![\"\"](\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/12\/image-13-1024x587.png?v=1703042330\")
<\/figure>\n\n\n\n\u4e8c\u3001\u5806\u7ed3\u6784<\/h2>\n\n\n\n1\u3001malloc_chunk\u7ed3\u6784\u4f53<\/h4>\n\n\n\n
\u5728\u6e90\u7801 glibc-2.26\/malloc\/malloc.c<\/a> \u6587\u4ef6\u4e2d\u5b9a\u4e49\u4e86\u5806\u5757\u7684\u6570\u636e\u7ed3\u6784\uff0c\u5206\u4e3a\u4ee5\u4e0b\u51e0\u4e2a\u5b57\u6bb5<\/p>\n\n\n\n \u89e3\u91ca\u5982\u4e0b\uff1a<\/p>\n\n\n\n \u5173\u4e8e3\u4e2a\u6bd4\u7279\u4f4d\u7684\u5b9a\u4e49\u5982\u4e0b\uff1a<\/p>\n\n\n\n \u53ef\u4ee5\u5f97\u51fa\uff0c\u5806\u5757\u7684\u5b9e\u9645\u5927\u5c0f\u4e3amchunk_size & ~(1 | 2 | 4)\u7684\u503c\u3002<\/p>\n\n\n\n \u793a\u4f8b\u4ee3\u7801\uff1a<\/p>\n\n\n\n \u7f16\u8bd1\u540e\u5728main\u51fd\u6570\u7ed3\u5c3ereturn\u5904\u4e0b\u65ad\u70b9\uff0c\u4ee5\u4e0b\u4e3agdb\u8c03\u8bd5\u7684\u65f6\u5019\u67e5\u770b\u7684\u5806\u5757\u60c5\u51b5\uff1a<\/p>\n\n\n\n \u89e3\u91ca\u5982\u4e0b\uff1a<\/p>\n\n\n\n \u4e3a\u4e86\u89e3\u51b3\u5305\u62ec\u8bf8\u591a\u6d6a\u8d39\u95ee\u9898\uff0cfree\u6709\u4e00\u5957\u660e\u786e\u7684\u7b56\u7565\uff1a<\/p>\n\n\n\n \u73b0\u4ee3\u5806\u7ba1\u7406\u5668\u5efa\u7acb\u4e86\u4e00\u7cfb\u5217\u7684Bins\u4ee5\u50a8\u5b58\u4e0d\u4e45\u524d\u88ab\u91ca\u653e\u7684chunk\uff0c\u5305\u62ec\uff1aSmallBin\u3001LargeBin\u3001UnsortedBin\u3001FastBin\u3001TcacheBin\u3002<\/p>\n\n\n\n \u4ee5\u4e0b\u4ee5TcacheBin\u548cLargeBin\u4e3a\u4f8b\uff0c\u7b80\u5355\u4ecb\u7ecd\u4e00\u4e0b\u8fd9\u4e24\u79cd\u7c7b\u522b\u7684\u533a\u522b\u3002<\/p>\n\n\n\n \u7f16\u8bd1\u540e\u5728main\u51fd\u6570\u7ed3\u5c3ereturn\u5904\u4e0b\u65ad\u70b9\uff0c\u4ee5\u4e0b\u4e3agdb\u8c03\u8bd5\u7684\u65f6\u5019\u67e5\u770b\u7684\u5806\u5757\u60c5\u51b5\uff1a<\/p>\n\n\n\n \u89e3\u91ca\u5982\u4e0b\uff1a<\/p>\n\n\n\n \u7f16\u8bd1\u540e\u5728main\u51fd\u6570\u7ed3\u5c3ereturn\u5904\u4e0b\u65ad\u70b9\uff0c\u4ee5\u4e0b\u4e3agdb\u8c03\u8bd5\u7684\u65f6\u5019\u67e5\u770b\u7684\u5806\u5757\u60c5\u51b5\uff1a<\/p>\n\n\n\n \u89e3\u91ca\u5982\u4e0b\uff1a<\/p>\n\n\n\n https:\/\/blog.csdn.net\/Tokameine\/article\/details\/119297245<\/a><\/p>\n\n\n\n https:\/\/blog.csdn.net\/m0_52343643\/article\/details\/126945803<\/a><\/p>\n\n\n\n https:\/\/blog.51cto.com\/u_15346415\/3675227<\/a><\/p>\n\n\n\n https:\/\/www.cnblogs.com\/hyq2\/p\/15998570.html<\/a><\/p>\n\n\n\nstruct malloc_chunk {\r\n\r\n INTERNAL_SIZE_T mchunk_prev_size; \/* Size of previous chunk (if free). *\/\r\n INTERNAL_SIZE_T mchunk_size; \/* Size in bytes, including