Std :: string :: assign () calls segfault

Question

I have a std::vector<uint8_t> that contains strings at certain offsets. The dump is shortened here:

 ... @128 00 00 00 00 00 00 00 00 73 6F 6D 65 74 68 69 33 ........somethin @144 38 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ng.............. @160 00 00 00 00 00 00 00 00 31 2E 32 2E 33 00 00 00 ........1.2.3... @176 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ ... 

I am trying to extract data with offset 136 and put it in std::string :

 std::string x; x.assign(vec.begin()+136, vec.begin()+168); 

This, however, leads to my segfault application. Now I am pretty new to Linux software development, but I know how to run my application in GDB and get the backtrace, and tracked the problem here:

 (gdb) backtrace #0 0xb7536d78 in ?? () from /lib/i686/cmov/libc.so.6 #1 0xb7538cd5 in malloc () from /lib/i686/cmov/libc.so.6 #2 0xb7708957 in operator new(unsigned int) () from /usr/lib/libstdc++.so.6 #3 0xb76e4146 in std::string::_Rep::_S_create(unsigned int, unsigned int, std::allocator<char> const&) () from /usr/lib/libstdc++.so.6 #4 0xb76e63b0 in std::string::_M_mutate(unsigned int, unsigned int, unsigned int) () from /usr/lib/libstdc++.so.6 #5 0xb76e654a in std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) () from /usr/lib/libstdc++.so.6 #6 0x0806d651 in std::string::_M_replace_dispatch<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > > (this=0xbfffe464, __i1=..., __i2=..., __k1=..., __k2=...) at /usr/include/c++/4.3/bits/basic_string.tcc:637 #7 0x0806d26e in std::string::replace<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > > (this=0x811c730, vec=...) at /usr/include/c++/4.3/bits/basic_string.h:1390 #8 std::string::assign<__gnu_cxx::__normal_iterator<unsigned char const*, std::vector<unsigned char, std::allocator<unsigned char> > > > ( this=0x811c730, vec=...) at /usr/include/c++/4.3/bits/basic_string.h:958 #9 myclass::somemethod (this=0x811c730, vec=...) at myclass.cpp:135 

Printing vec.size() returns 200 and even cyclically moves around the vector, and printing data does not cause me any problems (it’s definitely a failure over the fragment!).

I am compiling in Debian with g ++ 4.3.4. Any pointers to what this problem might be?

Answer 1

There is probably an incorrect free / delete elsewhere in your code that still delays the symptom. When you use free memory, the operating system can continue to work as long as it sees fit.

Try running the program in valgrind. valgrind uses its own malloc and is free, so it can warn you of incorrect news and removes it. Be sure to compile without optimization and -g ¹ :

 g++ -g main.cc -o binary valgrind --leak-check=full ./binary 

Make sure you are not creating a pointer from a stack variable that is out of scope. For example, this is a common mistake among new developers:

 int *foo() { int a = 0; // do something to a here return &a; } 

As a goes out of scope, you return a pointer to freed memory.

---

¹ O -g , with manpage: Generate debugging information in the native format of the operating system (stabs, COFF, XCOFF or DWARF 2). GDB can work with this debugging information.