在C程序中使用Free时出现奇怪的行为

Question

I have some program which decompress some string which is already mentioned here: How to decompres array of char in c . After I finished it I have problem with function free (without it, it works ok). There is some strange behaviour and the last assert fails because of : Aborted; core dumped; Aborted; core dumped;

when I debug this program I found that problem is in this cycle:

    for (j = 0; j < max - 1; j++) {
        vysledek[index] = src[i - pom];
        printf("cccc%d\n%s\n", j,vysledek);

        printf("xxx%c", src[i - pom]);
        index++;
    }

it prints:

...
xxx#cccc19
HHeeeeeellllllllooooooooooooooo#####################�
xxx#cccc20
HHeeeeeellllllllooooooooooooooo######################
xxx#cccc21
HHeeeeeellllllllooooooooooooooo#######################
xxx#cccc22
HHeeeeeellllllllooooooooooooooo########################
xxx#cccc23
HHeeeeeellllllllooooooooooooooo#########################Hello______________________________world!
xxx#cccc24
HHeeeeeellllllllooooooooooooooo##########################ello______________________________world!
...

can someone explain me this ? How can Hello world from second assert discover in third one ?

whole program is here:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
#include <assert.h>

char * decompress(const char * src) {

    int max = 0;
    int pom = 1;
    int maxSize = 0;
    int index = 0;
    int isNumber = 0;

    int i;
    for (i = 0; src[i] != 0; i++) {
        max = 0;
        isNumber = 0;
        while (isdigit(src[i])) {
            int digit = (src[i] - '0');
            max = max * 10 + digit;
            i++;
            isNumber = 1;
        }
        if (max == 0 && !isNumber) {
            max = 1;
        }

        maxSize = maxSize + max;
    }

    char *vysledek = (char*) malloc((maxSize) * sizeof (int));

    for (i = 0; src[i] != 0; i++) {
        max = 0;
        pom = 0;
        isNumber = 0;
        while (isdigit(src[i])) {
            int digit = (src[i] - '0');
            max = max * 10 + digit;
            i++;
            pom++;
            isNumber = 1;
        }

        if (!isNumber) {
            vysledek[index] = src[i];
            //printf("%c", src[i]);
            index++;
        } else {
            i--;
            int j;

            if (max < 1) {
                index--;
            }


            for (j = 0; j < max - 1; j++) {
                vysledek[index] = src[i - pom];
                //printf("cccc%d\n%s\n", j,vysledek);

                //printf("xxx%c", src[i - pom]);
                index++;
            }
        }
        //printf("\n%d\n", index);

    }

    return vysledek;
}

int main(int argc, char * argv []) {

    char * res;

    assert(!strcmp(
            (res = decompress("Hello world!")),
            "Hello world!"));
    //free(res);

    assert(!strcmp(
            (res = decompress("Hello_30world!")),
            "Hello______________________________world!"));
    //free(res);

    assert(!strcmp(
            (res = decompress("H2e6l8o15 35w5o6r-2d0!!")),
            "HHeeeeeellllllllooooooooooooooo                                   wwwwwoooooor--!!"));

    //free(res);
    return 0;
}

Answer 1

The problem is, that you compare a null-terminated string with a not-null-terminated string. In your function decompress() you need to reserve one more int and add the missing \\0 to the copied buffer.

char *vysledek = (char*) malloc((maxSize) * sizeof (int) + sizeof(int));
[...]
vysledek[index] = '\0';