I'm trying to detect "Use after free()" bugs, otherwise known as "Dangling pointers". I know Valgrind can be used to detect "Use after free" bugs on the *nix platform, but what about windows? What if I don't have the source? Is there a better program than Valgrind for detecting all dangling pointers in a program? A free and open source would be preferred , but I'll use a commercial solution if it will get the job done.
9 Answers
The MSVC debug memory allocator already does this. When you get 0xfeeefeee from a pointer dereference you've dangled. With some luck that will bomb the program.
-
Thats cool, but I'm attempting to track down all possible cases of this bug as efficiently as possible. Stepping though a large program line by line is time consuming, although variable break points would help.– rookMar 12, 2010 at 21:50
-
But what happens if the memory containing 0xfeeefeee gets re-used for a new object? Then this method of detection does not work. Aug 25, 2010 at 19:02
-
@jmatthias: bad use of a dangling pointer into recycled memory is called a "temporal" memory error. Our tool, SafetyCheck, will catch this. See semanticdesigns.com/Products/MemorySafety Mar 20, 2011 at 4:01
You can use gflags.exe and the Debugging Tools for Windows to enable heap checking in a process:
It's been a while since I've used this, and I honestly can't remember how well it interacts with the C runtime heap as opposed to the Windows heap manager (to ensure that each malloc()/free()/new/delete call is separately checked).
Free, but not open source.
-
1"Page Heap" option in gflags.exe changes the way heap is working. Since malloc/free/new/delete just call heap API, "Page Heap" is a great way to detect majority of memory violation. The actual functionality is embedded in Windows, gflags.exe just changes something in the registry. Mar 13, 2010 at 5:21
It's not quite as good as Valgrind, but Microsoft's Application Verifier performs a similar function for Windows. It also will let you simulate error conditions for most of the API to tell you if things are going to blow up in your most important client's face :)
Years ago I used Purify for this purpose. It's been around for a long time and was quite good when I used it.
-
I have used purify, it only seems to detect bugs after the program has crashed. I'm looking for new ways to crash the application :)– rookMar 12, 2010 at 21:33
-
I've used Purify, and it definitely was able to catch all sorts of memory problems like dangling pointer, double delete, array bounds, memory leak (many false positives on the system I worked on). Obviously sometimes the program will crash too. On any sort of runtime checker you have to execute the broken code or it won't be able to detect it. If you're looking for a static checker that's a different question entirely.– Mark BMar 12, 2010 at 22:03
-
1Trivia: Purify was, at a certain extent, the cause of the Debian SSH bug. :P Mar 12, 2010 at 23:35
-
@Matteo your right, it was also humans not understanding a false positive.– rookMar 13, 2010 at 21:14
See CheckPointer, our Memory Safety Checker for C. Does require you have the source code, but does run on Wndows.
NuMega BoundsChecker used to catch this stuff. Not sure if they're still in business though...
DieHard is another alternative worth looking at. It's on the HOARDE website, which unfortunately seems to use frames, so you'll need to look in the left-hand navigation to find DieHard.
free.