Memory overflow detection method, electronic device and storage medium

Abstract

The present invention relates to the field of computer technology, and in particular to a memory overflow detection method, electronic device and computer-readable storage medium for an embedded Linux system, in which a memory allocation function and a data operation function are rewritten through a compiler's wrap mechanism. When calling the rewritten memory allocation function, an additional preset byte is applied for storing an application length, and when calling the rewritten data operation function, the application length is obtained, and it is determined whether the data operation length passed in by the rewritten data operation function exceeds the application length. If so, it is confirmed that a memory overflow occurs. This memory overflow detection method, electronic device and computer-readable storage medium can quickly confirm whether a memory overflow occurs for the crash problem caused by memory cross-border damage, without the need to make a debugging version to capture a coredump file, and without the need to modify the source code, thereby improving the efficiency of memory overflow analysis and detection and enhancing the stability of the program.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a memory overflow detection method, electronic equipment and computer-readable storage medium for an embedded Linux system. Background Art

[0002] As we all know, in the video surveillance industry, video surveillance equipment, such as cameras, usually use embedded systems, such as embedded Linux systems. The memory and flash space of these embedded systems are very limited. In order to ensure that video surveillance equipment can run stably under limited memory and flash space, the debugging tools in the released version are basically optimized. Therefore, abnormal crash problems that occur at the application site of video surveillance equipment are often difficult to directly provide effective information for analysis through the existing embedded system. Generally speaking, video surveillance equipment has various abnormal crash problems, most of which are caused by memory out-of-bounds access, that is, memory overflow occurs. Once such a problem occurs, the traditional solution is to analyze it after local reproduction to confirm whether memory overflow occurs, so as to identify and solve the memory management problem in time. Specifically: rely on the compiled debug version to capture the coredump file, and further analyze whether memory overflow occurs according to the coredump file, so as to identify and solve the memory management problem in time according to the analysis results. However, such an analysis process is inefficient. In addition, this analysis method has defects such as the debug version software is large and cannot be directly put into the flash space for execution; the generated coredump file is too large to be stored in the flash space of the video surveillance device; and it is impossible to obtain valid information when the stack is destroyed. Summary of the invention

[0003] In view of this, the present invention proposes a memory overflow detection method for an embedded Linux system, an electronic device and a computer-readable storage medium, aiming to solve the problem of low efficiency of existing memory overflow analysis methods based on embedded Linux systems.

[0004] In order to solve the above problems, the present invention adopts the following technical solutions:

[0005] In a first aspect, the present invention provides a memory overflow detection method for an embedded Linux system, comprising:

[0006] Through the wrap mechanism of the compiler, the memory allocation function is rewritten according to the preset rules to obtain the rewritten memory allocation function, and the data operation function is rewritten to obtain the rewritten data operation function; wherein the data operation function includes a memory operation function and a string operation function; the preset rules include additionally applying for preset bytes for storing the application length when calling the memory allocation function, and obtaining the application length additionally applied for storage by the rewritten memory allocation function associated with the data operation function when calling the data operation function;

[0007] In response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function;

[0008] It is determined whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length. If so, it is confirmed that a memory overflow occurs.

[0009] Further, in response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function; determining whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length, and if so, confirming that a memory overflow occurs, including:

[0010] In response to calling the rewritten memory operation function, obtaining the incoming address of the called rewritten memory operation function, accessing a preset byte in the memory space through the incoming address, obtaining the application length stored in the preset byte, comparing the application length with the operation length passed in by the called rewritten memory operation function, and confirming that a memory overflow occurs if the operation length exceeds the application length;

[0011] In response to calling the rewritten string operation function, the incoming address of the called rewritten string operation function is obtained, the preset bytes in the memory space are accessed through the incoming address, the requested length stored in the preset bytes is obtained, and the size relationship between the requested length and the string length passed in by the called rewritten string operation function is compared. If the string length exceeds the requested length, it is confirmed that a memory overflow has occurred.

[0012] Furthermore, the memory allocation function includes malloc function, free function, calloc function and realloc function, the memory operation function includes memset function, memcpy function, memmove function, bzero function and bcopy function, and the string operation function includes strcpy function, strncpy function, strcat function and strncat function.

[0013] Furthermore, the preset bytes are 32 bytes.

[0014] Furthermore, the preset rules include: when calling a memory allocation function, additionally applying for 32 bytes for storing an application length, a magic number, a pid of an application thread, and an application thread name; and when calling a data operation function, obtaining the rewritten memory allocation function associated with the data operation function to additionally apply for storing the application length, the magic number, the pid of the application thread, and the application thread name.

