Detecting use after free() on windows. (dangling p

问题:

I'm trying to detect "Use after free()" bugs, otherwise known as "Dangling pointers". I know Valgrind can be used to detect "Use after free" bugs on the *nix platform, but what about windows? What if I don't have the source? Is there a better program than Valgrind for detecting all dangling pointers in a program? A free and open source would be preferred , but I'll use a commercial solution if it will get the job done.

回答1:

The MSVC debug memory allocator already does this. When you get 0xfeeefeee from a pointer dereference you've dangled. With some luck that will bomb the program.

回答2:

You can use gflags.exe and the Debugging Tools for Windows to enable heap checking in a process:

• http://msdn.microsoft.com/en-us/library/cc265885.aspx

It's been a while since I've used this, and I honestly can't remember how well it interacts with the C runtime heap as opposed to the Windows heap manager (to ensure that each malloc()/free()/new/delete call is separately checked).

Free, but not open source.

回答3:

It's not quite as good as Valgrind, but Microsoft's Application Verifier performs a similar function for Windows. It also will let you simulate error conditions for most of the API to tell you if things are going to blow up in your most important client's face :)

回答4:

Years ago I used Purify for this purpose. It's been around for a long time and was quite good when I used it.

回答5:

See CheckPointer, our Memory Safety Checker for C. Does require you have the source code, but does run on Wndows.

回答6:

NuMega BoundsChecker used to catch this stuff. Not sure if they're still in business though...

回答7:

DieHard is another alternative worth looking at. It's on the HOARDE website, which unfortunately seems to use frames, so you'll need to look in the left-hand navigation to find DieHard.

回答8:

Check the Windows debug heap. It's not open source, but works.

回答9:

After the free(), set the pointer value to 0 and wait for the fireworks?