CODEWITHSUNDEEP
cmemory-management
the_gp
the_gp

Reputation: 3

free(): invalid next size (fast) - Freeing a struct of string array in c

Hello I am trying to free a linked list I have created and I'm having some real trouble.

My System is Ubuntu 10.10 and I am using the gcc compiler. I have to use a makefile and separate source files compilation. This is the head of the makefile

OBJS    = main.o Buffer.o ExtMerge.o MySet.o
SOURCE  = main.c Buffer.c ExtMerge.c MySet.c
HEADER  = MyHeader.h Buffer.h ExtMerge.h MySet.h
OUT     = myjoin
CC  = gcc
FLAGS   = -g -c

The programm is part of an external sorting programm.It reads a bulk of records from a file, inserts them to the List sorted and writes them to part files.So far everything is going as it should. Then another file is opened. At this point, it would be wise to free the memory so that the new List (containing data from say file2) doesn't cost extra memory.

Let me show you my code: The nodes of the List:

struct record{

    char    **field;
    struct  record  *next;
    };

This function inserts an array of tokens (read from the file) to the list ordered: cols_no is the number of strings in the array, column is the one of interest. The following malloc stuff works just perfect

struct record *OrderedInsertRec(struct record *buf, char **arr, int column, int cols_no)
{   struct  record  *aux=NULL;
    int i;

if ( buf==NULL ) { 
            buf = (struct record *) malloc (sizeof(struct record)+1);
            buf->field=(char **)calloc(cols_no, sizeof(char*));
    for (i = 0; i <= cols_no; ++i){
        buf->field[i] = (char*)malloc(((strlen(arr[i])+1))*sizeof(char*));
        strcpy(buf->field[i],arr[i]);
    }

            buf->next = NULL;
    return(buf);
            }                 
else if ( strverscmp (buf->field[column], arr[column]) < 0 ) {  
    buf->next = OrderedInsertRec (buf->next, arr, column, cols_no);
    return(buf);
    }
else    {
    aux = (struct record *) malloc (sizeof(struct record)+1);
            aux->field=(char **)calloc(cols_no, sizeof(char*));
    for (i = 0; i <= cols_no; ++i){
        aux->field[i] = malloc(strlen(arr[i])+1);
        strcpy(aux->field[i],arr[i]);
    }

            aux->next = NULL;
    aux->next = buf;
    return(aux);
            }

}

This is causing my trouble:

struct record * DeleteBuffer(struct record * buf, int cols_no)
{
int i;

struct record * tmp;

while(buf != NULL)
{

    tmp = buf; 
    buf = buf->next;
    }
free(tmp);
}

}

This works without any problem but does nothing. Only a small amount of memory is freed(I suppose beacause I only free the pointer I have allocated in OrderedInsert and not the field[] array) as I can see from the System Monitor

Then I tried this:

struct record * DeleteBuffer(struct record * buf, int cols_no)
{
int i;


struct record * tmp;
while(buf != NULL)
{

    tmp = buf; 
    buf = buf->next;
    for (i = 0; i <= cols_no; ++i){

        free(tmp->field[i]);
    }

free(tmp);
}
}
}

And this is what i got: {

*** glibc detected *** ./myjoin: double free or corruption (out): 0x088b3010 ***
======= Backtrace: =========
/lib/libc.so.6(+0x6c501)[0xb766e501]
/lib/libc.so.6(+0x6dd70)[0xb766fd70]
/lib/libc.so.6(cfree+0x6d)[0xb7672e5d]
./myjoin[0x8048bee]
./myjoin[0x80495b4]
./myjoin[0x8048a10]
/lib/libc.so.6(__libc_start_main+0xe7)[0xb7618ce7]
./myjoin[0x8048791]
======= Memory map: ========
08048000-0804b000 r-xp 00000000 fb:03 2999566    /home/giorgos/Desktop/test11/myjoin
0804b000-0804c000 r--p 00002000 fb:03 2999566    /home/giorgos/Desktop/test11/myjoin
0804c000-0804d000 rw-p 00003000 fb:03 2999566    /home/giorgos/Desktop/test11/myjoin
088a0000-088c1000 rw-p 00000000 00:00 0          [heap]
b74d3000-b74ed000 r-xp 00000000 fb:03 3940432    /lib/libgcc_s.so.1
b74ed000-b74ee000 r--p 00019000 fb:03 3940432    /lib/libgcc_s.so.1
b74ee000-b74ef000 rw-p 0001a000 fb:03 3940432    /lib/libgcc_s.so.1
b7500000-b7521000 rw-p 00000000 00:00 0 
b7521000-b7600000 ---p 00000000 00:00 0 
b7601000-b7602000 rw-p 00000000 00:00 0 
b7602000-b7759000 r-xp 00000000 fb:03 3940764    /lib/libc-2.12.1.so
b7759000-b775b000 r--p 00157000 fb:03 3940764    /lib/libc-2.12.1.so
b775b000-b775c000 rw-p 00159000 fb:03 3940764    /lib/libc-2.12.1.so
b775c000-b775f000 rw-p 00000000 00:00 0 
b776d000-b7772000 rw-p 00000000 00:00 0 
b7772000-b7773000 r-xp 00000000 00:00 0          [vdso]
b7773000-b778f000 r-xp 00000000 fb:03 3940761    /lib/ld-2.12.1.so
b778f000-b7790000 r--p 0001b000 fb:03 3940761    /lib/ld-2.12.1.so
b7790000-b7791000 rw-p 0001c000 fb:03 3940761    /lib/ld-2.12.1.so
bfb1a000-bfb3b000 rw-p 00000000 00:00 0          [stack]
Aborted

}

What should I do. Is it a problem with my malloc?? Thank you in advance!

Upvotes: 0

Views: 2196

Answers (2)

typo.pl
typo.pl

Reputation: 8942

I see three problems. You malloc/calloc:

      buf = (struct record *) malloc (sizeof(struct record)+1);
      buf->field=(char **)calloc(cols_no, sizeof(char*));

Why sizeof(struct record)+1? What's the +1 for?

You calloc() cols_no items of size sizeof(char*), yet your two for-loop's go from 0...cols, when it should go from 0...cols-1.

   for (i = 0; i <= cols_no; ++i){

should be:

   for (i = 0; i < cols_no; ++i){

You should be allocating (strlen(arr[i])+1)*sizeof(char) -- using sizeof(char*) is probably 4-8x too much, assuming sizeof(char) == 1 and sizeof(char*) == 4 or 8 depending on 32-bit or 64bit ptrs.

      buf->field[i] = (char*)malloc(((strlen(arr[i])+1))*sizeof(char*));

should be:

      buf->field[i] = (char*)malloc(((strlen(arr[i])+1))*sizeof(char));

Upvotes: 1

Erik
Erik

Reputation: 91260

calloc(cols_no, sizeof(char*))
...
for (i = 0; i <= cols_no; ++i)

You're mixing whether cols_no is number of columns or index of last column.

Try changing all your loops from <=cols_no to <cols_no

If you have cols_no elements in an array, the valid array indexes are 0..cols_no-1

Upvotes: 0

Related Questions