2. A line of code that you haven't tested is a line of code with a bug.
Cardinal rule for debugging: If you are using gcc or g++, compile your program with -g option.
(Btw, to link a library with gcc, you use -l option. Eg: to link math library, use:
gcc filename -o outputfile -lm)
Segmentation Faults:
Any access outside that area (memory area assigned to the program) will cause a segmentation fault.
Common mistakes of segmentation faults:
1. Deferencing
a. NULL
b. an uninitialized pointer
c. a pointer that has been freed (or deleted, in C++) or that has gone out of scope (in the case of arrays declared in functions)
2. writing off the end of an array
3. Calling a recursive function that uses all of the stack space (On some systems, this will cause a "stack overflow" report)
Attacking segfaults:
1.a Deferencing NULL
$gdb myPgm core
The core file contains all the information needed by GDB to reconstruct the state of execution when the invalid operation caused a segmentation fault.
It will o/p:
Some copyright infoThis tells us that the execution stopped inside the function called foo() on line 4, which happened to be the assignment of the number 3 to the location pointed to by x.
Core was generated by `myPgm'.
Program terminated with signal 11, Segmentation fault.
Some information about loading symbols
#0 0x0804838c in foo() () at myPgm.cpp:4
4 *x = 3;
(gdb) list
1 void foo()
2 {
3 char *x = 0;
4 *x = 3;
5 }
6
7 int main()
8 {
9 foo();
10 return 0;
(gdb) print x
$1 = 0x0
A little complicated eg: execution crashing inside a system call or library function (perhaps because we passed an uninitialized pointer)
#0 0x40194f93 in strcat () from /lib/tls/libc.so.6so now we are in strcat stack but we want to see variable that was passed to strcat:
(gdb) bt
#0 0x40194f93 in strcat () from /lib/tls/libc.so.6
#1 0x080483c9 in foo() () at t.cpp:6
#2 0x080483e3 in main () at t.cpp:11
(gdb) upA common mistake is to not check the return from malloc to make sure that the system isn't out of memory. Another common mistake is to assume that a function that calls malloc doesn't return NULL even though it returns the result of malloc. Note that in C++, when you call new, it will throw an exception, bad_alloc, if sufficient memory cannot be allocated. Your code should be prepared to handle this situation cleanly, and if you choose to catch the exception and return NULL inside a function that ordinarily returns a new'ed pointer, this advice still holds.
#1 0x080483c9 in foo() () at t.cpp:6
6 strcat(x, "end");
(gdb) print x
$1 = 0x0
1.b Deferencing an uninitialized pointer
Figuring out whether or not a pointer has been initialized is a bit harder than figuring out whether a pointer is NULL. The best way to avoid using an uninitialized pointer is to set your pointers to NULL when you declare them (or immediately initialize them).
You might need to figure out if 0x4025e800 is valid memory. One way you can get a sense of this in GDB is by printing out the addresses stored in other pointers you've allocated. If they're fairly close together, you've probably correctly allocated memory. Of course, there's no guarantee that this rule of thumb will hold on all systems.
In some cases, your debugger can tell you that an address is invalid based on the value stored in the pointer.
(gdb) print x1.c Dereferencing Freed Memory
$1 = 0x1e <out of bounds>
(gdb) print *x
Cannot access memory at address 0x1e
This is another tricky bug to find because you're working with memory addresses that look valid. The best way to handle such a situation is again preventative: set your pointer to point to NULL as soon as you've freed it.
Another form of this bug is the problem of dealing with memory that has gone out of scope.
char *return_buffer()This is a really tricky bug to find because once again the memory address will look valid when you print it out in GDB.
{
char x[10];
strncpy(x, "a string", sizeof(x));
return x;
}
If that pointer is causing you trouble, check the function and look for whether the pointer is pointing to a local variable in the function. Note that it is perfectly fine to return a pointer to memory allocated in the function using new or malloc, but not to return a pointer to a statically declared array (e.g., char x[10]).
2. writing off the end of an array
Valgrind will help you catch this bug on dynamically allocated arrays. See point 2 below.
Trick:
If notice that some of your variable values are changing periodically and unexpectedly. This is a tough bug to crack; one option is to set up your debugger to watch a variable for changes and run your program until the variable's value changes. Your debugger will break on that instruction, and you can poke around to figure out if that behavior is unexpected.
(gdb) watch [variable name]This approach can get tricky when you're dealing with a lot of dynamically allocated memory and it's not entirely clear what you should watch.
Hardware watchpoint 1: [variable name]
(gdb) continue
...
Hardware watchpoint 1: [variable name]
Old value = [value1]
New value = [value2]
3. Stack overflow:
To diagnose a stack overflow in GDB, typically you just need to do a backtrace. If you find a single function call piling up an awfully large number of times, this is a good indication of a stack overflow.
(gdb) backtraceTypically, you need to analyze your recursive function to make sure that all the base cases (the cases in which the function should not call itself) are covered correctly.