[0015] Furthermore, the magic number is 0x55aa55aa.

[0016] Furthermore, after confirming that a memory overflow occurs, the method further includes:

[0017] Obtain the incoming address of the called rewritten data operation function, access the preset bytes in the memory space through the incoming address, and obtain the application length, magic number, pid of the application thread, and the application thread name stored in the preset bytes;

[0018] The function name of the rewritten data operation function being called, the length of the data operation passed in, the application length stored in the additional application, the magic number, the pid of the application thread and the application thread name, as well as the pid and thread name of the thread when the memory overflow is confirmed are saved to the log file.

[0019] Furthermore, the preset rules include a preset first rule and a preset second rule; wherein,

[0020] Rewriting the memory allocation function according to the preset first rule, including: when calling the memory allocation function, applying for an additional 32 bytes for storing the application length, the magic number, the pid of the application thread and the application thread name, and recording the return address as ptr;

[0021] The data operation function is rewritten according to the preset second rule, including: when calling the data operation function, obtaining the input operation address ptr; obtaining the ptr-32 target address according to the operation address ptr, and obtaining the application length, magic number, pid of the application thread and the application thread name stored in the 32 bytes.

[0022] In a second aspect, the present invention further provides an electronic device, comprising:

[0023] a memory for storing program instructions; and

[0024] The processor is used to execute the program instructions to implement the steps of the memory overflow detection method of the embedded Linux system as described above.

[0025] In a third aspect, the present invention further proposes a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the memory overflow detection method for the embedded Linux system as described above are implemented.

[0026] Compared with the prior art, the beneficial effects of the present invention are: a memory overflow detection method, electronic device and computer-readable storage medium for an embedded Linux system, comprising: rewriting a memory allocation function according to a preset rule through a compiler wrap mechanism to obtain a rewritten memory allocation function, and rewriting a data operation function to obtain a rewritten data operation function; in response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function; judging whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length, and if so, confirming that a memory overflow occurs. Wherein, the data operation function includes a memory operation function and a string operation function; the preset rule includes applying for an additional preset byte for storing the application length when calling the memory allocation function, and obtaining the application length additionally applied for storage by the rewritten memory allocation function associated with the data operation function when calling the data operation function. It can be seen that the memory overflow detection method, electronic device and computer-readable storage medium of the embedded Linux system rewrite the memory allocation function and the data operation function through the wrap mechanism of the compiler. When calling the rewritten memory allocation function, additional preset bytes are requested for storing the request length, and the request length is obtained when calling the rewritten data operation function, and it is determined whether the data operation length passed in by the rewritten data operation function exceeds the request length. If so, it is confirmed that a memory overflow has occurred. This memory overflow detection method, electronic device, and computer-readable storage medium can quickly confirm whether a memory overflow has occurred for the crash problem caused by memory out-of-bounds damage, without the need to make a debug version to capture a coredump file, and without the need to modify the source code, thereby improving the efficiency of memory overflow analysis and detection, enhancing the stability of the program, and having strong feasibility and a good user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0028] Figure 1 A schematic diagram of a flow chart of a first embodiment of a method for detecting memory overflow in an embedded Linux system according to the present invention;

[0029] Figure 2 A schematic diagram of a flow chart of a second embodiment of a method for detecting memory overflow in an embedded Linux system according to the present invention;

[0030] Figure 3 It is a schematic diagram of the structure of an electronic device in a hardware operating environment involved in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] It should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0033] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0034] It should be noted that GCC (GNU Compiler Collection) is an open source compiler collection that includes compilers for compiling multiple programming languages, such as C, C++, Objective-C, Fortran, and Ada. GCC is a powerful and widely used compiler suite that can run on multiple operating systems, including Linux, Unix, and Windows. The compiler wrap mechanism refers to the wrap mechanism of GCC, which is implemented by using a wrapper function for the symbol symbol. Under the wrap mechanism of GCC, any undefined symbol will be resolved as __wrap_symbol, and any undefined __real_symbol will be resolved as a real symbol. In other words, when a symbol named symbol uses the wrap function, any place in the project that uses the symbol symbol actually uses the __wrap_symbol symbol, and any place that uses __real_symbol actually uses the real symbol. For example, when an application calls malloc, it will actually be resolved as __wrap_malloc, and __real_malloc will be called in __wrap_malloc, which actually resolves to malloc. In this way, additional logic can be added to __wrap_malloc to wrap and extend the original function. This mechanism provides flexibility and extensibility to enhance or modify the function without modifying the original code (source code).

