void func(void)
{
    len = strlen(str);
    p = malloc(len);
    strcpy(p, str);  /*錯(cuò)誤！str的’’寫到動態(tài)內(nèi)存外*/
}

/* Log of dynamic memory usage */
typedef struct _dmem_log
{
    struct _dmem_log *p_stNext; /* Point to next log */
    const void *p_vDMem; /* Point to allocated memory by this pointer */
    INT32S iSize; /* Size of the allocated memory */
} DMEM_LOG;

static DMEM_LOG *s_pstFreeLog; /* Point to free log pool by this pointer */
static INT8U s_byNumUsedLog;
static DMEM_LOG *s_pstHeadLog; /* Point to used log chain by this pointer */


/* Pool of dynamic memory log */
#define NUM_DMEM_LOG 20
static DMEM_LOG s_astDMemLog[NUM_DMEM_LOG];

/**********************************************************                                                             *                    Initialize DMem Log
* Description : Initialize log of dynamic memory
* Arguments  : void
* Returns      : void
* Notes        :
**********************************************************/
static?void?InitDMemLog(void)
{
????INT16S????nCnt;
    /* Initialize pool of log */
    for (nCnt = 0; nCnt < NUM_DMEM_LOG; ++nCnt)
    {
        /* Point to next one */
        s_astDMemLog[nCnt].p_stNext = &s_astDMemLog[nCnt + 1];
    }
    s_astDMemLog[NUM_DMEM_LOG - 1].p_stNext = NULL;
    s_pstFreeLog = &s_astDMemLog[0]; /* Point to the 1th log */
    return;
}


/**********************************************************                                                             *                       Log DMem
* Description : Join an allocated memory into log pool
* Arguments  : const void *p_vAddr    point to address of this allocated memory by this pointer
*             INT32S iSize    size of this allocated memory
* Returns      : void
* Notes        :
**********************************************************/
static void LogDMem(const void *p_vAddr, INT32S iSize)
{
    ASSERT(p_vAddr && iSize > 0);
    DMEM_LOG *p_stLog;
    #if OS_CRITICAL_METHOD == 3
    OS_CPU_SR  cpu_sr;
    #endif


    /* Get a log from free pool */
    OS_ENTER_CRITICAL(); /* Avoid race condition on s_pstFreeLog */
    if (!s_pstFreeLog)
    {
        OS_EXIT_CRITICAL();
        PRINTF("Allocate DMemLog failed.
");       
        return;
    }
    p_stLog = s_pstFreeLog;
    s_pstFreeLog = s_pstFreeLog->p_stNext;
    OS_EXIT_CRITICAL();


    /* Don't need to protect this log that is free one currently */
    p_stLog->p_vDMem = p_vAddr;
    p_stLog->iSize = iSize;


    /* Put this log into used chain */
    OS_ENTER_CRITICAL(); /* Avoid race condition */
    p_stLog->p_stNext = s_pstHeadLog;
    s_pstHeadLog = p_stLog;
    ++s_byNumUsedLog;
    OS_EXIT_CRITICAL();


    return;
}


/**********************************************************                                                             *                       Unlog DMem
* Description : Remove an allocated memory from log pool
* Arguments  : const void *p_vAddr point to address of this allocated memory by this pointer
* Returns      : void
* Notes        :
**********************************************************/
static void UnlogDMem(const void *p_vAddr)
{
    ASSERT(p_vAddr);
    DMEM_LOG    *p_stLog, *p_stPrev;
    #if OS_CRITICAL_METHOD == 3
    OS_CPU_SR  cpu_sr;
    #endif


    /* Search the log */
    OS_ENTER_CRITICAL(); /*Avoid race condition */
    p_stLog = p_stPrev = s_pstHeadLog;
    while (p_stLog)
    {
        if (p_vAddr == p_stLog->p_vDMem)
        {
         break; /* Have found */
        }          


        p_stPrev = p_stLog;        
        p_stLog = p_stLog->p_stNext;    /* Move to next one */
    }


    if (!p_stLog)
    {
        OS_EXIT_CRITICAL();
        PRINTF("Search Log failed.
");         
        return;
    }


    /* Remove from used pool */
    if (p_stLog == s_pstHeadLog)
    {
     s_pstHeadLog = s_pstHeadLog->p_stNext;
    }
    else
    {
     p_stPrev->p_stNext = p_stLog->p_stNext;
    }
    --s_byNumUsedLog;
    OS_EXIT_CRITICAL();


    /* Don't need to protect this log that is free one currently */
    p_stLog->p_vDMem = NULL;
    p_stLog->iSize = 0;


    /* Add into free pool */
    OS_ENTER_CRITICAL(); /* Avoid race condition */
    p_stLog->p_stNext = s_pstFreeLog;
    s_pstFreeLog = p_stLog;
    OS_EXIT_CRITICAL();


    return;
}

/*********************************************************                                                    
*                      Malloc Extension
* Description : Malloc a block of memory and log it if need
* Arguments : INT32S iSize    size of desired allocate memory
* Returns: void *NULL= failed, otherwise=pointer of allocated memory
* Notes        :
**********************************************************/
void *MallocExt(INT32S iSize)
{
    ASSERT(iSize > 0);
    void *p_vAddr;


    p_vAddr = malloc(iSize);
    if (!p_vAddr)
    {
     PRINTF("malloc failed at %s line %d.
", __FILE__, __LINE__);
    }
    else
    {
        #if (DMEM_DBG && DBG_VER)
        memset(p_vAddr, 0xA3, iSize); /* Fill gargage for debug */
        LogDMem(p_vAddr, iSize);    /* Log memory for debug */
        #endif
    }


    return p_vAddr;     
}


/**********************************************************
*                      Free Extension
* Description : Free a block of memory and unlog it if need
* Arguments  : void * p_vMem point to the memory by this pointer
* Returns      : void
* Notes        :
**********************************************************/
void FreeExt(void *p_vMem)
{
    ASSERT(p_vMem);


    free(p_vMem);  
    #if (DMEM_DBG && DBG_VER)
    UnlogDMem(p_vMem);    /* Remove memory from log */
    #endif
    return;
}

?

?

?