overhead. *\/\r\n\r\n struct malloc_chunk* fd; \/* double links -- used only if free. *\/\r\n struct malloc_chunk* bk;\r\n\r\n \/* Only used for large blocks: pointer to next larger size. *\/\r\n struct malloc_chunk* fd_nextsize; \/* double links -- used only if free. *\/\r\n struct malloc_chunk* bk_nextsize;\r\n};<\/code><\/pre>\n\n\n\n2\u3001\u6700\u5c0f\u5806\u7ed3\u6784<\/h4>\n\n\n\n
mchunk_prev_size<\/td> mchunk_size <\/td><\/tr> fd<\/td> bk<\/td><\/tr> fd_nextsize<\/td> bk_nextsize<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \n
\/* size field is or'ed with PREV_INUSE when previous adjacent chunk in use *\/\r\n#define PREV_INUSE 0x1\r\n\r\n\/* extract inuse bit of previous chunk *\/\r\n#define prev_inuse(p) ((p)->mchunk_size & PREV_INUSE)\r\n\r\n\r\n\/* size field is or'ed with IS_MMAPPED if the chunk was obtained with mmap() *\/\r\n#define IS_MMAPPED 0x2\r\n\r\n\/* check for mmap()'ed chunk *\/\r\n#define chunk_is_mmapped(p) ((p)->mchunk_size & IS_MMAPPED)\r\n\r\n\r\n\/* size field is or'ed with NON_MAIN_ARENA if the chunk was obtained\r\n from a non-main arena. This is only set immediately before handing\r\n the chunk to the user, if necessary. *\/\r\n#define NON_MAIN_ARENA 0x4\r\n\r\n\/* Check for chunk from main arena. *\/\r\n#define chunk_main_arena(p) (((p)->mchunk_size & NON_MAIN_ARENA) == 0)\r\n\r\n\/* Mark a chunk as not being on the main arena. *\/\r\n#define set_non_main_arena(p) ((p)->mchunk_size |= NON_MAIN_ARENA)\r\n\r\n\r\n\/*\r\n Bits to mask off when extracting size\r\n\r\n Note: IS_MMAPPED is intentionally not masked off from size field in\r\n macros for which mmapped chunks should never be seen. This should\r\n cause helpful core dumps to occur if it is tried by accident by\r\n people extending or adapting this malloc.\r\n *\/\r\n#define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)\r\n\r\n\/* Get size, ignoring use bits *\/\r\n#define chunksize(p) (chunksize_nomask (p) & ~(SIZE_BITS))\r\n\r\n\/* Like chunksize, but do not mask SIZE_BITS. *\/\r\n#define chunksize_nomask(p) ((p)->mchunk_size)\n\n......<\/code><\/pre>\n\n\n\n#include <stdlib.h>\r\n#include <stdio.h>\r\n#include <string.h>\r\n\r\nint main(int argc , char* argv[])\r\n{\r\n char *a = malloc(0x100);\r\n char *b = malloc(0x100);\r\n char *c = malloc(0x100);\r\n free(b);\r\n strcpy(a,\"1111\");\n return 0;<\/mark>\n}<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/12\/image-9.png\")
<\/figure>\n\n\n\n\n
\u4e09\u3001Bins<\/h2>\n\n\n\n
\n