[0035] See also Figure 1 As shown, it is a flow chart of the first embodiment of the memory overflow detection method for the embedded Linux system of the present invention.

[0036] In this embodiment, the memory overflow detection method of the embedded Linux system includes:

[0037] Step S100: Through the wrap mechanism of the compiler, the memory allocation function is rewritten according to preset rules to obtain a rewritten memory allocation function, and the data operation function is rewritten to obtain a rewritten data operation function.

[0038] Among them, the data operation function includes a memory operation function and a string operation function; the preset rules include additionally applying for preset bytes for storing the application length when calling the memory allocation function, and obtaining the application length additionally applied for storage by the rewritten memory allocation function associated with the data operation function when calling the data operation function.

[0039] Specifically, through the compiler's wrap mechanism, memory allocation functions and data operation functions are rewritten according to preset rules so that the memory allocation and data operation processes can be monitored when the program is running. By rewriting these functions, additional logic can be inserted when the function is called, and corresponding processing can be performed according to preset rules to help detect memory overflow.

[0040] In some embodiments of the present application, the preset bytes are 32 bytes.

[0041] Specifically, storing only the request length may not require 32 bytes of space, but considering factors such as the design of the overall data structure, memory alignment, and storage requirements for other information related to memory overflow detection, choosing a larger space to store this information can improve the reliability of the program and ensure the accuracy and security of memory operations.

[0042] In some embodiments of the present application, the preset rules include: when calling a memory allocation function, additionally applying for 32 bytes to store the application length, magic number, pid of the application thread, and the application thread name; and when calling a data operation function, obtaining the rewritten memory allocation function associated with the data operation function to additionally apply for storing the application length, the magic number, the pid of the application thread, and the application thread name.

[0043] Specifically, the number of bytes required to store the request length, magic number, pid of the request thread, and the request thread name depends on the specific data type and encoding method. Generally speaking, if common data types and encoding methods are used, the number of bytes required to store this information is as follows:

[0044] Request length: This can usually be represented by a 4-byte or 8-byte integer data type, depending on the bit size of the system (32-bit or 64-bit) and the size range of the memory allocation.

[0045] Magic number: Usually a fixed-length numeric value or string used to identify a specific data structure or format, which may require several bytes of space to store.

[0046] Request thread pid: It can usually be represented by a 4-byte integer data type, because the pid of most systems is a 32-bit integer.

[0047] Apply for a thread name: The length of a thread name is variable. Usually, the number of bytes required for storage needs to be determined based on actual conditions, which may range from a few bytes to dozens of bytes.

[0048] Taking all the above factors into consideration, the number of bytes required to store the application length, magic number, pid of the application thread, and the name of the application thread may vary depending on the specific situation. In general, dozens of bytes of space may be required. Therefore, in order to ensure sufficient space to store this information, a 32-byte storage space is designed to ensure the storage requirements of various information.

[0049] In some embodiments of the present application, the magic number is 0x55aa55aa.

[0050] Specifically, in the computer field, a magic number is a special value or identifier, which is usually used to identify a specific type or version in a file format, data structure, or communication protocol so that the program can correctly parse and process the corresponding data. By checking the magic number, the program can quickly determine the type or validity of the data and perform corresponding operations. The value of the magic number is 0x55aa55aa, which means that a part of the storage space is designated as this specific value, which is used as an identifier or a mark for specific information. The magic number can help the program identify related data structures or information and perform corresponding processing.

[0051] Specifically, the request length usually refers to the size of the memory block dynamically requested by the memory allocation function (such as malloc) when the program is running. This length is usually in bytes and is used to specify the size of the memory space to be allocated. In memory management, the correct request length is very important. Too small may lead to insufficient memory, and too large may lead to memory waste or memory overflow. Therefore, accurately recording and managing the request length is crucial to the stability and performance of the program.

[0052] Specifically, the pid (Process ID) of a thread is a unique identifier assigned by the operating system to each thread. The pid is used to distinguish different threads so that the operating system can correctly manage and schedule threads. In a multi-threaded program, each thread has its own pid, which can uniquely identify a thread. Recording the pid of the requesting thread can help track and identify which thread has performed the memory allocation operation, which is helpful for debugging and monitoring the running status of the program.

[0053] Specifically, the application thread name refers to the name or identifier of the thread that performs memory allocation operations. The thread name is usually a descriptive name assigned by the developer to the thread to identify the role or function of the thread. Recording the application thread name can help developers better understand and track the source of memory allocation operations, making it easier to debug and troubleshoot problems. Recording thread names also helps to distinguish operations of different threads in a multi-threaded environment, improving the readability and maintainability of the program.

