在分配的内存中使用qsort后，为什么自由功能会崩溃？

Question

我使用malloc为字符串分配内存，然后在该内存上执行qsort ，对字符串的字符进行排序。

我执行qsort几次，每次都将新值复制到分配的内存中。

之后，我尝试free内存，但是它崩溃了

如果我评论qsort行，它不会崩溃

/**
 * Iterates over b finding permutations of s
 *
 * @param s smaller string
 * @param b bigger string
 * @param locations array for the result
 * @return number of locations
 */
int substring_permutations(const char *s, const char *b, int *locations) {
    int s_len = (int) strlen(s);

    char *sorted_sub_b = malloc((s_len + 1) * sizeof(char));
    sorted_sub_b[s_len] = '\0';

    char *sorted_s = malloc((s_len + 1) * sizeof(char));
    sorted_s[s_len] = '\0';
    sort_string(s, s_len, sorted_s);

    int l = 0;
    for (int i = 0; i < strlen(b) - s_len + 1; i++) {
        sort_string(b + i, s_len, sorted_sub_b);

        if (strcmp(sorted_s, sorted_sub_b) == 0) {
            locations[l++] = i;
        }
    }

    free(sorted_s);

    free(sorted_sub_b); // Why does this crash?

    return l;
}

void sort_string(const char *s, int s_len, char *sorted_s) {
    memcpy(sorted_s, s, s_len * sizeof(char));
    qsort(sorted_s, s_len * sizeof(char), sizeof(char), chrcmp);
}

int chrcmp(const void *a, const void *b) {
    return *(char *) a - *(char *) b;
}

执行第二个free时崩溃

Process finished with exit code 139 (interrupted by signal 11: SIGSEGV)

编辑 ：添加调用代码

int main() {
    const char *s = "abbc";
    const char *b = "cbabadcbbabbcbabaabccbabc";

    printf("%s\n", s);
    printf("%s\n", b);

    size_t s_len = strlen(s);
    size_t b_len = strlen(b);
    int *locations = malloc((b_len + 1 - s_len) * sizeof(char));

    int permutations = substring_permutations(s, b, locations);

    for (int i = 0; i < permutations; i++) {
        int location = locations[i];
        printf("%d ", location);
        print_chars(b + location, s_len);
        printf("\n");
    }

    free(locations);

    return 0;
}

void print_chars(const char *c, size_t size) {
    for (int i = 0; i < size; i++) {
        printf("%c", c[i]);
    }
}

编辑2 ：我现在看到了问题，它在调用代码中：

我有

    int *locations = malloc((b_len + 1 - s_len) * sizeof(char));

代替

    int *locations = malloc((b_len + 1 - s_len) * sizeof(int));

谢谢@ user5329483