實例
英文介紹
段錯誤A segmentation fault (often shortened to segfault) is a particular error condition that can occur during the operation of computer software. In short, a segmentation fault occurs when a program attempts to access a memory location that it is not allowed to access, or attempts to access a memory location in a way that is not allowed (e.g., attempts to write to a read-only location, or to overwrite part of the operating system). Systems based on processors like the Motorola 68000 tend to refer to these events as Address or Bus errors.
Segmentation is one approach to memory management and protection in the operating system. It has been superseded by paging for most purposes, but much of the terminology of segmentation is still used, "segmentation fault" being an example. Some operating systems still have segmentation at some logical level although paging is used as the main memory management policy.
On Unix-like operating systems, a process that accesses invalid memory receives the SIGSEGV signal. On Microsoft Windows, a process that accesses invalid memory receives the STATUS_ACCESS_VIOLATION exception.
另外，這裡有個基本上對照的中文解釋，來自庫擴展閱讀1；
Quote
一旦一個程式發生了越界訪問，cpu就會產生相應的保護，於是segmentation fault就出現
了通過上面的解釋，段錯誤應該就是訪問了不可訪問的記憶體，這個記憶體區要么是不存在的，
要么是受到系統保護的，還有可能是缺少檔案或者檔案損壞。
段錯誤形式
在編程中以下幾類做法容易導致段錯誤,基本上是錯誤地使用指針引起的。
1) 訪問 系統數據區，尤其是往系統保護的記憶體地址寫數據最常見就是給一個指針以0地址。
2) 記憶體越界(數組越界，變數類型不一致等)： 訪問到不屬於你的記憶體區域。
解決方法：我們在用C/C++語言寫程式的時候，記憶體管理的絕大部分工作都是需要我們來做的。實際上，記憶體管理是一個比較繁瑣的工作，無論你多高明，經驗多豐富，難免會在此處犯些小錯誤，而通常這些錯誤又是那么的淺顯而易於消除。但是手工“除蟲”（debug），往往是效率低下且讓人厭煩的，本文將就"段錯誤"這個記憶體訪問越界的錯誤談談如何快速定位這些"段錯誤"的語句。
下面將就以下的一個存在段錯誤的程式介紹幾種調試方法：
| 1 dummy_function (void) 2 { 3 unsigned char *ptr = 0x00; 4 *ptr = 0x00; 5 } 6 7 int main (void) 8 { 9 dummy_function (); 10 11 return 0; 12 } |
作為一個熟練的C/C++程式設計師，以上代碼的bug應該是很清楚的，因為它嘗試操作地址為0的記憶體區域，而這個記憶體區域通常是不可訪問的禁區，當然就會出錯了。我們嘗試編譯運行它:
| xiaosuo@gentux test $ ./a.out 段錯誤 |
出錯並退出。
查找段錯誤
這種方法也是被大眾所熟知並廣泛採用的方法，首先我們需要一個帶有調試信息的可執行程式，所以我們加上“-g -rdynamic"的參數進行編譯，然後用gdb調試運行這個新編譯的程式,具體步驟如下:
| xiaosuo@gentux test $ gcc -g -rdynamic d.c xiaosuo@gentux test $ gdb ./a.out GNU gdb 6.5 Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"...Using host libthread_db library "/lib/libthread (gdb) r Starting program: /home/xiaosuo/test/a.out Program received signal SIGSEGV, Segmentation fault. 0x08048524 in dummy_function () at d.c:4 4 *ptr = 0x00; (gdb) |
不用一步步調試我們就找到了出錯位置d.c檔案的第4行，其實就是如此的簡單。
從這裡我們還發現進程是由於收到了SIGSEGV信號而結束的。通過進一步的查閱文檔(man 7 signal)，我們知道SIGSEGV默認handler的動作是列印”段錯誤"的出錯信息，並產生Core檔案，由此我們又產生了方法二。
分析檔案
| The default action of certain signals is to cause a process to terminate and produce a core dump file, a disk file containing an image of the process's memory at the time of termination. A list of the signals which cause a process to dump core can be found in signal(7). |
以 上資料摘自man page(man 5 core)。不過奇怪了，我的系統上並沒有找到core檔案。後來，憶起為了漸少系統上的垃圾檔案的數量，禁止了core檔案的生成，查看了以下果真如此，將系統的core檔案的大小限制在512K大小，再試:
| xiaosuo@gentux test $ ulimit -c 0 xiaosuo@gentux test $ ulimit -c 1000 xiaosuo@gentux test $ ulimit -c 1000 xiaosuo@gentux test $ ./a.out 段錯誤 (core dumped) xiaosuo@gentux test $ ls a.out core d.c f.c g.c pango.c test_iconv.c test_regex.c |
core檔案終於產生了，用gdb調試一下看看吧:
| xiaosuo@gentux test $ gdb ./a.out core GNU gdb 6.5 Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"...Using host libthread_db library "/lib/libthread. warning: Can't read pathname for load map: 輸入/輸出錯誤。 Reading symbols from /lib/lib6...done. Loaded symbols for /lib/li6 Reading symbols from /lib/ld-.2...done. Loaded symbols for /lib/ld-linux.s2 Core was generated by `./a.out'. Program terminated with signal 11, Segmentation fault. #0 0x08048524 in dummy_function () at d.c:4 4 *ptr = 0x00;dfg |
分析工具
利用backtrace和objdump進行分析
#include <execinfo.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
/* A dummy function to make the backtrace more interesting. */
void
dummy_function (void)
{
unsigned char *ptr = 0x00;
*ptr = 0x00;
}
void dump(int signo)
{
void *array[10];
size_t size;
char **strings;
size_t i;
size = backtrace (array, 10);
strings = backtrace_symbols (array, size);
printf ("Obtained %zd stack frames.\n", size);
for (i = 0; i < size; i++)
printf ("%s\n", strings[i]);
free (strings);
exit(0);
}
int
main (void)
{
signal(SIGSEGV, &dump);
dummy_function ();
return 0;
}
運行結果：xiaosuo@gentux test $ gcc -g -rdynamic g.c
xiaosuo@gentux test $ ./a.out
Obtained 5 stack frames.
./a.out(dump+0x19) [0x80486c2]
[0xffffe420]
./a.out(main+0x35) [0x804876f]
典型段錯誤
1，int main(void){
char*s ="hello world";
*s ="H";
}
被裝載時，系統把“hello world” 連同其它的字元串和const型數據放入到記憶體的唯讀區。執行時，一個變數s被設為指向該字元串的位置，當再試圖向該位置寫時，就會產生段錯誤。
2，
int*ptr = NULL;
*ptr =1;
因為該代碼只創建了一個空指針，並沒有指向一個具體空間，當賦值時，產生段錯誤。
3，
int main(void){
main();
return0;
}
無限遞歸，這會導致棧溢出，也會產生段錯誤。