[0054] Step S200: in response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function.

[0055] Specifically, obtaining the application length of the called rewritten data operation function is to obtain the application length of the rewritten memory allocation function associated with the called rewritten data operation function. The purpose of obtaining the application length is to provide a necessary reference for subsequent determination of whether memory overflow occurs.

[0056] Step S300: determine whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length. If so, it is confirmed that a memory overflow occurs.

[0057] Specifically, by comparing the data operation length with the application length, it is possible to determine whether the actual operation data length exceeds the preset memory allocation length, thereby confirming whether a memory overflow has occurred, and taking corresponding measures to handle it when a memory overflow has occurred. Judging memory overflow by comparing the application length with the data operation length is a simple and effective means of detecting memory overflow.

[0058] Specifically, step S100, step S200 and step S300 are combined to form a memory overflow detection method for an embedded Linux system. Through the wrap mechanism and preset rules of the compiler, monitoring and control of memory allocation and data operations are achieved, thereby improving the stability and security of the program. This memory overflow detection method can not only quickly confirm the memory overflow problem, but also detect the memory overflow without modifying the original code, which provides convenience for the development and maintenance of embedded systems.

[0059] Compared with the prior art, the memory overflow detection method of the embedded Linux system of the embodiment of the present invention rewrites the memory allocation function and the data operation function through the wrap mechanism of the compiler. When calling the rewritten memory allocation function, additional preset bytes are applied for storing the application length, and the application length is obtained when calling the rewritten data operation function, and it is determined whether the data operation length passed in by the rewritten data operation function exceeds the application length. If so, it is confirmed that a memory overflow has occurred. This memory overflow detection method is aimed at the crash problem caused by memory out-of-bounds damage, and can quickly confirm whether a memory overflow has occurred. There is no need to make a debug version to capture the coredump file, and there is no need to change the source code. The efficiency of memory overflow analysis and detection is improved, the stability of the program is enhanced, and it has strong feasibility and good user experience.

[0060] See also Figure 2As shown, it is a flow chart of the second embodiment of the memory overflow detection method for the embedded Linux system of the present invention.

[0061] Compared with the first embodiment of the memory overflow detection method for embedded Linux systems, this embodiment provides a detailed explanation of the process of comparing the data operation length and the application length to confirm whether a memory overflow occurs, refines the preset rules, and adds a step of saving reference information for determining whether a memory overflow occurs to a log file.

[0062] In this embodiment, the memory overflow detection method of the embedded Linux system includes:

[0063] Step S100: Through the wrap mechanism of the compiler, the memory allocation function is rewritten according to preset rules to obtain a rewritten memory allocation function, and the data operation function is rewritten to obtain a rewritten data operation function.

[0064] Among them, the data operation function includes a memory operation function and a string operation function; the preset rules include additionally applying for preset bytes for storing the application length when calling the memory allocation function, and obtaining the application length additionally applied for storage by the rewritten memory allocation function associated with the data operation function when calling the data operation function.

[0065] Specifically, memory operation functions and string operation functions are common data processing operation functions, which are used to operate memory and strings. In addition to these two functions, there are other types of data operation functions, such as file operation functions, data structure operation functions, etc.

[0066] Memory operation functions are usually used to read, write, copy, allocate, and release memory blocks. Common memory operation functions include:

[0067] memset(): memory setting;

[0068] memcpy(): memory copy;

[0069] memmove(): memory movement;

[0070] bzero(): clear memory;

[0071] bcopy(): memory copy.

[0072] String operation functions are usually used to process and operate strings. Common string operation functions include:

[0073] strcpy(): string copy;

[0074] strncpy(): copy a string with length limit;

[0075] strcat(): string concatenation;

[0076] strncat(): String concatenation with length limit.

[0077] These memory operation functions and string operation functions are often used in programming to process memory and string data, and are important components of data operation functions. Other types of data operation functions may involve different data types and operation methods according to specific needs.

[0078] In some embodiments of the present application, the preset rule includes a preset first rule and a preset second rule; wherein,

[0079] Rewriting the memory allocation function according to the preset first rule, including: when calling the memory allocation function, applying for an additional 32 bytes for storing the application length, the magic number, the pid of the application thread and the application thread name, and recording the return address as ptr;

[0080] The data operation function is rewritten according to the preset second rule, including: when calling the data operation function, obtaining the input operation address ptr; obtaining the ptr-32 target address according to the operation address ptr, and obtaining the application length, magic number, pid of the application thread and the application thread name stored in the 32 bytes.

