chunk with the specified Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16. If the pool was created with nonzero Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 17 redzones, Memcheck will mark the Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 17 bytes before and after the chunk as NOACCESS. If the pool was created with the Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 18 argument set, Memcheck will mark the chunk as DEFINED, otherwise Memcheck will mark the chunk as UNDEFINED.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 44: This request informs Memcheck that the chunk at Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 39 should no longer be considered allocated. Memcheck will mark the chunk associated with Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 39 as NOACCESS, and delete its record of the chunk's existence.
• Invalid free()

  at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 47: This request trims the chunks associated with Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16. The request only operates on chunks associated with Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16. Trimming is formally defined as:

  • All chunks entirely inside the range Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    50 are preserved.
  • All chunks entirely outside the range Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    50 are discarded, as though Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    30 was called on them.
  • All other chunks must intersect with the range Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    

    50; areas outside the intersection are marked as NOACCESS, as though they had been independently freed with Invalid free()

      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  
    Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd  
      at 0x4004FFDF: free (vg_clientmalloc.c:577)  
      by 0x80484C7: main (tests/doublefree.c:10)  

  • This is a somewhat rare request, but can be useful in implementing the type of mass-free operations common in custom LIFO allocators.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 55: This request informs Memcheck that the pool previously anchored at address Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 56 has moved to anchor address Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 57. This is a rare request, typically only needed if you ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6 the header of a mempool. No memory-status bits are altered by this request.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 59: This request informs Memcheck that the chunk previously allocated at address Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 60 within Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16 has been moved and/or resized, and should be changed to cover the region Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 62. This is a rare request, typically only needed if you ==32233== Argument 'size' of function malloc has a fishy (possibly negative) value: -3 ==32233== at 0x4C2CFA7: malloc (vg_replace_malloc.c:298) ==32233== by 0x400555: foo (fishy.c:15) ==32233== by 0x400583: main (fishy.c:23) 6 a superblock or wish to extend a chunk without changing its memory-status bits. No memory-status bits are altered by this request.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 64: This request informs the caller whether or not Memcheck is currently tracking a mempool at anchor address Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 16. It evaluates to 1 when there is a mempool associated with that address, 0 otherwise. This is a rare request, only useful in circumstances when client code might have lost track of the set of active mempools.

4.9. Debugging MPI Parallel Programs with Valgrind

Memcheck supports debugging of distributed-memory applications which use the MPI message passing standard. This support consists of a library of wrapper functions for the

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

66 interface. When incorporated into the application's address space, either by direct linking or by

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

67, the wrappers intercept calls to

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

68,

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

69, etc. They then use client requests to inform Memcheck of memory state changes caused by the function being wrapped. This reduces the number of false positives that Memcheck otherwise typically reports for MPI applications.

The wrappers also take the opportunity to carefully check size and definedness of buffers passed as arguments to MPI functions, hence detecting errors such as passing undefined data to

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

68, or receiving data into a buffer which is too small.

Unlike most of the rest of Valgrind, the wrapper library is subject to a BSD-style license, so you can link it into any code base you like. See the top of

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

71 for license details.

4.9.1. Building and installing the wrappers

The wrapper library will be built automatically if possible. Valgrind's configure script will look for a suitable

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72 to build it with. This must be the same

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72 you use to build the MPI application you want to debug. By default, Valgrind tries

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72, but you can specify a different one by using the configure-time option

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

75. Currently the wrappers are only buildable with

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72s which are based on GNU GCC or Intel's C++ Compiler.

Check that the configure script prints a line like this:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

4

If it says

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

77, your

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72 has failed to compile and link a test MPI2 program.

If the configure test succeeds, continue in the usual way with

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

79 and

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

80. The final install tree should then contain

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

81.

Compile up a test MPI program (eg, MPI hello-world) and try this:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

5

You should see something similar to the following

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

6

repeated for every process in the group. If you do not see these, there is an build/installation problem of some kind.

