Heap-corruption when freeing allocated memory

Question

I am writing small school project, and I got stuck with error that I can't fix. When I try to free allocated memory, I get this error:

Here is the code that involves my char pointer temp:

1. Allocation of memory and setting starting value:

 char *temprijec(int rng, RIJEC *B, int *len) {
    int i;
    char *temp=(char*)calloc(*len + 1, sizeof(char));
    *len = strlen((B + rng)->rijec);
    for (i = 0; i < *len; i++) {
        if (i == 0) {
            temp[i] = (B + rng)->rijec[i];
        }
        else if (i == (*len)) {
            temp[i] = '\0';
        }
        else {
            temp[i] = '_';
        }
    }
    return temp;
 }

2. Working with char pointer temp:

void tijek_igre(char*temp,RIJEC *B,int rng,int len,int*br2pok,int *pokpogreska,int *pokbr,char*pokch) {
    int i;
    printf("\nPogodi slovo ili rijec!");
    *pokch = _getch();
    for (i = 0; (B + rng)->rijec[i] != '\0'; i++) {
        if (*pokch == (B + rng)->rijec[i]) {
            temp[i] = *pokch;
        }
    }
    for (i = 0; (B + rng)->rijec[i] != '\0'; i++) {
        if (*pokch != (B + rng)->rijec[i]) {
            (*br2pok)++;
            if (*br2pok == len) {
                (*pokpogreska)++;
            }
        }
    }
    for (i = 0; temp[i] != '\0'; i++) {
        if (temp[i] != '_') {
            (*pokbr)++;
        }
    }
}

Everything is fine until I try to free it with free(temp);

In your Code snippets I don't see any `free`. I assume some relevant part is missing. — milbrandt, Apr 03 '18 at 19:11
tons of variables here, we don't know what any of your arguments, structures, or typedefs are, an [MCVE](https://stackoverflow.com/help/mcve) would be most helpful. But in your `temprijec` function, allocating `temp` based on `*len`, then changing `*len` to some other value, then filling `temp` based on the new value of `*len`,,, that seems awfully dangerous to me. — yano, Apr 03 '18 at 19:19
What steps have you taken to try and debug this? I'd recommend reading https://stackoverflow.com/help/mcve to learn how to narrow this issue down. — Evan Darwin, Apr 03 '18 at 20:29
The error you're getting is pretty clear, you're writing out of bounds and triggering UB. Check your memory accesses. — Mgetz, Apr 03 '18 at 20:59
you just have to slog through to find out where you go off the end of temp. The free is raising the error simply because thats when the debug CRT gets a change to look see if you wrote off the end of your space. If you were on linux you could use valgrind — pm100, Apr 03 '18 at 22:08
It does not make sense to use strlen() to calculate `*len` *after* the calloc() call. Swap the two statements. — Hans Passant, Apr 04 '18 at 00:55
@yano Sry for late response.I copied that `*len` part to wrong place here.I did like you said,I have created MCVE but without all those pointers and it worked,so I passed structure with needed variables to function instead of pointers and now it works. Tnx for your comment it helped me alot. — Mx2uler, Apr 07 '18 at 15:58

score 1 · Accepted Answer · answered Apr 07 '18 at 16:03

I fixed the error by changing the way I am passing variables to function,structure instead of pointers and now it works idk why but it works :).Tnx everyone for help.

Changed code:

VARIJABLE temprijec(VARIJABLE V, RIJEC *B) {
    int i;
    V.len = strlen((B + V.rng)->rijec);
    V.temp = (char*)calloc(V.len + 1, sizeof(char));

    for (i = 0; i < V.len + 1; i++) {
        if (i == 0) {
            V.temp[i] = (B + V.rng)->rijec[i];
        }
        else if (i == (V.len)) {
            V.temp[i] = '\0';
        }
        else {
            V.temp[i] = '_';
        }
    }
    return V;
}

and

VARIJABLE tijek_igre(RIJEC *B, VARIJABLE V) {
    int i;
    printf("\nPogodi slovo ili rijec!");
    V.ch = _getch();
    for (i = 0; (B + V.rng)->rijec[i] != '\0'; i++) {
        if (V.ch == (B + V.rng)->rijec[i]) {
            V.temp[i] = V.ch;
        }
    }
    for (i = 0; (B + V.rng)->rijec[i] != '\0'; i++) {
        if (V.ch != (B + V.rng)->rijec[i]) {
            (V.pogresno_slovo)++;
            if (V.pogresno_slovo == V.len) {
                (V.pogreska)++;
            }
        }
    }
    for (i = 0; V.temp[i] != '\0'; i++) {
        if (V.temp[i] != '_') {
            (V.tocno_slovo)++;
        }
    }
    return V;
}

Heap-corruption when freeing allocated memory

1 Answers1