[0081] Specifically, ptr is a pointer that points to the starting address of the memory block returned by the memory allocation function. ptr-32 is the starting address of the 32-byte data that stores the request length, magic number, pid of the requesting thread, and the name of the requesting thread. In this way, the previously additional request storage information can be obtained to further determine whether the memory operation is legal or whether a memory overflow occurs.

[0082] Step S201: in response to calling the rewritten memory operation function, obtaining the incoming address of the called rewritten memory operation function, accessing the preset bytes in the memory space through the incoming address, and obtaining the application length stored in the preset bytes.

[0083] Step S301: compare the request length with the operation length passed into the called rewritten memory operation function. If the operation length exceeds the request length, it is confirmed that a memory overflow occurs.

[0084] Specifically, step S201 and step S301 are a set of processing steps for the rewritten memory operation function. Step S201 is intended to obtain the requested length stored in the preset bytes by the memory operation function. Through step S301, it can be determined whether the memory operation function exceeds the requested memory range during actual operation, thereby confirming whether a memory overflow occurs.

[0085] Step S202: in response to calling the rewritten string operation function, obtaining the incoming address of the called rewritten string operation function, accessing the preset bytes in the memory space through the incoming address, and obtaining the requested length stored in the preset bytes.

[0086] Step S302: comparing the requested length with the length of the string passed into the called rewritten string operation function. If the string length exceeds the requested length, it is determined that a memory overflow occurs.

[0087] Specifically, step S202 and step S302 are a set of processing steps for the rewritten string operation function. Step S202 is intended to obtain the requested length stored in the preset bytes by the string operation function. Through step S302, it can be determined whether the string operation function exceeds the requested string length range during actual operation, thereby confirming whether a memory overflow occurs.

[0088] It should be noted that there is no order of precedence between the steps S201 and S301 and the steps S202 and S302, and either one of them can be implemented. These two steps are respectively for the memory operation function and the string operation function, and by obtaining the application length of the additional application storage pointed to by the incoming address and comparing the actual data operation length with the application length, it is determined whether the memory operation is legal or whether a memory overflow occurs, thereby ensuring the security and stability of the system.

[0089] In some embodiments of the present application, the memory allocation function includes malloc function, free function, calloc function and realloc function, the memory operation function includes memset function, memcpy function, memmove function, bzero function and bcopy function, and the string operation function includes strcpy function, strncpy function, strcat function and strncat function.

[0090] Specifically, memory allocation functions are usually used to dynamically allocate memory space when the program is running in order to store data or objects. Common memory allocation functions include:

[0091] malloc(): dynamically allocate memory;

[0092] free(): release memory;

[0093] calloc(): dynamically allocate and clear memory;

[0094] realloc(): reallocates memory.

[0095] Step S401: Get the incoming address of the called rewritten data operation function, access the preset bytes in the memory space through the incoming address, and obtain the application length, magic number, pid of the application thread and the application thread name stored in the preset bytes.

[0096] Specifically, memory overflow means that when a program writes data to the memory, it exceeds the scope of the requested memory space, resulting in data overwriting or out-of-bounds access. Recording the application length can help the program accurately know the size of each memory allocation at runtime, so as to check whether there is out-of-bounds access or write beyond the boundary when releasing the memory, which helps to find memory overflow problems in time. As a specific identifier, the magic number can help the program identify the validity of data structures or information. During memory operations, the correctness of the memory block can be verified by checking the magic number to prevent memory overflow problems caused by damaged data structures. If the magic number does not match, it may mean that the memory block has been damaged, which helps to quickly locate the cause of the memory overflow. Recording the pid and thread name of the thread that applied for memory can help track and identify which thread performed the memory allocation operation. In a multi-threaded environment, different threads may perform memory operations at the same time. By recording thread information, the specific operator can be tracked. If a memory overflow occurs, the specific thread can be located based on the thread information, which helps to analyze the cause of the memory overflow and debug the program. Providing the above four parameters (application length, magic number, pid of the application thread, and application thread name) has greater advantages in confirming memory overflow or locating problems than providing only one parameter, the application length. These four parameters provide more comprehensive information, including memory allocation size, data structure integrity, operation thread identity, etc., which help to fully reflect the background and environment of memory operations, provide more accurate positioning and more efficient troubleshooting and repair process, and speed up the resolution of memory overflow problems.

[0097] Step S402: Save the function name of the rewritten data operation function being called, the data operation length passed in, the application length stored in the additional application, the magic number, the pid of the application thread and the application thread name, as well as the pid and thread name of the thread when the memory overflow is confirmed to the log file.

