Problem with free

pgpython · 06-02-2009, 11:46 AM

I am trying to learn c at the moment and I am having a problem freeing a block after I have allocated and used it. I have checked the block is valid using gdb before it hits the crash with segv using gdb and it looks to be intact so I can't understand why I can't free the block.

The code which is causing me trouble is

Code:

char **rules = splitString(&rule_size,  rule_string, ",");
if (!rules){ return NULL; }
for (forloop=0; forloop < rule_size; forloop++){
             rule = strip(rules[forloop]);
            //Do some rule checking.
             free(rule);        
         }  
 free(rules);

Can anyone tell me what is going wrong?

Hko · 06-02-2009, 12:38 PM

Looks OK to me.

What is the problem actually? Does it give you an error?

Or is it that you don't see memroy usage dropping in tools like 'top'? In the latter case there probably isn't any problem. The kernel will have registered that you free'd the block of memory, and may decide to keep the memory block as a part of your process to re-use it later when your program asks for another block.

noctilucent · 06-02-2009, 12:49 PM

Hello.

Perhaps providing the definitions of functions such as splitString and strip might help elucidate things.

pgpython · 06-03-2009, 05:29 AM

The string functions I am using are as follows:

Code:

//Strip all leading and trailing whitespace from a string.

char* strip(char string[]){
      int start = 0;
      int charsize = strlen(string);
      int loop;
      int stop = charsize;
      
      for (loop = 0; loop < charsize; loop++){
          if (string[loop] != ' ' && string[loop] != '\t'){
              break;
              }
           start++;
      }
      for (loop = charsize-1; loop > 0; loop--){
          if (string[loop] != ' ' && string[loop] != '\t'){
             break;
           }
           stop--;
      }
      
      string = slice(string, start, stop, 1);
      return string;
}
       
//Get a slice of a string 

char* slice(char string[], int start, int stop, int step){
    
      //Initalise the basic paramaters.
      
       int size = strlen(string); 
       int chptr = 0;
       int loop, charsize;
       char *rtn = NULL;
              
       //normalise the paramaters.
       
       if ( start < 0 ){ start = (size + 1) + start; }
       if ( stop < 0 ) { stop = (size + 1) + stop; }
       if ( start > stop){
          int temp = start;
          start = stop;
          stop = temp;
       }
       step = abs(step);
       
       //Prepare the copy.
       
       charsize = (stop - start)/ step;
       
       rtn = (char *)malloc(charsize+2 * sizeof(char));
       if (rtn == NULL){
           return NULL;
       }    
       
       //copy each required character.
       
       for (loop = start;loop < stop; loop = loop + step){
          rtn[chptr] = string[loop];
          chptr++;
          }
      rtn[charsize] =  '\0';    
      return rtn;
}

// return an array of string split by the given delimiter

char** splitString(int *size, char data[], char delimiter[]){
       mlog("INFO", "splitString called.");
       char **results;
       char *token = NULL;
       
       *size = 0;
       results = (char **) malloc(sizeof(data) + 3);
       if (results == NULL){
           mlog("FATAL", "malloc failed in splitString.");
           return NULL;
       }
       
       token = strtok(data, delimiter);
       while (token != NULL){
             mlog("INFO", "Got a token in splitString.");
             results[(int) *size] = token;
             *size =  *size + 1;
             token = strtok(NULL, delimiter);
             }  
       return results;
}

The program crashes with free(): invalid next size (fast)

johnsfine · 06-03-2009, 06:09 AM

There is an obvious error that fits the symptoms. But I didn't check carefully enough to see if it is the only such error nor even if it is the error that would cause the symptoms first.

Quote:

Originally Posted by pgpython

results = (char **) malloc(sizeof(data) + 3);

sizeof(data) does not do what you expect. Passing char data[] does not pass the size of the array, just its address.
Even if you had the size of the char array, I don't think the allocation would be correct. You would then be depending on the average split length being greater than the number of bytes in a pointer.

The actual error generally means you used more of a memory allocation than you allocated, overwriting the information right after that allocation. Clearly you do so with this results allocation. I don't know if you also do so with other allocations.