\u7c7b\u522b<\/td> \u8bf4\u660e<\/td><\/tr> SmallBin<\/td> \u603b\u517162\u4e2a\u5faa\u73af\u53cc\u94fe\u8868\uff0c\u5728 32 \u4f4d\u7cfb\u7edf\u4e0a\uff0c\u5c0f\u4e8e 512 \u5b57\u8282\uff08\u6216\u5728 64 \u4f4d\u7cfb\u7edf\u4e0a\u5c0f\u4e8e 1024 \u5b57\u8282\uff09\u3002<\/td><\/tr> LargeBin<\/td> \u603b\u517163\u4e2a\u5faa\u73af\u53cc\u94fe\u8868\uff0c\u5728 64 \u4f4d\u7cfb\u7edf\u4e0a\u5927\u4e8e\u7b49\u4e8e 1024 \u5b57\u8282\u3002<\/td><\/tr> UnsortedBin<\/td> \u603b\u51711\u4e2a\u5faa\u73af\u53cc\u94fe\u8868\uff0c\u5f53SmallBin\u548cLargeBin\u90fd\u4e0d\u80fd\u6ee1\u8db3\u7684\u65f6\u5019\u91c7\u7528\u3002<\/td><\/tr> FastBin<\/td> \u603b\u517110\u4e2a\u5355\u94fe\u8868\uff0c\u6db5\u76d6\u5927\u5c0f\u4e3a 16\u300124\u300132\u300140\u300148\u300156\u300164\u300172\u300180 \u548c 88 \u5b57\u8282\u7684chunk\uff0c\u540c\u6837\u4e0d\u9700\u8981\u989d\u5916\u7684\u6392\u5e8f\u64cd\u4f5c\u3002\u4f46\u7279\u6b8a\u7684\u662f\uff0c\u88ab\u653e\u5165\u8fd9\u91cc\u7684chunk\u5e76\u4e0d\u4f1a\u88ab\u6807\u8bb0\u4e3a\u201c\u672a\u88ab\u5229\u7528\u201d\uff0c\u5373\u4e0b\u4e00\u4e2achunk\u7684P\u4f4d\u4e0d\u4f1a\u88ab\u7f6e\u96f6\uff0c\u8fd9\u79cd\u8868\u73b0\u50cf\u662f\u8fd8\u672a\u88ab\u91ca\u653e\u4e00\u6837\u3002<\/td><\/tr> TcacheBin<\/td> \u603b\u517164\u4e2a\u5355\u94fe\u8868\uff0c\u4eceglibc2.26\u5f00\u59cb\u589e\u52a0\uff0c\u6bcf\u4e2a\u94fe\u5305\u542b\u6700\u591a7\u4e2a\u8282\u70b9\uff0c\u4f18\u5148\u7ea7\u9ad8\u4e8efastbin\uff0c\u5728 64 \u4f4d\u7cfb\u7edf\u4e0a\u5c0f\u4e8e 1024 \u5b57\u8282\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n 1\u3001\u793a\u4f8b\u4ee3\u7801\uff08tcachebins\uff09<\/h4>\n\n\n\n
#include <stdlib.h>\n#include <stdio.h>\n\nint main(int argc , char* argv[])\n{\n char *t[7];\r\n \r\n for(int i=0;i<7;i++)\r\n {\r\n t[i]=malloc(0x100);\r\n }\r\n \r\n for(int i=0;i<7;i++)\r\n {\r\n free(t[i]);\r\n }\n return 0;<\/mark>\n}<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/12\/image-14-1024x618.png?v=1703042380\")
<\/figure>\n\n\n\n\n
2\u3001\u793a\u4f8b\u4ee3\u7801\uff08largebins\uff09<\/h4>\n\n\n\n
#include <stdlib.h>\n#include <stdio.h>\n\nint main(int argc , char* argv[])\n{\n char *t[7];\r\n \r\n for(int i=0;i<7;i++)\r\n {\r\n t[i]=malloc(0x410+0x10*i);\r\n malloc(0x10);\r\n }\r\n \r\n for(int i=0;i<7;i++)\r\n {\r\n free(t[i]);\r\n }\r\n \r\n malloc(0x500);\n return 0;<\/mark>\n}<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2023\/12\/image-15-1024x575.png?v=1703042397\")
<\/figure>\n\n\n\n\n
\u56db\u3001\u53c2\u8003\u94fe\u63a5<\/h2>\n\n\n\n