[0098] Specifically, the application length, the magic number, the pid of the application thread and the application thread name, as well as the pid and thread name of the thread when the memory overflow is confirmed to be saved in the log file, and then the function name of the data operation function and the input data operation length are saved together in the log file, which can more comprehensively record the relevant information of the memory operation for subsequent tracking, debugging and performance analysis. By recording the function name and data operation length of the data operation function, the data operation process can be tracked, which helps to locate the problem and troubleshoot, and evaluate the performance of different data operation functions, thereby improving the stability and performance of the program. This recording method not only helps to analyze the specific situation of memory operations, but also provides strong support for the optimization and improvement of the program. It should be noted that when saving the log file, the pid and thread name of the application thread that are additionally applied for storage are information recorded when memory is allocated, which are used to identify the thread that applies for memory. The pid and thread name of the thread when the memory overflow is confirmed to occur are information recorded when the memory overflow occurs, which are used to identify the thread that causes the memory overflow. Recording and saving these two sets of thread parameters recorded at different times can help track thread information during memory operations and better locate and solve memory overflow problems.

[0099] The memory overflow detection method of the embedded Linux system of this embodiment rewrites the malloc, free, calloc and realloc functions through the wrap mechanism of gcc. When applying for memory, 32 bytes are applied for more, and the return address is recorded as ptr. The first 32 bytes of ptr are used to store the magic number (0x55aa55aa), the pid of the application thread, the name of the application thread and the application length, and the address returned to the user is ptr+32. At the same time, memset, memcpy, memmove, strcpy, strncpy, strcat, strncat, bzero and bcopy functions are rewritten, and the incoming operation address is recorded as ptr. When calling, the ptr-32 address is obtained to obtain the magic number filled in when applying for memory, the pid of the application thread, the name of the application thread and the application length. When the data operation length passed in by the data operation function exceeds the application length of this address, it is determined that a memory overflow occurs, and the information is recorded in the log file.

[0100] The memory overflow detection method of the embedded Linux system of the present embodiment can detect overflow access to dynamically applied memory. When memory overflow occurs, the function name of the called data operation function, the thread information of calling this data operation function, and the thread information of applying for this memory block can be printed, and this information can be saved in a log file for analysis and use, thereby improving the efficiency of locating crash problems caused by memory cross-boundary access. For crash problems caused by memory cross-boundary damage, compared with the detection and analysis method of making a debug version to capture the coredump file for further analysis, by analyzing the log file stored in the flash space when the memory overflow occurs, the thread and function where the memory overflow occurs can be known, and the problem can be quickly located in combination with the code, thereby improving the detection efficiency of memory overflow and the stability of the program.

[0101] The following describes in detail the linking steps and basic process of the memory overflow detection method for the embedded Linux system provided by this embodiment.

[0102] The linking steps of the memory overflow detection method of the embedded Linux system include:

[0103] Step (1), when compiling and linking, add link parameters to replace the corresponding function with __wrap_symbol (for example: malloc is replaced with __wrap_malloc)

[0104] -Wl,--wrap=malloc,-Wl,--wrap=free,-Wl,--wrap=realloc,-Wl,--wrap=calloc,-Wl,--wrap=memset,-Wl,--wrap=memcpy,-Wl,--wrap=memmove

[0105] -Wl,--wrap=strcpy,-Wl,--wrap=strncpy,-Wl,--wrap=strcat,-Wl,--wrap=strncat,-Wl,--wrap=bzero,-Wl,--wrap=bcopy.

[0106] This step (1) can intercept the corresponding memory allocation function and data operation function when the program is running, so as to perform additional processing and detection during data operation.

[0107] Step (2), when compiling and linking, add -static-libstdc++ to statically link the libstdc++ library, and replace the new / delete compilation with __wrap_malloc / __wrap_free.

[0108] This step (2) can intercept dynamic memory allocation and release operations to detect and record memory overflows.

[0109] Step (3), implement the functions corresponding to __wrap_symbol, including: __wrap_malloc / __wrap_free / __wrap_realloc / __wrap_calloc / __wrap_memset / __wrap_memcpy / __wrap_memmove / __wrap_strcpy / __wrap_strncpy / __wrap_strcat / __wrap_strncat / __wrap_bzero / __wrap_bcopy.

[0110] Add processing logic before these interfaces, and then call the corresponding __real_symbol (such as __real_malloc).

[0111] This step (3) can add additional processing logic to the function, such as applying for an extra 32 bytes to store the request length, and detecting memory overflow in the data operation function. In the implementation process, it is necessary to call the corresponding real function, such as __real_malloc, to ensure that the original memory allocation and operation functions can be executed normally.

