Program crashes at times while using free on a pointer which holds conditionally allocated memory

Question

This is a simple code just to illustrate the issue I am dealing with.

If you give the input of n = 3 and enter the array elements as 1, 2 ,3 and m= 0 the program crashes!!!

Why is it so?? The problem occurs due to the last 2 lines involving the free()

Now my question is why this thing is happening? The same program with the same input doesn't crash if the free statements are removed...

Please explain me. Is it so that the conditional memory allocation is causing the said problem to occur?? If so then why ?

I am not getting any cue, moreover free (NULL) shall not cause any error as far as I know, so the problem is caused when I am trying to free one of the allocated memory, especially positive in my input ...

This is my code:

#include <stdlib.h>
#include <stdio.h>

int main()
{
    int n;
    scanf("%d",&n);
    printf("Enter elements into the array\n");
    int arr[n];
    int i;
    for(i=0;i<n;)
    {
        printf("arr[%d] ? ",i);
        scanf("%d",(arr+i));
        if(i>0)
        {
            if(arr[i]<arr[i-1])
                continue;
            else
                i++;
        }
        else
            i++;
    }
    int m;
    printf("m ? ");
    scanf("%d",&m);
    int j,flag=0;
    int *positive,*negative;
    int start,end;
    start=arr[0];
    end=arr[n-1];
    if(start<0 && end<0)
    {
        negative=(int*)calloc((start*-1),sizeof(int));
        positive=0;
    }
    else if(start<0 && end>0)
    {
        negative=(int*)calloc((start*-1),sizeof(int));
        positive=(int*)calloc(end,sizeof(int));
    }
    else if(start>=0 && end >0)
    {
        negative=0;
        positive=(int*)calloc(end,sizeof(int));  
    }
    int p=0;
    for(i=0;i<n;i++)
    {
        if(i==0)
            p=-1;
        else
            p=i;
        if(arr[i]<0)
            negative[-arr[i]]=p;
        else
            positive[arr[i]]=p;
    }
    for(i=0;i<n;i++)
    {
        int num=m-arr[i];
        if(negative!=0 && num<0 && negative[-num])
        {
            if(negative[-num]==-1)
                j=0;
            else
                j=negative[-num];
            printf("%d %d\n",i,j);
            flag=1;
        }
        else if(positive!=0 && num>=0 && positive[num])
        {
            if(positive[num]==-1)
                j=0;
            else
                j=positive[num];
            printf("%d %d\n",i,j);
            flag=1;
        }
    }
    if(flag==0)
        printf("NO SUCH i j EXISTS\n");
    if(positive) free(positive);
    if(negative) free(negative);
    return 0;
}

Here is my output:

Are you going out of bounds of any of the arrays (dynamically allocated or not)? Are you dereferencing `positive` or `negative` even if they are `NULL`? Have you tried to step through the code line by line in a debugger to see that it behaves like it should? — Some programmer dude, Mar 21 '19 at 07:04
FYI, you don't need `if(positive)` or `if(negative)`. `free()` does that check itself. — Barmar, Mar 21 '19 at 07:05
I did it to be more sure that free(NULL) doesn't cause error — , Mar 21 '19 at 07:06
Also, what happens if `end == 0`? Then your pointers will be uninitialized. — Some programmer dude, Mar 21 '19 at 07:09
Can `end` be `0`? Your `if` and `else if` blocks only handle `end < 0` and `end > 0`, not `end == 0`. — Barmar, Mar 21 '19 at 07:09
Running the code in Valgrind should catch the problem. Unfortunately I don't have Valgrind installed on the system that I'm currently using. — taskinoor, Mar 21 '19 at 07:24

score 8 · Accepted Answer · answered Mar 21 '19 at 07:27

With the input values you mention, you first do :

end=arr[n-1];
positive=(int*)calloc(end,sizeof(int));

Given that n == 3 and arr[n-1] == 3, you allocate an array of 3 ints for positive.

In the very next loop, you then end up doing :

positive[arr[i]]=p;

which tries to overwrite positive[3] (when i == n-1). This is trying to write beyond the bounds of the array (valid indexes range from 0 to 2 only), and undefined behavior ensues, meaning anything at all can happen after that point, including a crash.

Program crashes at times while using free on a pointer which holds conditionally allocated memory

1 Answers1