malloc Incorrect checksum error when trying to parse input as tokens

Question

I'm trying to create a shell but I keep encountering the error,

malloc: Incorrect checksum for freed object

in my code and also segmentation faults when testing, is there a possible fix for this? I tried debugging but I can't find anything abnormal in the code, can someone please point me in the right direction?

char **getArguments(char line[])
{
    /* Pointer to char pointer for storing arguments, initial size is 1 */
    char **args = malloc(sizeof(char *));
    /* Error handling */
    if (args == NULL)
    {
        fprintf(stderr, "Error: cannot split line.");
        exit(EXIT_FAILURE);
    }
    int count = 0;
    /* Try to parse first argument */
    char *temp = strtok(line, " \t\n\r\a");
    while (temp != NULL)
    {
        args[count] = temp;
        /* Reallocate more space for next argument */
        count++;
        char **reallocated = realloc(args, count * sizeof(char *));
        /* Error handling */
        if (reallocated == NULL)
        {
            fprintf(stderr, "Error: cannot split line.");
            exit(EXIT_FAILURE);
        }
        else
        {
            args = reallocated;
        }
        /* Move to next token */
        temp = strtok(NULL, " \t\n\r\a");
    }
    /* NULL terminate the array so that we know where's the end */
    args[count] = NULL;
    return args;
}

Answer 1

The initialisation of count to 0, and then assignments using args[count] seems to be the issue.

The getArguments() function initially creates a single-item array for arguments, but then assigns count = 0 - this should be 1 as there exists that first element.

Next the code makes assignments with the full-length of count . Obviously in C, arrays are indexed 0 to length-1 , so my_array[ length ] is never correct.

Simply initialising count to 1 and fixing the array-indexes to be 0-offset corrects the problem.

/* Splits the command into arguments */
char **getArguments(char line[])
{
    /* Pointer to char pointer for storing arguments, initial size is 1 */
    char **args = malloc(sizeof(char *));
    /* Error handling */
    if (args == NULL)
    {
        fprintf(stderr, "Error: cannot split line.");
        exit(EXIT_FAILURE);
    }
    int count = 1;                                                       // <-- HERE
    /* Try to parse first argument */
    char *temp = strtok(line, " \t\n\r\a");
    while (temp != NULL)
    {
        args[count-1] = temp;                                            // <-- HERE
        /* Reallocate more space for next argument */
        count++;
        char **reallocated = realloc(args, count * sizeof(char *));
        /* Error handling */
        if (reallocated == NULL)
        {
            fprintf(stderr, "Error: cannot split line.");
            exit(EXIT_FAILURE);
        }
        else
        {
            args = reallocated;
        }
        /* Move to next token */
        temp = strtok(NULL, " \t\n\r\a");
    }
    /* NULL terminate the array so that we know where's the end */
    args[count-1] = NULL;                                           // <-- HERE
    return args;
}

Example Output (through Valgrind)

[user@machine]> valgrind ./run_cmds 
==8173== Memcheck, a memory error detector
==8173== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==8173== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==8173== Command: ./run_cmds
==8173== 
# /bin/echo foo
foo
# /bin/echo 1 2 3 4 5 6 7 8 9 10 11 12 13 14
1 2 3 4 5 6 7 8 9 10 11 12 13 14
# ==8173== 
==8173== HEAP SUMMARY:
==8173==     in use at exit: 120 bytes in 1 blocks
==8173==   total heap usage: 24 allocs, 23 frees, 3,544 bytes allocated
==8173== 
==8173== LEAK SUMMARY:
==8173==    definitely lost: 0 bytes in 0 blocks
==8173==    indirectly lost: 0 bytes in 0 blocks
==8173==      possibly lost: 0 bytes in 0 blocks
==8173==    still reachable: 120 bytes in 1 blocks
==8173==         suppressed: 0 bytes in 0 blocks
==8173== Rerun with --leak-check=full to see details of leaked memory
==8173== 
==8173== For lists of detected and suppressed errors, rerun with: -s
==8173== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Maybe your code was directed to use realloc() as an assignment or suchlike, but a simpler way would be to simply count the number of arguments, allocate args to the correct size (done once), and thus not loop-parse reallocating.