[0112] In general, steps (1), (2) and (3) can intercept and detect data operation functions and record memory operation information, thereby improving the ability to detect and locate memory overflow problems and enhancing the stability and security of the program.

[0113] The basic process of the memory overflow detection method of the embedded Linux system includes:

[0114] (1) Apply for memory

[0115] In __wrap_malloc / __wrap_calloc / __wrap_realloc, the request length is increased by 32, and memory is actually requested through __real_malloc / __real_calloc / __real_realloc, and the magic number (0x55aa55aa), the pid of the requesting thread (obtained through gettid()), the requesting thread name (obtained through prctl(PR_GET_NAME)), and the request length are filled into different positions in the first 32 bytes, and then ptr + 32 is returned to the caller. For details, please refer to Table 1, which is the data operation information table.

[0116] Table 1 Data operation information table

[0117]

[0118] (2) Release memory

[0119] In __wrap_free, the actual application address is obtained by passing in the address, and then __real_free is called to release the actual application address.

[0120] (3) Memory overflow determination

[0121] in / __wrap_memset / __wrap_memcpy / __wrap_memmove / __wrap_strcpy /

[0122] In __wrap_strncpy / __wrap_strcat / __wrap_strncat / __wrap_bzero / __wrap_bcopy, get the XrsHead of the target address.

[0123] in / __wrap_memset / __wrap_memcpy / __wrap_memmove / __wrap_bzero /

[0124] In __wrap_bcopy, the requested length in XrsHead is compared with the passed in data operation length. If the requested length is smaller than the passed in data operation length, it is determined that a memory overflow has occurred. In / __wrap_strcpy / __wrap_strncpy / __wrap_strcat / __wrap_strncat, the string length of the passed in string is first calculated, and then the requested length in XrsHead and the string length are compared. If the string length exceeds the requested length, it is determined that a memory overflow has occurred.

[0125] (4) Recording logs

[0126] When a memory overflow is determined to have occurred, the name of the called function, the length of the data operation passed in, the pid of the thread when this memory is requested, the thread name, the request length, the pid and thread name of the thread when the memory overflow is determined to have occurred are saved to a log file in the flash. The log file where the memory overflow occurs can also be stored separately as an overflow log file for subsequent analysis.

[0127] Compared with the prior art, the memory overflow detection method for the embedded Linux system provided by the embodiment of the present invention saves the log file of the memory overflow to the flash space when the memory overflow problem occurs in the embedded Linux system, providing a basis for subsequent analysis. The memory overflow detection method for the embedded Linux system can quickly locate the memory overflow problem under the condition of limited resources without changing the original engineering code, occupies less flash space and memory, and is efficient in locating the memory overflow problem.

[0128] The following is an embodiment of the electronic device provided by the present invention. The embodiment of the electronic device and the embodiment of the memory overflow detection method of the embedded Linux system described above belong to the same concept, and the details not described in detail in the embodiment of the electronic device can refer to the embodiment of the memory overflow detection method of the embedded Linux system described above.

[0129] See also Figure 3 As shown, it is a schematic diagram of the structure of an electronic device in a hardware operating environment involved in an embodiment of the present invention.

[0130] In this embodiment, an electronic device includes:

[0131] Memory 1005, used to store program instructions; and

[0132] The processor 1001 is used to execute the program instructions to implement the steps of the memory overflow detection method of the embedded Linux system as described above.

[0133] The electronic device of the embodiment of the present invention can be a computing device such as a desktop computer, a notebook, a palm computer, and a server. Figure 3 As shown, the electronic device may include: a processor 1001 (such as a CPU), a network interface 1004, a user interface 1003, a memory 1005 and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit, such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0134] Those skilled in the art will understand that Figure 3The electronic device structure shown in the figure does not constitute a limitation of the electronic device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0135] like Figure 3 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module and a computer program.

[0136] exist Figure 3 In the electronic device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the computer program stored in the memory 1005. When the computer program is called and executed by the processor 1001, the steps of the memory overflow detection method of the above-mentioned embedded Linux system are implemented.

[0137] The following is an embodiment of the computer-readable storage medium provided by the present invention. The embodiment of the computer-readable storage medium and the embodiment of the memory overflow detection method and electronic device of the above-mentioned embedded Linux system belong to the same concept, and the details not described in detail in the embodiment of the computer-readable storage medium can refer to the embodiment of the memory overflow detection method and electronic device of the above-mentioned embedded Linux system.

