Memory leak in C, most likely due to realloc - c

Question

I have a program that is supposed to receive input, remember the longest string and print it out at EOF. My code works, but when run through a debugger there is a memory leak detected. I am compiling in Windows and do not have a proper debugger like Valgrind so I do not get much information about the error. The only thing I can imagine can cause this leak is the realloc() or free() function. However, I am not skilled enough in C to understand what the problem is.
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <string.h>
int main(void)
{
char *p;
char *line;
int sc;
p = (char*) malloc ( sizeof(char) );
line = (char*) malloc ( sizeof(char) );
int count = 0;
int max = 0;
p[count] = 0;
while ( ( sc = getchar()) != EOF ) {
if ( p == NULL ) {
p = (char*) realloc ( p, sizeof(char) );
}
if ( isalpha(sc) ) {
p[count] = sc;
count++;
p = (char*) realloc( p, (count+1)*sizeof(char) );
p[count] = 0;
} else if ( sc == '\n' || sc == ' ' ) {
if ( count > max ) {
line = (char*) realloc( line, (count+1)*sizeof(char) );
strcpy( line, p );
max = count;
} else if ( count == 0) {
printf("%d characters in longest word: %s\n", max, line);
free(line);
free(p);
break;
}
count = 0;
}
}
return 0;
}

Answer 1

You state in the comments that you "have tried moving both free() to the end of the program", but I don't believe you. The problem appears to be that this is a badly designed program which does not always reach the free() statements because when sc is a space or newline, count is unlikely to be 0, and after count is reset to 0, the next character is read into sc (unlikely to be a space or newline).
Simply moving the calls to free() to the end of the program fixes the memory leak, which was reported by Valgrind:
λ> valgrind --tool=memcheck ./a.out
==2967== Memcheck, a memory error detector
==2967== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==2967== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==2967== Command: ./a.out
==2967==
this is a test
==2967==
==2967== HEAP SUMMARY:
==2967== in use at exit: 10 bytes in 2 blocks
==2967== total heap usage: 14 allocs, 12 frees, 42 bytes allocated
==2967==
==2967== LEAK SUMMARY:
==2967== definitely lost: 10 bytes in 2 blocks
==2967== indirectly lost: 0 bytes in 0 blocks
==2967== possibly lost: 0 bytes in 0 blocks
==2967== still reachable: 0 bytes in 0 blocks
==2967== suppressed: 0 bytes in 0 blocks
==2967== Rerun with --leak-check=full to see details of leaked memory
==2967==
==2967== For counts of detected and suppressed errors, rerun with: -v
==2967== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
But there are many other issues with the code. First, never store the result of a call to realloc() in the only copy of a pointer you have to the memory being reallocated; a null pointer may be returned, and if so you then have a memory leak and lost data. Instead, use a temporary variable to hold the result, and assign this value to the original pointer only after checking for a null pointer. If a null pointer has been returned, the simplest solution is probably to terminate the program with an error message, as is done below; the error could be handled in other ways, so long as it is handled.
The posted code is more complex than it needs to be, with multiple calls to malloc() and realloc(). Instead, initialize p and line to NULL, and reallocate only as needed. There is no need to begin by allocating space for 1 char; this can be done when the first character needs to be stored. Also, there is no need to cast the result of malloc() in C (a different story in C++); and, sizeof char is always 1, so this is redundant and only clutters the code.
The fundamental problem in the posted code seems to be that when a character is read, count is incremented. Then if this character is a space or a newline, count may not be 0, so the exit with deallocation condition may not be met. Instead of complicated conditions, rethink the flow of the program.
After reading a character (unless EOF is encountered), if that character is alphabetic, count should be incremented, and p should be reallocated. If this step is successful, the character should be stored in p[], which should then be null-terminated.
Otherwise, if the character is a \n or a space, max should be compared with count. If count is larger, then line should be reallocated. If this step is successful, the string pointed to by p should be copied to line[]. Then max is given the value of count, and count is reset to 0.
After the loop has terminated, the results are printed only if there were words in the input. Then deallocation can occur before the program terminates.
The isalpha() function and similar functions from ctype.h expect an int value in the range of an unsigned char (or EOF). Often you need to cast the value of arguments to these functions to unsigned char to avoid undefined behavior. But, in this case the cast is unnecessary since getchar() returns an int value in the range of an unsigned char (or EOF).
You might also consider using the isspace() function instead of sc == '\n' || sc == ' '. This would allow other whitespace characters, such as '\t', to separate words in the input. As written in the OP, an input of "one\tword" (where '\t' is a tab character) would result in an output of:
7 characters in longest word: oneword
Here is a modified version of the posted code:
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <string.h>
int main(void)
{
char *p = NULL;
char *line = NULL;
int sc;
int count = 0;
int max = 0;
while ((sc = getchar()) != EOF) {
if (isalpha(sc)) {
++count; // read a letter
char *temp = realloc(p, count + 1); // +1 for '\0'
if (temp == NULL) { // check allocation
perror("Failure to reallocate p");
exit(EXIT_FAILURE);
}
p = temp; // OK to reassign p
p[count-1] = sc; // store character
p[count] = 0; // add null-terminator
} else if (isspace(sc)) {
if (count > max) {
char *temp = realloc(line, count + 1); // +1 for '\0'
if (temp == NULL) { // check allocation
perror("Failure to reallocate line");
exit(EXIT_FAILURE);
}
line = temp; // OK to reassign line
strcpy(line, p);
max = count;
}
count = 0;
}
}
if (max > 0) {
printf("%d characters in longest word: %s\n", max, line);
} else {
puts("No words in input");
}
free(line);
free(p);
return 0;
}
And here is a clean bill of health from Valgrind:
λ> valgrind --tool=memcheck ./a.out
==4753== Memcheck, a memory error detector
==4753== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==4753== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==4753== Command: ./a.out
==4753==
this is a testrun
7 characters in longest word: testrun
==4753==
==4753== HEAP SUMMARY:
==4753== in use at exit: 0 bytes in 0 blocks
==4753== total heap usage: 16 allocs, 16 frees, 69 bytes allocated
==4753==
==4753== All heap blocks were freed -- no leaks are possible
==4753==
==4753== For counts of detected and suppressed errors, rerun with: -v
==4753== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Answer 2

