Valgrind — detecting memory errors

5.1.19 · Coding › C Programming

YEH tool exist kyun karta hai?

C tumhe raw pointers deta hai aur koi automatic memory management nahi hoti. CPU khushi se kisi bhi address par read/write karta hai; agar tumne malloc(10) kiya aur byte 11 likha, toh kuch turant crash nahi hoga — tum heap corrupt karte ho aur program "randomly" 5000 lines baad mar jata hai. Yeh bugs hote hain:

• Non-deterministic (heap layout aur timing par depend karte hain).
• Silent (koi compiler warning nahi, aksar koi crash nahi).

YEH kya track karta hai (core trick — shadow memory): Real memory ke har byte ke liye, Memcheck do bits of info rakhta hai:

• A-bits (Addressability): kya yeh byte abhi access karne ki ijazat hai?
• V-bits (Validity/defined-ness): kya is byte mein koi defined value hai, ya malloc ki garbage?

HOW Memcheck reason karta hai (first principles se derivation)

Yahan koi formula nahi hai — hamare paas ek decision procedure hai. Isko build karte hain.

Maano address $a$ aur access size $n$ hai. $a$ se shuru hokar $n$ bytes ke read ya write ke liye:

Agar koi bhi byte accessible nahi hai ⇒ Invalid read/write error.

Defined-ness ke liye, V-bits operations ke through propagate hote hain. Starting rules:

Leak rule (exit par mark-and-sweep): program khatam hone par, Memcheck ek GC-style scan karta hai. Ek heap block ho sakta hai:

• Still reachable: koi pointer uski taraf exist karta hai → "lost" leak nahi (lekin phir bhi unfreed).
• Definitely lost: koi bhi pointer kahin bhi uski taraf point nahi karta → tumne use leak kiya.
• Indirectly lost: sirf kisi doosre lost block ke through reachable.
• Possibly lost: sirf koi interior pointer uski taraf point karta hai.

Worked Example 1 — Heap buffer overflow

#include <stdlib.h>
int main(void) {
    int *a = malloc(5 * sizeof(int)); // 20 bytes, A-bits=1, V-bits=undef
    a[5] = 42;                         // writes bytes 20..23 -> A-bits=0!
    free(a);
    return 0;
}

Run: gcc -g -O0 prog.c && valgrind --leak-check=full ./a.out

Valgrind kehta hai:

Invalid write of size 4
   at main (prog.c:4)
 Address 0x... is 0 bytes after a block of size 20 alloc'd

Worked Example 2 — Use of uninitialised value

#include <stdio.h>
#include <stdlib.h>
int main(void) {
    int *p = malloc(sizeof(int)); // V-bits = undefined
    if (*p == 0)                  // branching on undefined value!
        printf("zero\n");
    free(p);
    return 0;
}

Conditional jump or move depends on uninitialised value(s)

Worked Example 3 — Memory leak

#include <stdlib.h>
int main(void) {
    char *buf = malloc(100);
    buf = malloc(200);   // first 100-byte block now unreachable
    free(buf);           // frees the 200, leaks the 100
    return 0;
}

LEAK SUMMARY:
   definitely lost: 100 bytes in 1 blocks

Flashcards

Connections

• malloc and free — woh allocations jo Valgrind shadow karta hai
• Pointers in C — invalid/dangling pointers woh hain jo A-bits guard karte hain
• Undefined Behaviour in C — kyun yeh bugs silent hote hain
• Stack vs Heap — Memcheck mainly heap ko police karta hai
• AddressSanitizer (ASan) — compiler-based alternative, faster, alag trade-offs
• Debugging with GDB — root-cause analysis ke liye Valgrind ke saath pair karo

Concept Map