尝试释放时程序崩溃（）

Question

Trying to create a program that loops connecting two strings together printing out the alphabet. When i gets to equal 11, I get an error when trying to free(new).

#include <stdbool.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>


int main(void)
{
    char* word = NULL;


    for(int i = 0; i < 25; i++)
    {       
        int buff = 'a' + i;

        // creates first string
        if (i == 0)
        {
            char* new = malloc(sizeof(char) + 1);
            if (new == NULL)
            {
                printf("malloc failed");
                return 1;
            }
            sprintf(new, "%c", buff);
            word = (char *) malloc(sizeof(new));
            if (word == NULL)
            {
                printf("malloc failed");
                return 1;
            }
            *word = *new;
            free(new);
        }
        // adds string word to string new
        else
        {
            char* new = malloc(sizeof(char) + 1);
            if (new == NULL)
            {
                printf("malloc failed");
                return 1;
            }
            sprintf(new, "%c", buff);
            char* new_word = malloc(strlen(word) + strlen(new) + 1);
            if (new_word == NULL)
            {
                printf("malloc failed");
                return 1;
            }
            // Copies combines word and new into new_word
            strcpy(new_word, word);
            strcat(new_word, new);

            // Resizes memory for word and prints new_word into word
            word = (char *) realloc(word, strlen(new_word));
            sprintf(word, "%s", new_word);
            // Frees looped vars
            free(new);
            free(new_word);
        }

        printf("%s\n", word);
    }
}

This is the results I get:

a
ab
abc
abcd
abcde
abcdef
abcdefg
abcdefgh
abcdefghi
abcdefghij
abcdefghijk
*** Error in `./test': free(): invalid pointer: 0x08cac028 ***

this is what I get from GDB when trying to debug:

(gdb) 
56              free(new);
(gdb) info locals
new = 0x804b008 "l"
new_word = 0x804b038 "abcdefghijkl"
buff = 108
i = 11
word = 0x804b018 "abcdefghijkl"
(gdb) n
*** Error in `/home/jharvard/Dropbox/pset6/test': invalid fastbin entry (free): 0x0804b008 ***

Program received signal SIGSEGV, Segmentation fault.
0x4408e098 in malloc_consolidate (av=av@entry=0x441d4420 <main_arena>)
    at malloc.c:4093
4093              unlink(av, nextchunk, bck, fwd);

Answer 1

char* new = malloc(sizeof(char)) allocates a buffer of length 1. Then you sprintf a char (%c) to that buffer and that takes 2 bytes (the char and the terminating zero) hence a buffer overflow and memory corruption.

BTW allocating very small buffers if totally inefficient and basically useless. You should probably rethink your program from the ground up.

Answer 2

Strings in C must always have a null terminator (aka '\\0') at the end. The null terminator marks the end of the string. Without the null terminator, many of the C string library functions will run past the end of the string, causing a crash if you're lucky. If you're unlucky, running past the end of a string will corrupt data unrelated to the string, causing bugs that are excruciatingly difficult to find. The strlen function counts the number of characters in a string, but that count does not include the null terminator.

char *new = malloc(sizeof(char));                      // returns a pointer to 1 byte of memory.
sprintf(new, "%c", buff);                              // writes two characters into that memory, whatever buff is, and a null terminator '\0'
*word = *new;                                          // copies the first character of 'new' into 'word', but doesn't null terminate 'word'
word = (char *) malloc(sizeof(new));                   // since new is a pointer, sizeof(new) is the size of a pointer, 4 bytes on 32-bit systems, 8 bytes on 64-bit systems
char* new_word = malloc(strlen(word) + strlen(new));   // allocates enough space for the two string but doesn't include space for the null terminator
word = (char *) realloc(word, strlen(new_word));       // again no space for the null terminator

There might be more, but you get the idea.