为什么这个程序在释放时会崩溃？

Question

I'm trying to understand why does this program crash, when I use this line and trying to free the pointer:

 t_mat *C=malloc(sizeof(t_mat));

But works well with the following line (no memory leaks, no crashing, the value 53 is the minimum I found by trial and error):

 t_mat *C=malloc(sizeof(t_mat)+53);

Program: (the while(1) loop is for memory leak testing, doesn't affect the crashing)

#include <stdio.h>
#include <stdlib.h> 
typedef int t_mat[3][3];
t_mat* matice(t_mat A, t_mat B, char op)
{
    t_mat *C=malloc(sizeof(t_mat)+53);
    switch(op)
    {
    case '+':
        for(int i=0; i<3; i++)
            for(int j=0; j<3; j++)
                *C[i][j]=A[i][j]+B[i][j];
        return *C;
        break;
    case '-':
        for(int i=0; i<3; i++)
            for(int j=0; j<3; j++)
                *C[i][j]=A[i][j]-B[i][j];
        return *C;
        break;
    default:
        free(C);
        printf("Chyba\n");
        return NULL;
        break;
    }
}
int main()
{
    char op;
    scanf("%c",&op);
    getchar();
    t_mat A = {0,1,2,3,4,5,6,7,8},B= {0,1,2,3,4,5,6,7,8},*C;
    while(1)
    {
        C=matice(A, B, op);
        for(int i=0; i<3; i++)
            for(int j=0; j<3; j++)
                printf("%d\n",*C[i][j]);
        free(C);
        C=NULL;
    }
    return 0;
}

Am I missing something here?

Answer 1

Unary * has lower precedence than [] . You need to write (*C)[i][j] .

Answer 2

Statements like these

*C[i][j]=A[i][j]+B[i][j];

and

printf("%d\n",*C[i][j]);

invoke undefined behavior. The type of the variable C is int ( * )[3][3] due to this declaration

t_mat *C=malloc(sizeof(t_mat)+53);

So at first you shall to apply the dereferencing operator and only after that the subscript operator

( *C )[i][j]=A[i][j]+B[i][j];

or

printf("%d\n", ( *C )[i][j]);

Otherwise the program has undefined behavior.

So there is no any sense to use the magic number 53 in the memory allocation. Just write

t_mat *C=malloc(sizeof(t_mat));

Here is a demonstrative program.

#include <stdio.h>
#include <stdlib.h>

#define N   3
typedef int t_mat[N][N];

int main(void) 
{
    t_mat A = 
    { 
        { 0, 1, 2 }, 
        { 3, 4, 5 },
        { 6, 7, 8 }
    };
    
    t_mat B = 
    { 
        { 0, 1, 2 }, 
        { 3, 4, 5 },
        { 6, 7, 8 }
    };
    
    t_mat *C = malloc( sizeof( t_mat ) );
    
    for ( size_t i = 0; i < N; i++ )
    {
        for ( size_t j = 0; j < N; j++ )
        {
            ( *C )[i][j] = A[i][j] + B[i][j];
        }
    }
    
    for ( size_t i = 0; i < N; i++ )
    {
        for ( size_t j = 0; j < N; j++ )
        {
            printf( "%2d ", ( *C )[i][j] );
        }
        
        putchar( '\n' );
    }
    
    putchar( '\n' );
    
    free( C );
    
    return 0;
}

The program output is

 0  2  4 
 6  8 10 
12 14 16