Bo opened the first chapter, learning under glibc malloc implementation, the first record source.
A, glibc malloc of transplanted ptmalloc, ptmalloc encapsulates dlmalloc, the following relationship:
dlmalloc (concurrent common but insecure) -> ptmalloc (multi-threaded optimization) -> glibc transplant (but large code changes).
So start ptmalloc start from the manual carefully analyze the Ideological and memory allocation, management.
Two, ptmalloc characteristics
* Vital statistics:
The Supported pointer / size_t representation:. 4 or. 8 bytes
size_t the MUST BE AN unsigned type of The Same width AS
Pointers (the If you are the using AN Ancient System that Declares.
Size_t AS A Signed type, or need IT to BE A Different width
Within last Pointers, Previous use Release A CAN you of the this the malloc
(EG 2.7.2) supporting THESE).
support size_t pointer and form: 4 or 8 bytes
size_t must be unsigned, and the same bit width and pointer. (If you use a signed size_t the old system, or size_t
and inconsistent pointer bits wide, you can use the historical version 2.7.2 support, such as malloc).
Alignment: 8 bytes (default)
. This suffices for in a Nearly All Current Machines and C Compilers
HOWEVER, you CAN the DEFINE MALLOC_ALIGNMENT to BE WIDER Within last the this
IF Necessary (up to 128bytes of), AT at The Expense of a using More Space.
Alignment: the default 8-word festival
It supports almost all current machines and c compiler. In addition, if desired, you can define MALLOC_ALIGNMENT macro,
change to a larger alignment bits wide (up to 128 bytes), the expense will take up more memory space.
Minimum overhead per allocated the chunk:. 4 or. 8 bytes (IF 4byte sizes)
. 8 or 16 bytes (IF 8byte sizes)
Each malloced the chunk has A hidden Word of overhead Holding size
and Status Information, and Additional Cross-Check Word
IF Footers IS defined.
the minimum chunk prefix of each block (overhead): 4 or 8 bytes (4 bytes when size_t)
8, or 16 bytes (8 bytes when size_t)
chunk each application has a hidden prefix word, with given to the block size and the status information, if defined Footers, extra will
occupy a cross-check word.
Minimum allocated size: 4-byte ptrs: 16 bytes (including overhead)
8-byte ptrs: 32 bytes (including overhead)
Even A Request for ZERO bytes (IE, the malloc (0)) Returns A
pointer to something of The Minimum ALLOCATABLE size.
Of The maximum overhead wastage (IE, Number of Extra bytes
allocated Within last were requested in the malloc) IS less Within last or equal
to The minimum size, the except for Requests> = mmap_threshold that
are Serviced Via the mmap (), WHERE The worst Case wastage IS About
32 bytes PLUS The REMAINDER from A System Page (The minimal
the mmap Unit);. typically 4096 or 8192 bytes
minimum application memory size (including prefix): 32bit address: 16 byte
64bit address: 32 byte
even application byte 0 (malloc (0)), the actual minimum memory also returns a pointer. (Malloc in the maximum waste prefix
allocated number of bytes requested exceeds) the case is less than or equal to the minimum application. In addition, when the application memory and large mmap_threshold
, will pass mmap () function to allocate memory, such wastage is maximum 32 bytes (Mini) system plus the remaining pages (minimum units mmap,
典型大小为4096字节或8192字节)。
Security: static-safe; optionally more or less
The "security" of malloc refers to the ability of malicious
code to accentuate the effects of errors (for example, freeing
space that is not currently malloc'ed or overwriting past the
ends of chunks) in code that calls malloc. This malloc
guarantees not to modify any memory locations below the base of
heap, i.e., static variables, even in the presence of usage
errors. The routines additionally detect most improper frees
and reallocs. All this holds as long as the static bookkeeping
for malloc itself is not corrupted by some other means. This
is only one aspect of security -- these checks do not, and
cannot, detect all possible programming errors.
If FOOTERS is defined nonzero, then each allocated chunk
carries an additional check word to verify that it was malloced
from its space. These check words are the same within each
execution of a program using malloc, but differ across
executions, so externally crafted fake chunks cannot be
freed. This improves security by rejecting frees/reallocs that
could corrupt heap memory, in addition to the checks preventing
writes to statics that are always on. This may further improve
security at the expense of time and space overhead. (Note that
FOOTERS may also be worth using with MSPACES.)
By default detected errors cause the program to abort (calling
"abort()"). You can override this to instead proceed past
errors by defining PROCEED_ON_ERROR. In this case, a bad free
has no effect, and a malloc that encounters a bad address
caused by user overwrites will ignore the bad address by
dropping pointers and indices to all known memory. This may
be appropriate for programs that should continue if at all
possible in the face of programming errors, although they may
run out of memory because dropped memory is never reclaimed.
You do not like either IF THESE of Options, you CAN the DEFINE
CORRUPTION_ERROR_ACTION and USAGE_ERROR_ACTION Anything to do
the else. And IF IF you are a using the Sure that your malloc Program has
NO errors or Vulnerabilities, you CAN Insecure to the DEFINE 1,
Which Might (or . might not) provide a small performance improvement
safety: static safety; can choose the
malloc "security" means the ability to call malloc error affects code caused by malicious code. (For example, the release of
memory is not the current application or write overflow of the current chunk tail). This guarantee does not modify the malloc heap below the bottom of
any memory location, such as a static variable, even if there is an error to use. Routine also detect most improper release and
redistribution. As long as static marks malloc itself is not destroyed other programs, all of which are valid. This is only safe
one aspect of - these checks not and can not detect all possible programming errors.
