如何修复C ++中的“堆已损坏”错误？

Question

When I run the program, I get exception "heap has been corrupted" after completion of the function

I have read that this exception may cause if you are using memory that has been freed, or when you are writing to index which is out of array index. But none of the cases applies here. I have read other answers of some problems but it didn't help much.

`char fileNametoExport[26]="d:\\FOlder1\\part1.ipt";
 char WorkingFolderName[260] ="d:\\folder";
 int start = rFind(fileNametoExport, '\\');
 int finish = rFind(fileNametoExport, '.');
 if (start == -1)
 start = 0;
char partname[260];
strcpy(partname,substr(fileNametoExport, start, finish));
::AfxMessageBox((LPCTSTR)partname);
char xtfile[260];
char xmltxtfile[260];
strcpy(xtfile, strcat(WorkingFolderName, partname));
strcat(xtfile, "__Default.x_t");
strcpy(xmltxtfile, WorkingFolderName);
strcat(xmltxtfile,"_XT_SE_INV_Default_SOLID_0_Solid1_xt.xmt_txt");`

function rfind() to find occurence of char in char array-

int rFind(char* s, char c)
    {
    int sz = 0;
    char *tmp = s;
    while (*tmp != '\0')
    {
        sz++;
        tmp++;
    }
    for (int i = sz - 1; i >= 0; i--)
    {
        if (*(s + i) == c)
            return i;
    }
    return -1;
}

function substr() to get substring from position x to y (y exclusive)

char* substr(char* s, const int b, const int f)
{
    char *str = new char[f - b];
    int t = 0;
    for (int i = b; i != f; i++)
    {
        str[t] = s[i];
        t++;
    }
    str[t] = '\0';
    return str;
}

PS- While giving input I ensure that fileNametoExport always contains '.' and '\\'.

Answer 1

1. Your program do not check lengths of input strings. You can receive a string longer than your buffer and program will fail.
2. If your program get fileNametoExport = "d:\\\\somefolder\\\\somefilewithoutdot" , finish will be -1 and program fail at strcpy(partname,substr(fileNametoExport, start, finish)); .

3. Program writes after buffer in char* substr(char* s, const int b, const int f) at line

    str[t] = '\\0'; 

   because t at this point equal fb , size of str buffer.

Function _ASSERTE( _CrtCheckMemory( ) ); from <crtdbg.h> very useful when searching for bugs like this. Put it around suspicious code and it fails after your bug. It works only in debug.