gdb调试malloc-free 产生的coredown

1。将struct malloc_chunk内容破坏程序如下：

int fun0(const char *str)
{
    char buf[40];
    memset(buf, 0, sizeof(buf));
    strcpy(buf, str);
    ptrace("fun0");
    printf("fun0:%s\n", buf);
    char *tbuf1 = (char *)malloc(sizeof(char) * 4);
    char *tbuf2 = (char *)malloc(sizeof(char) * 4);
    strcpy(tbuf1 -4, str);
    strcpy(tbuf2, str);
    printf("fun1:%s\n", tbuf1);
    printf("fun2:%s\n", tbuf2);
    free(tbuf1);
    free(tbuf2);
    return 0;
}

如下gdb内容：
#0  0x00007fd5bcc67cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fd5bcc6b0d8 in __GI_abort () at abort.c:89
#2  0x00007fd5bcca4394 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7fd5bcdb2b28 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007fd5bccb066e in malloc_printerr (ptr=<optimized out>, str=0x7fd5bcdb2c58 "double free or corruption (out)", action=1)
    at malloc.c:4996
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
#5  0x0000000000400d6f in fun0 (str=0x400f56 "yangzhengwen") at mcore.cpp:46
#6  0x0000000000400dce in main (argc=1, argv=0x7ffd67472a88) at mcore.cpp:66

提示：两次 释放，其实是的指针结构被破坏了。

修改为如下：

    free(tbuf1);
    free(tbuf1);
    free(tbuf2);

core  down如上次，

修改为如下：
    free(tbuf1);
    free(tbuf2);
    free(tbuf1);

没有core down。说明了什么？


2. 申请内存与struct malloc_chunk的关系：

    char *tbuf1 = (char *)malloc(sizeof(char) * 4);
    char *tbuf2 = (char *)malloc(sizeof(char) * 4);
    char *tbuf3 = (char *)malloc(sizeof(char) * 40);
    char *tbuf4 = (char *)malloc(sizeof(char) * 1024);

gdb中：

(gdb) p  *((mchunkptr)((char*)(tbuf1) - 2*sizeof(size_t)))
$1 = {prev_size = 140737354127864, size = 33, fd = 0x0, bk = 0x0, fd_nextsize = 0x0, bk_nextsize = 0x21}
(gdb) p  *((mchunkptr)((char*)(tbuf2) - 2*sizeof(size_t)))
$2 = {prev_size = 0, size = 33, fd = 0x0, bk = 0x0, fd_nextsize = 0x0, bk_nextsize = 0x31}
(gdb) p  *((mchunkptr)((char*)(tbuf3) - 2*sizeof(size_t)))
$3 = {prev_size = 0, size = 49, fd = 0x0, bk = 0x0, fd_nextsize = 0x0, bk_nextsize = 0x0}
(gdb) p  *((mchunkptr)((char*)(tbuf4) - 2*sizeof(size_t)))
$4 = {prev_size = 0, size = 1041, fd = 0x0, bk = 0x0, fd_nextsize = 0x0, bk_nextsize = 0x0}

可见，mchunkptr的size比实际申请的要大一点。说明书上的内存管理 的分配算法。