Thread: segmentation fault in memcpy

Hello everyone,


I am wondering if I met with segmentation fault in memcpy (Red Hat Linux). How to debug it? And what is the possible reason of segmentation fault -- source address error, destination address error or size error?

Sorry that my application is too large and I can not post all the codes.


thanks in advance,
George

also they can't overlap.

http://www.cplusplus.com/reference/c...ng/memcpy.html

Originally Posted by robwhit

also they can't overlap.

http://www.cplusplus.com/reference/c...ng/memcpy.html

However, an overlap will not cause a failure as segmentation fault in the memcpy itself.

I agree with Salem, it's a case of either bad pointers (NULL or uninitialized values) or "too much copy", i.e. copying past the end of the block of memory. Potentially "backwards" copy of string-literal would also cause this behaviour, e.g.

Code:

char *s = "Hello";
char   t[10];
...
   memcpy(s, t, 6);
...

Since s points to a string literal, which is read-only, it will segfault.

Getting the size calculation wrong is a classic one, as negative size will be HUGE amount of data, since size_t is a unsigned value, and "negative" unsigned values make huge positive numbers.

--
Mats

Hi Salem,

Originally Posted by Salem

Well one of the two pointers is either garbage or NULL, or the amount you're trying to copy is too much.

Use a debugger, break on that call, then examine the parameters.

Thanks for your advice. The memory address is not NULL and they seem to be valid address. The amount is correct, 4096 bytes.

I am wondering more detailed information about how to debug the source and destination buffer? How to debug? Any tricks or best practices?


regards,
George

Thanks robwhit,

Originally Posted by robwhit

also they can't overlap.

http://www.cplusplus.com/reference/c...ng/memcpy.html

I have checked that they are not overlap. Any ideas to debug?


regards,
George

Thanks Mats,

Originally Posted by matsp

However, an overlap will not cause a failure as segmentation fault in the memcpy itself.

I agree with Salem, it's a case of either bad pointers (NULL or uninitialized values) or "too much copy", i.e. copying past the end of the block of memory. Potentially "backwards" copy of string-literal would also cause this behaviour, e.g.

Code:

char *s = "Hello";
char   t[10];
...
   memcpy(s, t, 6);
...

Since s points to a string literal, which is read-only, it will segfault.

Getting the size calculation wrong is a classic one, as negative size will be HUGE amount of data, since size_t is a unsigned value, and "negative" unsigned values make huge positive numbers.

--
Mats

I have checked that the size is correct, 4096 bytes. The source buffer address and the destination buffer address are not zero -- seems valid address. I agree with you that they seem valid address, but may point to some invalid address.

Do you have any more detailed ideas to check or debug? How to detect they are not valid address? The source buffer and the destination buffer are all buffers on heap (not stack).


regards,
George

Thanks Salem,

Originally Posted by Salem

Post a stack trace then.
Run the program in gdb, then use the 'bt' command to print out the history of where it came from.

How do you know what a valid address looks like, when the evidence is that it segfaults? Two valid addresses with 4096 valid addresses after them would NOT segfault.

How do you know it is memcpy which is segfaulting anyway?

When there is a segmentation fault, there will be a core file generated. I used gdb <application name> <core file name> to debug, then using where command, I find the segmentation fault is from memcpy (reported by gdb).

The memory seems *valid*, because they are not zero. But I am interested to learn from you how to check in more details? Maybe the heap corruption? (source buffer and destination buffer are both heap buffers.)


regards,
George

Thanks iMalc,

Originally Posted by iMalc

Try writing code to copy only the first and last bytes of the block across. One or the other should fail.

I agree with you. I have debugged that even if I access the source buffer one by one (byte), there will be segmentation fault. So I think there should be something wrong with the source buffer.

The debug code I developed is something like,

Code:

char tmp;

for (int i = 0; i < 4096; i++)
{
    tmp = source_buffer [i];
}

Any ideas or comments?


regards,
George

Originally Posted by George2

Thanks iMalc,




I agree with you. I have debugged that even if I access the source buffer one by one (byte), there will be segmentation fault. So I think there should be something wrong with the source buffer.

The debug code I developed is something like,

Code:

char tmp;

for (int i = 0; i < 4096; i++)
{
    tmp = source_buffer [i];
}

Any ideas or comments?


regards,
George

That tells you that the source buffer isn't 4096 bytes long - how long is it (e.g. at what value of i does it crash)?

--
Mats