I think during debugging after the free() function call; you checked the value of the pointer p and line, and you still see the value(string) it is pointing to. If so that is not memory leak because free() does not change the value of pointer or assign 0 or '\0' character in it. free() just free the block of memory so that next time when you call any memory allocation function it will get that memory as available memory, and allocate it. Therefore after calling free(), we always assign NULL to the pointer like p = NULL;.
Correct the code as below and try:-
free(line);
free(p);
line = NULL;
p = NULL;
break;

Answer 3

Based on your coding approach I'll use calloc (you need) instead of malloc to get rid of that:
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <string.h>
int main(void)
{
char *p = NULL;
char *line = NULL;
int sc;
p = calloc ( sizeof(char), 1);
line = calloc ( sizeof(char),1 );
size_t count = 0;
size_t max = 0;
p[count] = 0;
while ( ( sc = getchar()) != EOF ) {
if ( p == NULL ) {
p = realloc ( p, sizeof(char) );
}
if ( isalpha(sc) ) {
p[count] = (char)sc;
count++;
p = realloc( p, (count+1) * sizeof(char) );
p[count] = 0;
} else if ( sc == '\n' || sc == ' ' ) {
if ( count > max ) {
line = realloc( line, (count+1)*sizeof(char) );
strcpy( line, p );
max = count;
} else if ( count == 0) {
printf("%zu characters in longest word: %s\n", max, line);
free(line);
free(p);
break;
}
count = 0;
}
}
return 0;
}
Output with Valgrind:
==4362== Memcheck, a memory error detector
==4362== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==4362== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==4362== Command: ./program
==4362==
Hello World
5 characters in longest word: Hello
==4362==
==4362== HEAP SUMMARY:
==4362== in use at exit: 0 bytes in 0 blocks
==4362== total heap usage: 15 allocs, 15 frees, 2,096 bytes allocated
==4362==
==4362== All heap blocks were freed -- no leaks are possible
==4362==
==4362== For counts of detected and suppressed errors, rerun with: -v
==4362== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Now try to understand, why is not working with malloc and why is working with calloc.
EDIT
Are you sure that is all about a leak? and is not about an uninitialised value?
I'm saying because if you type a letter works fine, the problem comes with Numbers, hence the calloc sugestion.
This is the Output of Valgrind using your code with no modification:
==5042== Memcheck, a memory error detector
==5042== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==5042== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==5042== Command: ./program
==5042==
1
==5042== Conditional jump or move depends on uninitialised value(s)
==5042== at 0x4E88CC0: vfprintf (vfprintf.c:1632)
==5042== by 0x4E8F898: printf (printf.c:33)
==5042== by 0x40082B: main (in /home/michael/program)
==5042== Uninitialised value was created by a heap allocation
==5042== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==5042== by 0x400715: main (in /home/michael/program)
==5042==
0 characters in longest word:
==5042==
==5042== HEAP SUMMARY:
==5042== in use at exit: 0 bytes in 0 blocks
==5042== total heap usage: 4 allocs, 4 frees, 2,050 bytes allocated
==5042==
==5042== All heap blocks were freed -- no leaks are possible
==5042==
==5042== For counts of detected and suppressed errors, rerun with: -v
==5042== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)