为什么Valgrind在realloc（）之后报告无效的free（）？

Question

When I run valgrind on the following (example) code it reports an "Invalid free() / delete / delete[]" and Invalids reads. I really can't understand why. Can somebody please explain ?

Edit : Thanks for your replies, it's so obvious now.

#include <stdio.h>
#include <stdlib.h>
#include <string.h

void vl_dec(char* a) {
  char* str = a;
  while (*(str+1) != '\0') str++;
  while(*str == '0') {
    *str = '9';
    str--;
  }
  (*str)--;

  if (*a == '0') {
    memmove(a, a+1, strlen(a));
    a = (char*)realloc(a, (strlen(a)+1)*sizeof(char));
    if (a == NULL) {
      fprintf(stderr, "Cannot allocate memory\n");
      exit(1);
    }
  }
}

int main(int argc, char* argv[]) {
  char* a = (char*)malloc(6*sizeof(char));
  if (a == NULL) {
    fprintf(stderr, "Cannot allocate memory\n");
    exit(1);
  }
  strcpy(a, "10000");
  vl_dec(a);
  printf("%s\n", a);
  free(a);
  return 0;
}

Answer 1

In your function main , you are passing a to vl_dec by value, so it never gets updated - the result of realloc is only stored in a local variable that's lost when vl_dec returns. Instead, pass its address:

void vl_dec(char ** a) { *a = realloc(...); }

int main()
{
    char * a = malloc(...);
    vl_dec(&a);
    free(a);
}

Answer 2

You can't just assume that the new value of a that realloc returns is the same as the old value. You actually have to update the pointer every where it's used. I suspect you know that, because you correctly saved the return value of realloc inside of vl_dec , however you forgot that you need to return the new value of a from vl_dec (or update it by using a char** as the paramter to vl_dec .)

Answer 3

because you pass the pointer to vl_dec by value, not by reference.

If you realloc the pointer within vl_dec your main function will still see the original pointer declared in main. After realloc that pointer is invalid, so valgrind complains.

A easy way to fix this is to rewrite vl_dec and let it return the pointer. That way you can call:

   a = vl_dec(a);

In main and the problem is solved.