All allocated memory freed, still Invalid free

Question

Why do I get different results with two versions of the gcc compiler?

With gcc version 4.9.2 my program compiles and runs without a core dump. But with the gcc version 5.3 it compiles without any warning, but on execution dumps core. What causes the difference? I have tried with malloc, it results in even more errors by both gcc versions.

The versions in question are

1. gcc version 4.9.2 20150212 (Red Hat 4.9.2-6) (GCC) (Fedora 21 - 3.19.5-200.fc21.i686) - Valgrind 3.10
2. gcc version 5.3.1 20151207 (Red Hat 5.3.1-2) (GCC) (Fedora 23 - 4.2.3-300.fc23.x86_64) - Valgrind 3.11

The code snippet is given below:

#include <stdio.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>


char *somval[12][2] =
 {
  {"one", "ONE"},
  {"two", "TWO"},
  {"three", "THREE"},
  {"four", "FOUR"},
  {"five", "FIVE"},
  {"six", "SIX"},
  {"seven", "SEVEN"},
  {"eight", "EIGHT"},
  {"nine", "NINE"},
  {"ten", "TEN"},
  {NULL, NULL}
 };

typedef struct _getval
 {
  char **val1;
  char **val2;
 }GETVAL;

int main()
{
 int i;

 GETVAL *getval;
 getval = calloc(1, sizeof(GETVAL));
 getval->val1 = calloc(12, sizeof(int));
 getval->val2 = calloc(12, sizeof(int));

 for(i = 0; somval[i][1] != NULL; i++)
   {
    getval->val1[i] = calloc(101, sizeof(int));
    getval->val1[i] = somval[i][0];
    getval->val2[i] = somval[i][1];

    printf("%s = %s\n", getval->val1[i], getval->val2[i]);
   }

 for(i = 0; somval[i][1] != NULL; i++)
   {
    free(getval->val1[i]);
   }
 free(getval->val1);
 free(getval->val2);
 free(getval);

 return 0;
}

Compile the program with gcc or cc and valgrind ./a.out gives the following on gcc version 4.92. The program runs fine without a core dump and executed without valgrind.

==4818== Memcheck, a memory error detector
==4818== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==4818== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==4818== Command: ./a.out
==4818== 
one = ONE
two = TWO
three = THREE
four = FOUR
five = FIVE
six = SIX
seven = SEVEN
eight = EIGHT
nine = NINE
ten = TEN
==4818== Invalid free() / delete / delete[] / realloc()
==4818==    at 0x40082CD: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==4818==    by 0x80485A1: main (in /users/netha/NTFiles/progs/cprog/test/a.out)
==4818==  Address 0x8048684 is not stack'd, malloc'd or (recently) free'd
==4818== 
==4818== 
==4818== HEAP SUMMARY:
==4818==     in use at exit: 4,040 bytes in 10 blocks
==4818==   total heap usage: 13 allocs, 13 frees, 4,144 bytes allocated
==4818== 
==4818== LEAK SUMMARY:
==4818==    definitely lost: 4,040 bytes in 10 blocks
==4818==    indirectly lost: 0 bytes in 0 blocks
==4818==      possibly lost: 0 bytes in 0 blocks
==4818==    still reachable: 0 bytes in 0 blocks
==4818==         suppressed: 0 bytes in 0 blocks
==4818== Rerun with --leak-check=full to see details of leaked memory
==4818== 
==4818== For counts of detected and suppressed errors, rerun with: -v
==4818== ERROR SUMMARY: 10 errors from 1 contexts (suppressed: 0 from 0)

----------------------------------------------------
Compile the program with gcc or cc and valgrind ./a.out gives the following on gcc version 5.3. The program runs fine without a core dump and executed with valgrind. Otherwise, the program dumps core without valgrind.