The MPI functions to be wrapped are assumed to be in an ELF shared object with soname matching

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

82. This is known to be correct at least for Open MPI and Quadrics MPI, and can easily be changed if required.

4.9.2. Getting started

Compile your MPI application as usual, taking care to link it using the same

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

72 that your Valgrind build was configured with.

Use the following basic scheme to run your application on Valgrind with the wrappers engaged:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

7

As an alternative to

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

67ing

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

81, you can simply link it to your application if desired. This should not disturb native behaviour of your application in any way.

4.9.3. Controlling the wrapper library

Environment variable

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

86 is consulted at startup. The default behaviour is to print a starting banner

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

8

and then be relatively quiet.

You can give a list of comma-separated options in

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

86. These are

• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 88: show entries/exits of all wrappers. Also show extra debugging info, such as the status of outstanding Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 89s resulting from uncompleted Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 90s.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 91: opposite of Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 88, only print anything when the wrappers want to report a detected programming error, or in case of catastrophic failure of the wrappers.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 93: by default, functions which lack proper wrappers are not commented on, just silently ignored. This causes a warning to be printed for each unwrapped function used, up to a maximum of three warnings per function.
• Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) 94: print an error message and abort the program if a function lacking a wrapper is used.

If you want to use Valgrind's XML output facility (

Conditional jump or move depends on uninitialised value(s) at 0x402DFA94: _IO_vfprintf (_itoa.h:49) by 0x402E8476: _IO_printf (printf.c:36) by 0x8048472: main (tests/manuel1.c:8)

71), you should pass

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

91 in

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

86 so as to get rid of any extraneous printing from the wrappers.

4.9.4. Functions

All MPI2 functions except

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

98,

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

99 and

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

00 have wrappers. The first two are not wrapped because they return a

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

01, which Valgrind's function-wrap mechanism cannot handle (but it could easily be extended to do so).

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

00 cannot be wrapped as it has variable arity:

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

03

Most functions are wrapped with a default wrapper which does nothing except complain or abort if it is called, depending on settings in

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

86 listed above. The following functions have "real", do-something-useful wrappers:

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

9

A few functions such as

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

05 are listed as

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

06. They have no wrapper at all as there is nothing worth checking, and giving a no-op wrapper would reduce performance for no reason.

Note that the wrapper library itself can itself generate large numbers of calls to the MPI implementation, especially when walking complex types. The most common functions called are

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

07,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

08,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

09, and

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

10.

4.9.5. Types

MPI-1.1 structured types are supported, and walked exactly. The currently supported combiners are

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

11,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

12,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

13,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

14

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

15,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

16 and

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

17. This should cover all MPI-1.1 types. The mechanism (function

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

18. should extend easily to cover MPI2 combiners.

MPI defines some named structured types (

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

19,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

20,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

21,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

22,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

23,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

24. which are pairs of some basic type and a C

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

44. Unfortunately the MPI specification makes it impossible to look inside these types and see where the fields are. Therefore these wrappers assume the types are laid out as

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

26 (for

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

19), etc, and act accordingly. This appears to be correct at least for Open MPI 1.0.2 and for Quadrics MPI.

If

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

94 is an option specified in

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

86, the application will abort if an unhandled type is encountered. Otherwise, the application will print a warning message and continue.

Some effort is made to mark/check memory ranges corresponding to arrays of values in a single pass. This is important for performance since asking Valgrind to mark/check any range, no matter how small, carries quite a large constant cost. This optimisation is applied to arrays of primitive types (

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

01,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

31,

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

44,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

33,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

34,

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

35,

include

include

int main( void ) {

char* arr  = malloc(10);
int*  arr2 = malloc(sizeof(int));
write( 1 /* stdout */, arr, 10 );
exit(arr2[0]);

}

45, and

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

37 on platforms where

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

38). For arrays of all other types, the wrappers handle each element individually and so there can be a very large performance cost.