If FOOTERS is defined as non-0, chunk allocated to each block carries an additional check word to verify that it is
Malloc. These programs use malloc check word of each execution are the same, but it is not different in execution
The same, and therefore can not be released chunks external configuration. This may be damaged by refusing to release heap memory / reallocated to improve security
full resistance, also prevents static data write is always in the open state. This may be at the expense of spending time and space into a
further increase security. (Note, FOOTERS may also be worthwhile to use with MSPACES.)
Detects the default error default action is to call abort (call "abort ()"). You can define PROCEED_ON_ERROR to
cover it continues processing error. In this case, the wrong free no effect, while malloc encounters an error caused by the user to override
an address, wrong address will be ignored by the index pointer and threw all known memory. This may apply to those that may arise programming
procedures if an error should continue to run, even though they may run out of memory because memory will never be discarded recovered.
If you do not like these options, you can define CORRUPTION_ERROR_ACTION and USAGE_ERROR_ACTION to do
any other thing. If you believe that your program uses malloc no errors or loopholes, you can INSECURE set, this may
be (or may not) have a small performance increase.
Thread-safety: NOT thread-safe unless USE_LOCKS defined
When USE_LOCKS is defined, each public call to malloc, free,
etc is surrounded with either a pthread mutex or a win32
spinlock (depending on WIN32). This is not especially fast, and
can be a major bottleneck. It is designed only to provide
minimal protection in concurrent environments, and to provide a
basis for extensions. If you are using malloc in a concurrent
program, consider instead using nedmalloc
(http://www.nedprod.com/programs/portable/nedmalloc/) or
ptmalloc (See http://www.malloc.de), which are derived
from versions of this malloc.
线程安全：不是线程安全的，除非定义USE_LOCKS
When USE_LOCKS is defined that each common call malloc, free, etc. are pthread mutex or spin lock win32 wrap
(depending on win32). This is not particularly fast, it will become a major bottleneck. In a concurrent environment, it is designed to provide only minimal protection,
to provide the basis for an extended version. If you use a concurrent environment malloc, consider using nedmalloc or ptmalloc, which
is derived from this version of malloc.
System requirements: Any combination of MORECORE and/or MMAP/MUNMAP
This malloc can use unix sbrk or any emulation (invoked using
the CALL_MORECORE macro) and/or mmap/munmap or any emulation
(invoked using CALL_MMAP/CALL_MUNMAP) to get and release system
memory. On most unix systems, it tends to work best if both
MORECORE and MMAP are enabled. On Win32, it uses emulations
based on VirtualAlloc. It also uses common C library functions
like memset.
Compliance: I believe it is compliant with the Single Unix Specification
(See http://www.unix.org). Also SVID/XPG, ANSI C, and probably
others as well.
* Overview of algorithms
This is not the fastest, most space-conserving, most portable, or
most tunable malloc ever written. However it is among the fastest
while also being among the most space-conserving, portable and
tunable. Consistent balance across these factors results in a good
general-purpose allocator for malloc-intensive programs.
In most ways, this malloc is a best-fit allocator. Generally, it
chooses the best-fitting existing chunk for a request, with ties
broken in approximately least-recently-used order. (This strategy
normally maintains low fragmentation.) However, for requests less
than 256bytes, it deviates from best-fit when there is not an
exactly fitting available chunk by preferring to use space adjacent
to that used for the previous small request, as well as by breaking
ties in approximately most-recently-used order. (These enhance
locality of series of small allocations.) And for very large requests
(>= 256Kb by default), it relies on system memory mapping
facilities, if supported. (This helps avoid carrying around and
possibly fragmenting memory used only for large chunks.)
All operations (except malloc_stats and mallinfo) have execution
times that are bounded by a constant factor of the number of bits in
a size_t, not counting any clearing in calloc or copying in realloc,
or actions surrounding MORECORE and MMAP that have times
proportional to the number of non-contiguous regions returned by
system allocation routines, which is often just 1. In real-time
applications, you can optionally suppress segment traversals using
NO_SEGMENT_TRAVERSAL, which assures bounded execution even when
system allocators return non-contiguous spaces, at the typical
expense of carrying around more memory and increased fragmentation.
The implementation is not very modular and seriously overuses
macros. Perhaps someday all C compilers will do as good a job
inlining modular code as can now be done by brute-force expansion,
but now, enough of them seem not to.
Some compilers issue a lot of warnings about code that is
dead/unreachable only on some platforms, and also about intentional
uses of negation on unsigned types. All known cases of each can be
ignored.
For a longer but out of date high-level description, see
http://gee.cs.oswego.edu/dl/html/malloc.html
Introduction to Algorithms:
It's not the fastest, most space-saving, the most the most portable or adjustable malloc. However, it is the fastest, but
also the most space-saving, portable and adjustable. Consistent balance between these factors can malloc intensive programs
provide a good general allocation procedure.
In most cases, this is the most suitable malloc allocator. Typically, it will request select the most appropriate existing chunk,
and in order to disconnect the least recently used. (This strategy is usually kept low fragmentation.) However, in less than 256bytes
request, if not completely suitable available blocks when it deviates from the best match because it tends to use a previous request small phase
space adjacent and breaking the order of most recently used. (This enhances the application of a series of small memory locality.) For very large Please
request (by default> = 256Kb), if supported, it depends on system memory mapping tool. (This helps to avoid carrying only
in large blocks of memory, and can make the memory fragmentation.)
// skip
this implementation is not very modular, and serious abuse of the macro. Perhaps one day, all C compilers can be like now extended through brute force
can do as well inline modular code.
Some compilers will issue a large number of warning that the code only on some platforms is dead / unreachable, but also deliberately unsigned
use negated on type. All known cases in each case can be ignored.