#0 foo() () at t.cpp:5
#1 0x08048404 in foo() () at t.cpp:5
#2 0x08048404 in foo() () at t.cpp:5
#3 0x08048404 in foo() () at t.cpp:5
[...]
#20 0x08048404 in foo() () at t.cpp:5
#21 0x08048404 in foo() () at t.cpp:5
#22 0x08048404 in foo() () at t.cpp:5
---Type to continue, or q to quit---
Other cool tricks with gdb:
We discussed bt, p (print), list, up
To set a breakpoint, type break <line number>
<line number> can be <sourcefile>:<line number>
Use n (or next) to progress through the loop one line at a time, r to run the program and c to continue.
There is also another set of commands, although they are not very commonly used; these commands actually modify the program as it is running. The call command, for example, will call a particular function; the set variable command will set a variable in the program to a particular value, for example, set variable i = 0. Return will make the current function return to the caller.
Using valgrind:
1. Finding memory leaks:
Compile your program with -g option.
$valgrind --tool=memcheck program_nameIf number of allocs and the number of frees will differ in o/p, the try
$valgrind --tool=memcheck --leak-check=yes --show-reachable=yes program_name
O/p is somewhat like:
==pid== 100 bytes in 1 blocks are definitely lost in loss record 1 of 1This means that there is a memory leak at line 5 in myPgm.c
==pid== at 0x1B900DD0: malloc (vg_replace_malloc.c:131)
==pid== by 0x804840F: main (myPgm.c:5)
2. Finding invalid pointers:
Warning of form:
'Invalid read of size X'or 'Invalid write of size X'
where X is the amount of memory we try to read.
Eg: if you allocate an array with malloc or new and then try to access a location past the end of the array:
This will give o/p:int main()
{
char *x = malloc(10);
x[10] = 'a';
return 0;
}
$valgrind --tool=memcheck --leak-check=yes --show-reachable=yes program_name
==pid== Invalid write of size 13. Detecting the use of uninitialized variables:
==pid== at 0x804841E: main (myPgm2.c:6)
==pid== Address 0x1BA3607A is 0 bytes after a block of size 10 alloc'd
==pid== at 0x1B900DD0: malloc (vg_replace_malloc.c:131)
==pid== by 0x804840F: main (myPgm2.c:5)
Warning: 'uninitialised' value(s)
Eg:
o/p:int foo(int x)
{
if(x < 10)
{
printf("x is less than 10\n");
}
}
int main()
{
int y;
foo(y);
}
==pid== Conditional jump or move depends on uninitialised value(s)4. Other improper use of memory:
==pid== at 0x8048366: foo (myPgm3.c:5)
==pid== by 0x8048394: main (myPgm3.c:14)
4.a: If you call free twice on the same pointer value, Valgrind will detect this for you; you'll get an error:
Invalid free()This is also called "double free attack":
free(x);The easiest way to avoid it is simply to set your pointer to point to NULL once you've freed it:
/* code */
free(x);
free(x); x = NULL;
/* code */
free(x);
4.b: free should be matched with corresponding malloc. Similarly, delete with new and delete[] with new[].
If you do mismatch, you will get following error:
Mismatched free() / delete / delete []What won't Valgrind find?
Valgrind doesn't perform bounds checking on static arrays (allocated on the stack).
Eg:
int main()Valgrind won't alert you!
{
char x[10];
x[11] = 'a';
}
Also, if you don't test for buffer overflows by using long input strings, Valgrind won't tell you that your code is capable of writing over memory that it shouldn't be touching.
------------------------
Some common bugs in C/C++:
1. Uninitialized variables
2. Using a single equal sign to check equality:
while(x='Y') { ....}
int x;4. Overstepping array boundaries (especially if it static array):
for(x=0; x<100; x++);
Do something with x;
int array[10];
//...
for(int x=1; x<=10; x++) do something with array[x];
-------------------------
Make file: Simple eg:
CC = gcc
FILES = in_one.c in_two.c
OUT_EXE = out_executable
build: $(FILES)
$(CC) -o $(OUT_EXE) $(FILES)
clean:
rm -f *.o core
rebuild: clean build
Advanced eg:
1. $@ is the name of the target.
client: client.c
$(CC) client.c -o $@
server: server.c
$(CC) server.c -o $@
List of dependents
$? - more recent than the target(i.e., those that have changed since the last time make was invoked for the given target)
$^ - all dependencies, regardless of whether they are more recent than the target, but removes duplicate names
$+ - like $^, but it keeps duplicates
$> - first dependency
Wildcard Matching in Targets (percent sign, %)
When a % appears in the dependencies list, it replaces the same string of text throughout the command in makefile target. If you wish to use the matched text in the target itself, use the special variable $*.
Eg:
%.c:Implicit Targets
gcc -o $* $*.c
.c:This rule says that for any target that corresponds to a .c file, make should compile it using the name of the implicit target as the output, and the name plus the .c extension as the file to compile.
$(CC) -o $@ $@.c
Replacing Text
To specify that OBJ is equivalent to SRC, except with the .c extension replaced with a .o extension:
OBJ = $(SRC:.c=.o)
Visit CProgramming.com for more details