4.9.6. Writing new wrappers

For the most part the wrappers are straightforward. The only significant complexity arises with nonblocking receives.

The issue is that

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

90 states the recv buffer and returns immediately, giving a handle (

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

89. for the transaction. Later the user will have to poll for completion with

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

41 etc, and when the transaction completes successfully, the wrappers have to paint the recv buffer. But the recv buffer details are not presented to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

41 -- only the handle is. The library therefore maintains a shadow table which associates uncompleted

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

89s with the corresponding buffer address/count/type. When an operation completes, the table is searched for the associated address/count/type info, and memory is marked accordingly.

Access to the table is guarded by a (POSIX pthreads) lock, so as to make the library thread-safe.

The table is allocated with

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

1 and never

Syscall param write(buf) points to uninitialised byte(s)

 at 0x25A48723: __write_nocancel (in /lib/tls/libc-2.3.3.so)
 by 0x259AFAD3: __libc_start_main (in /lib/tls/libc-2.3.3.so)
 by 0x8048348: (within /auto/homes/njn25/grind/head4/a.out)

Address 0x25AB8028 is 0 bytes inside a block of size 10 alloc'd

 at 0x259852B0: malloc (vg_replace_malloc.c:130)
 by 0x80483F1: main (a.c:5)

Syscall param exit(error_code) contains uninitialised byte(s)

 at 0x25A21B44: __GI__exit (in /lib/tls/libc-2.3.3.so)
 by 0x8048426: main (a.c:8)

4d, so it will show up in leak checks.

Writing new wrappers should be fairly easy. The source file is

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

71. If possible, find an existing wrapper for a function of similar behaviour to the one you want to wrap, and use it as a starting point. The wrappers are organised in sections in the same order as the MPI 1.1 spec, to aid navigation. When adding a wrapper, remember to comment out the definition of the default wrapper in the long list of defaults at the bottom of the file (do not remove it, just comment it out).

4.9.7. What to expect when using the wrappers

The wrappers should reduce Memcheck's false-error rate on MPI applications. Because the wrapping is done at the MPI interface, there will still potentially be a large number of errors reported in the MPI implementation below the interface. The best you can do is try to suppress them.

You may also find that the input-side (buffer length/definedness) checks find errors in your MPI use, for example passing too short a buffer to

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

47.

Functions which are not wrapped may increase the false error rate. A possible approach is to run with

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

48 containing

Invalid free() at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10) Address 0x3807F7B4 is 0 bytes inside a block of size 177 free'd at 0x4004FFDF: free (vg_clientmalloc.c:577) by 0x80484C7: main (tests/doublefree.c:10)

93. This will show you functions which lack proper wrappers but which are nevertheless used. You can then write wrappers for them.

A known source of potential false errors are the

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

50 family of functions, when using a custom (user-defined) reduction function. In a reduction operation, each node notionally sends data to a "central point" which uses the specified reduction function to merge the data items into a single item. Hence, in general, data is passed between nodes and fed to the reduction function, but the wrapper library cannot mark the transferred data as initialised before it is handed to the reduction function, because all that happens "inside" the

Mismatched free() / delete / delete [] at 0x40043249: free (vg_clientfuncs.c:171) by 0x4102BB4E: QGArray::~QGArray(void) (tools/qgarray.cpp:149) by 0x4C261C41: PptDoc::~PptDoc(void) (include/qmemarray.h:60) by 0x4C261F0E: PptXml::~PptXml(void) (pptxml.cc:44) Address 0x4BB292A8 is 0 bytes inside a block of size 64 alloc'd at 0x4004318C: operator new (vg_clientfuncs.c:152) by 0x4C21BC15: KLaola::readSBStream(int) const (klaola.cc:314) by 0x4C21C155: KLaola::stream(KLaola::OLENode const *) (klaola.cc:416) by 0x4C21788F: OLEFilter::convert(QCString const &) (olefilter.cc:272)

50 call. As a result you may see false positives reported in your reduction function.