==29481== Memcheck, a memory error detector
==29481== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==29481== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==29481== Command: ./a.out
==29481== 
one = ONE
two = TWO
three = THREE
four = FOUR
five = FIVE
six = SIX
==29481== Invalid write of size 8
==29481==    at 0x400645: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f60c0 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x4005F0: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
==29481== Invalid write of size 8
==29481==    at 0x40066E: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f60c0 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x4005F0: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
==29481== Invalid write of size 8
==29481==    at 0x400698: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f6130 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x400609: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
==29481== Invalid read of size 8
==29481==    at 0x4006B0: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f6130 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x400609: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
==29481== Invalid read of size 8
==29481==    at 0x4006C7: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f60c0 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x4005F0: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
seven = SEVEN
eight = EIGHT
nine = NINE
ten = TEN
==29481== Invalid free() / delete / delete[] / realloc()
==29481==    at 0x4C29E00: free (vg_replace_malloc.c:530)
==29481==    by 0x400722: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x400810 is in a r-x mapped file /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out segment
==29481== 
==29481== Invalid read of size 8
==29481==    at 0x400718: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481==  Address 0x51f60c0 is 0 bytes after a block of size 48 alloc'd
==29481==    at 0x4C2AA98: calloc (vg_replace_malloc.c:711)
==29481==    by 0x4005F0: main (in /XtraStorage/netha/jayami/progs/cprog/gtk_examples/a.out)
==29481== 
==29481== 
==29481== HEAP SUMMARY:
==29481==     in use at exit: 4,040 bytes in 10 blocks
==29481==   total heap usage: 13 allocs, 13 frees, 4,152 bytes allocated
==29481== 
==29481== LEAK SUMMARY:
==29481==    definitely lost: 4,040 bytes in 10 blocks
==29481==    indirectly lost: 0 bytes in 0 blocks
==29481==      possibly lost: 0 bytes in 0 blocks
==29481==    still reachable: 0 bytes in 0 blocks
==29481==         suppressed: 0 bytes in 0 blocks
==29481== Rerun with --leak-check=full to see details of leaked memory
==29481== 
==29481== For counts of detected and suppressed errors, rerun with: -v
==29481== ERROR SUMMARY: 34 errors from 7 contexts (suppressed: 0 from 0)

Answer 1

Thanks for pointint it out. I have been allocating memory by sizeof(int) and none of the programs crashed until this new gcc version. I have updated the code and pasted it below with the valgrind results on gcc version 5.3. I replaced sizeof(int) with sizeof(void *)

#include <stdio.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>


char *somval[12][2] =
 {
  {"one", "ONE"},
  {"two", "TWO"},
  {"three", "THREE"},
  {"four", "FOUR"},
  {"five", "FIVE"},
  {"six", "SIX"},
  {"seven", "SEVEN"},
  {"eight", "EIGHT"},
  {"nine", "NINE"},
  {"ten", "TEN"},
  {NULL, NULL}
 };

typedef struct _getval
 {
  char **val1;
  char **val2;
 }GETVAL;

int main()
{
 int i;

 GETVAL *getval;
 getval = calloc(1, sizeof(GETVAL));
 getval->val1 = calloc(12, sizeof(void *));
 getval->val2 = calloc(12, sizeof(void *));

 for(i = 0; somval[i][1] != NULL; i++)
   {
    getval->val1[i] = somval[i][0];
    getval->val2[i] = somval[i][1];

    printf("%s = %s\n", getval->val1[i], getval->val2[i]);
   }

 free(getval->val1);
 free(getval->val2);
 free(getval);

 return 0;
}

-------------------------------------------
Compile with cc or gcc and ran with valgrind gave the below result. Without valgrind the program did not dump core.

==31006== Memcheck, a memory error detector
==31006== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==31006== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==31006== Command: ./a.out
==31006== 
one = ONE
two = TWO
three = THREE
four = FOUR
five = FIVE
six = SIX
seven = SEVEN
eight = EIGHT
nine = NINE
ten = TEN
==31006== 
==31006== HEAP SUMMARY:
==31006==     in use at exit: 0 bytes in 0 blocks
==31006==   total heap usage: 3 allocs, 3 frees, 208 bytes allocated
==31006== 
==31006== All heap blocks were freed -- no leaks are possible
==31006== 
==31006== For counts of detected and suppressed errors, rerun with: -v
==31006== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Answer 2

val1 and val2 are pointers but you're using sizeof(int) to allocate them. Same with *val1 and *val2.