[0138] In this embodiment, a computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the memory overflow detection method for the embedded Linux system as described above are implemented.

[0139] Since the electronic device and computer-readable storage medium of the present invention can both implement the steps of the above-mentioned embedded Linux system memory overflow detection method, they at least have all the beneficial effects brought by the technical solution of the above-mentioned embedded Linux system memory overflow detection method step embodiment, which will not be described one by one here.

[0140] The above description is only a partial or preferred embodiment of the present invention. Neither the text nor the drawings can limit the scope of protection of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the overall concept of the present invention, or direct / indirect application in other related technical fields are included in the scope of protection of the present invention.

[0141] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0142] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0144] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A memory overflow detection method for an embedded Linux system, characterized in that: include: Through the wrap mechanism of the compiler, the memory allocation function is rewritten according to the preset rules to obtain the rewritten memory allocation function, and the data operation function is rewritten to obtain the rewritten data operation function; wherein the data operation function includes a memory operation function and a string operation function; the preset rules include additionally applying for preset bytes for storing the application length when calling the memory allocation function, and obtaining the application length additionally applied for storage by the rewritten memory allocation function associated with the data operation function when calling the data operation function; In response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function; Determine whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length, and if so, confirm that a memory overflow occurs; Wherein, in response to calling the rewritten data operation function, obtaining the application length of the called rewritten data operation function; determining whether the data operation length passed in by the called rewritten data operation function exceeds the obtained application length, and if so, confirming that a memory overflow occurs, including: In response to calling the rewritten memory operation function, obtaining the incoming address of the called rewritten memory operation function, accessing a preset byte in the memory space through the incoming address, obtaining the application length stored in the preset byte, comparing the application length with the operation length passed in by the called rewritten memory operation function, and confirming that a memory overflow occurs if the operation length exceeds the application length; In response to calling the rewritten string operation function, the incoming address of the called rewritten string operation function is obtained, the preset bytes in the memory space are accessed through the incoming address, the requested length stored in the preset bytes is obtained, and the size relationship between the requested length and the string length passed in by the called rewritten string operation function is compared. If the string length exceeds the requested length, it is confirmed that a memory overflow has occurred.

2. The method for detecting memory overflow of an embedded Linux system according to claim 1, wherein: The memory allocation functions include malloc function, free function, calloc function and realloc function, the memory operation functions include memset function, memcpy function, memmove function, bzero function and bcopy function, and the string operation functions include strcpy function, strncpy function, strcat function and strncat function.

3. The memory overflow detection method of the embedded Linux system according to claim 1, characterized in that: The preset bytes are 32 bytes.

4. The method for detecting memory overflow of an embedded Linux system according to claim 1, wherein: The preset rules include: when calling a memory allocation function, applying for an additional 32 bytes for storing an application length, a magic number, a pid of an application thread, and an application thread name; and when calling a data operation function, obtaining a rewritten memory allocation function associated with the data operation function to additionally apply for storing the application length, the magic number, the pid of the application thread, and the application thread name; The magic number is 0x55aa55aa, and the magic number is used to identify the type or version in the file format, data structure or communication protocol.

5. The method for detecting memory overflow of an embedded Linux system according to claim 4, characterized in that: After confirming that the memory overflow occurs, the following steps are also included: Obtain the incoming address of the called rewritten data operation function, access the preset bytes in the memory space through the incoming address, and obtain the application length, magic number, pid of the application thread, and the application thread name stored in the preset bytes; The function name of the rewritten data operation function being called, the length of the data operation passed in, the application length stored in the additional application, the magic number, the pid of the application thread and the application thread name, as well as the pid and thread name of the thread when the memory overflow is confirmed are saved to the log file.

6. The memory overflow detection method of the embedded Linux system according to claim 4, characterized in that: The preset rules include a preset first rule and a preset second rule; wherein, Rewriting the memory allocation function according to the preset first rule, including: when calling the memory allocation function, applying for an additional 32 bytes for storing the application length, the magic number, the pid of the application thread and the application thread name, and recording the return address as ptr; The data operation function is rewritten according to the preset second rule, including: when calling the data operation function, obtaining the input operation address ptr; obtaining the ptr-32 target address according to the operation address ptr, and obtaining the application length, magic number, pid of the application thread and the application thread name stored in the 32 bytes.

7. An electronic device, characterized in that: include: A memory for storing program instructions; as well as A processor is used to execute the program instructions to implement the steps of the memory overflow detection method for an embedded Linux system according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the memory overflow detection method for an embedded Linux system according to any one of claims 1 to 6 are implemented.

Images