Heap has been corrupted after a certain size malloc In C

Question

Im trying to write a very simple compressor in C and I ran into the error "Heap has been corrupted" in my code. I looked into it, and the error seems to come because of this line:

ptr = (char*)malloc(count * sizeof(char));

when i change the size from count to 1000 it works, and i tried debugging and seeing if there is a difference somewhere but i couldnt find it, i understand there might be somekind of an overflow but i dont understand why and whats the solution instead of just writing a big number to fix it

this is my code for now:

#include <stdio.h>
#include <stdlib.h>

errno_t err;
int count =0;

struct node {
    int data;
    struct node* left;
    struct node* right;
};

struct node* newNode(int data) {
        struct node* node = (struct node*)malloc(sizeof(struct node));

        node->data = data;

        node->left = NULL;
        node->right = NULL;
        return (node);
    };

int* frequency(char* str) {

    FILE* fptr;
    err = fopen_s(&fptr, str, "r");
    if (err != 0)
    {
        printf("The file wasn't opened\n");
        exit(0);
    }

    int* ptr;
    ptr = (int*)malloc(95 * sizeof(int));

    if (ptr == NULL) {
        printf("Error! memory not allocated.");
        exit(0);
    }

    for (int i = 0; i < 95; i++) {
        *(ptr + i) = 0;
    }
    char ch;
    int index;

    while ((ch = fgetc(fptr)) != EOF) {
        index = (int)ch - 32;
        (*(ptr+index))++;
    }

    err = fclose(fptr);
    if (err != 0)
    {
        printf("The file wasn't closed\n");
        exit(0);
    }

    for (int i = 0; i < 95; i++) {
        printf("%d ", *(ptr+i));
    }
    return ptr;
}

void* letFrequency(int* occLet) {
    for (int i = 0; i < 95; i++) // counts how many actually occur 
    {
        if (*(occLet+i) > 0)
        {
            count++;
        }
    }

    int* ptr;
    ptr = (char*)malloc(count * sizeof(char));
    if (ptr == NULL) {
        printf("Error! memory not allocated.");
        exit(0);
    }

    int max = 0;
    int placement = 0;

    for (int j = 0; j < count; j++) {
        for (int i = 0; i < 95; i++) {
            if (*(occLet+i) >= max)
            {
                max = *(occLet+i);
                placement = i;
            }
        }
        *(ptr+j) = (char)(placement + 32);
        printf("%c", *(ptr +j));
        *(occLet+placement) = 0;
        max = 1;
    }
    return ptr;
}

void binaryMap(char* letFrq) {
    struct node* rootzero = newNode(1);
    struct node* rootone = newNode(0);

    int leaveszero = 0;
    int leavesone = 0;

    if (count % 2 == 0) {
        leavesone = count / 2;
        leaveszero = count / 2;
    }
    else
    {
        leavesone = count / 2;
        leaveszero = count / 2 + 1;
        printf("%d", leaveszero);
    }

}


int main() {
    char str[70];
    printf("Enter the name of the text file you want to compress: ");
    scanf_s("%s", str, sizeof(str));
    int* ptrFr;
    char* ptrLetFr;
    ptrFr = frequency(str);
    ptrLetFr = letFrequency(ptrFr);
    free(ptrFr);
    binaryMap(ptrLetFr);
}

Answer 1

The lines;

    int* ptr;
    ptr = (char*)malloc( count * sizeof(char));

are clearly erroneous. If you intended count integers, then sizeof(char) will allocate too small a block. I suggest as a habit:

• Do not cast void* - just assign it.
• Use sizeof the object pointed to, not an explicit type.
• Do not leave dangling pointers unnecessary.

To that end:

    int* ptr = malloc(count * sizeof(*ptr) ) ;

Or if it were _intended to be char* then:

    char* ptr = malloc(count * sizeof(*ptr) ) ;

Note how minimal the change is - you don't have to correct it three different places.