使用malloc（）和free（）函数时出错

Question

i want to create my own strcpy() function without include <string.h> .i have read that whenever we call malloc() function to allocate memory,we must freeing the memory that we have allocate using free() function,but why this program give me a strange error,i never seen this type of error before and why this program doesn't give me the exact destination string.

this is the program:

#include <stdio.h>
#include <stdlib.h>

char *my_gets(char *string);
char *coppy(char *dest,char*src);
int len(char *string);

int main (void){
    char *src,*dest;

    src=(char *)malloc(len(src)+1);
    printf("enter string source:");my_gets(src);

    printf("length source=%d\n",len(src));

    dest=(char *)malloc(len(src)+1);
    coppy(dest,src);
    printf("destination string:%s\n",dest);

    free(src);
    free(dest);
    return 0;
}

char *my_gets(char *string){
   char ch;

   while((*string=getchar()) !='\n'){
        string++;
   }
   if(string[len(string)-1]=='\n'){
    string[len(string)-1]='\0';
    }
    return string;
 }

char *coppy(char *dest,char *src){
   while(*src!='\0'){
    *dest++=*src++;
   }
   *dest='\0';
   return dest;
 }

int len(char *string){
   int i=0;

   while(*string!='\0'){
    string++;
    i++;
   }
   return i;
 }

this the error :

enter string source:i want to create my own strcpy function but i got an a strange error
length source=67
destination string:i want to crI
*** Error in `./program': free(): invalid next size (normal): 0x086b4018 ***
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(+0x767e2)[0xb76457e2]
/lib/i386-linux-gnu/libc.so.6(+0x77530)[0xb7646530]
./program[0x804855f]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0xb75e8935]

./program[0x80483d1] ======= Memory map: ======== 08048000-08049000 r-xp 00000000 08:01 4330274 /home/harianja/LUNDU/Lundu/coding/Cprogram/program 08049000-0804a000 r--p 00000000 08:01 4330274 /home/harianja/LUNDU/Lundu/coding/Cprogram/program
0804a000-0804b000 rw-p 00001000 08:01 4330274 /home/harianja/LUNDU/Lundu/coding/Cprogram/program
086b4000-086d5000 rw-p 00000000 00:00 0 [heap]
b7593000-b75ae000 r-xp 00000000 08:01 4195166 /lib/i386-linux-gnu/libgcc_s.so.1
b75ae000-b75af000 r--p 0001a000 08:01 4195166 /lib/i386-linux-gnu/libgcc_s.so.1
b75af000-b75b0000 rw-p 0001b000 08:01 4195166 /lib/i386-linux-gnu/libgcc_s.so.1
b75ce000-b75cf000 rw-p 00000000 00:00 0
b75cf000-b777d000 r-xp 00000000 08:01 4208177 /lib/i386-linux-gnu/libc-2.17.so
b777d000-b777f000 r--p 001ae000 08:01 4208177 /lib/i386-linux-gnu/libc-2.17.so
b777f000-b7780000 rw-p 001b0000 08:01 4208177 /lib/i386-linux-gnu/libc-2.17.so
b7780000-b7783000 rw-p 00000000 00:00 0
b779e000-b77a3000 rw-p 00000000 00:00 0
b77a3000-b77a4000 r-xp 00000000 00:00 0 [vdso]
b77a4000-b77c4000 r-xp 00000000 08:01 4208178 /lib/i386-linux-gnu/ld-2.17.so
b77c4000-b77c5000 r--p 0001f000 08:01 4208178 /lib/i386-linux-gnu/ld-2.17.so b77c5000-b77c6000 rw-p 00020000 08:01 4208178 /lib/i386-linux-gnu/ld-2.17.so bf863000-bf884000 rw-p 00000000 00:00 0 [stack] Aborted

Answer 1

This:

char *src,*dest;

src=(char *)malloc(len(src)+1);

is undefined behavior, src is an uninitialized pointer which you can't pass to len() since it will read from it.

Also, len() is a re-implementation of strlen() but perhaps you knew that.

Answer 2

This line:

src=(char *)malloc(len(src)+1); 

Will error, as src has not been initialized yet. Initialize it to some other value relevant to what it needs to be used for.

src=malloc(100); //for lack of any better value, used 100  

Your function len() will error out if you pass it an uninitialized pointer .
And do not cast the return of malloc()

Answer 3

When you malloc in your first line, you find the src size with len() but src is not initialized. So you malloc trash.

Answer 4

char *src,*dest;
src=(char *)malloc(len(src)+1);

You forgot to add -fclairvoyance compiler option. Notice that clairvoyance is still in beta and is not guaranteed to produce correct results. To work around this limitation, try to estimate max string length up front:

src=malloc(100);

Note you should not cast the result of malloc .