C - realloc causes crash

Question

I'm trying to implement a dynamyc array of strings (which can be any length) read from console. However it crashes on the realloc() call in the loop. The code:

void kill(char **memory, int count) {
        if (memory != NULL) {
        for (int i = 0; i < count; i++) {
            if (memory[i] != NULL) {
                free(memory[i]);
            }
        }
        free(memory);
    }
}

char **getData(int *strCount, int *allocatedCount) {
    int maxStrCount = 10;
    int maxStrLength = 10;
    char **data = malloc(sizeof(char *) * maxStrCount);
    if (data == NULL) {
        return NULL;
    }
    for (int i = 0; i < maxStrCount; i++) {
        data[i] = malloc(sizeof(char) * maxStrLength);
        if (data[i] == NULL) {
            kill(data, i);
            return NULL;
        }
    }
    int i = 0;
    int j = 0;
    for (char ch = getchar(); ch != EOF; ch = getchar()) {
        if (ch == '\n') { // if end of line
            data[i][j] = '\0';
            i++;
            j = 0;
            if (i >= maxStrCount) {
                // extend array
                char **newData = realloc(data, sizeof(char *) * (maxStrCount * 2));
                if (newData == NULL) {
                    kill(data, maxStrCount);
                    return NULL;
                }
                maxStrCount *= 2;
                data = newData;
                for (int k = i; k < maxStrCount; k++) {
                    data[k] = malloc(sizeof(char) * maxStrLength);
                    if (data[k] == NULL) {
                        kill(data, k);
                        return NULL;
                    }
                }
            }
        } else { // if not end of line
            data[i][j] = ch;
            j++;
            if (j >= maxStrLength - 1) { // extend string
                maxStrLength *= 2;
                char *newStr = realloc(data[i], sizeof(char) * maxStrLength); // Here it crashes
                if (newStr == NULL) {
                    kill(data, maxStrCount);
                    return NULL;
                }
                data[i] = newStr;
            }
        }
    }
    if (j > 0) { // in case of file doesn't end with empty line
        data[i][j] = '\0';
        i++;
    }
    if (i == 0) { // in case of empty input
        kill(data, maxStrCount);
        return NULL;
    }
    *strCount = i;
    *allocatedCount = maxStrCount;
    return data;
}

The crash appears on the following input:

Lorem ipsum dolor sit
amet, consectetur
adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua

It happens like this: It reads "Lorem ips", then realloc is called, then reads "Lorem ipsum dolor s", then realloc is called again, all fine. Then it reads "amet, consectetur" (2-nd line) and "adipiscing elit, sed do eiusmod tempor " (3-rd line), then tries to realloc and crashes.

I watched all this trying to debug, but I still have no idea why does it crash.

Answer 1

You are sharing the variable maxStrLength between all strings.

You are reallocating the buffer for the 2-nd line and increasing that maxStrLength; however, when you are reading the next line, it's buffer is smaller, so you are writing into it out-of-bounds here:

data[i][j] = ch;