Tricky Heap corruption Bug? - c

Question

EDIT: What I thought was a bug-correction was nothing but a random fix. I was forgetting to free up heap memory correctly. See the actual code and explanation at the bottom (I'm not sure if I should have edited the whole question).
I haved fixed a bug, but do not understand what it's causing it.
If I use a helper pointer to access the element of a list in the heap, and modify its contents, everything's fine. However, if I directly modify the contents of the element using a function that returns that pointer, then this data gets corrupted at a later stage when allocating more memory.
The error only appears when the code is run in a loop, on the 6th cycle.
Code does not work
// numEvents gets corrupted after some cycles
lstEvent_NewList(&lstEvent, 1, &err); // creates a list of typeEvent in heap
//...
lstEvent_FirstNode(&lstEvent)->numEvents = events; // access first element of list directly
//...
typeCommand * p = 0;
p = (typeCommand *) malloc(sizeof(typeCommand)); // do some more allocations
lstField_NewList(&p->lstFields, 5, &err); // THIS LINE CAUSES CORRUPTION IN numEvents
Code does work
typeEvent * pEvent; // use an auxiliar to iterate through the list
lstEvent_NewList(&lstEvent, 1, &err);
//...
pEvent = lstEvent_FirstNode(&lstEvent);
pEvent->numEvents = events;
//...
typeCommand * p = 0;
p = (typeCommand *) malloc(sizeof(typeCommand)); // do some more allocations
lstField_NewList(&p->lstFields, 5, &err); // all is good
So, basically if I use an auxiliar to get the first element of the list nothing happens. However, if I use the function to directly access the first element, it breaks later on in the program.
Structure and function definitions:
typeEvent * lstEvent_FirstNode (LSTEvent *lst)
{
return lst->ls;
}
void lstEvent_NewList (LSTEvent * lst, uint16_t size, uint8_t * err)
{
typeEvent* ret = 0;
ret = (typeEvent*)malloc(sizeof(typeEvent)*size);
if (ret == 0)
{
*err = E_RUN_OUT_OF_MEM;
lst->cn = 0;
return;
}
*err = 0;
lst->ls = ret;
lst->cn = size;
}
void lstField_NewList (LSTField * lst, uint16_t size, uint8_t * err)
{
typeField* ret = 0;
ret = (typeField*)malloc(sizeof(typeField)*size);
if (ret == 0)
{
*err = E_RUN_OUT_OF_MEM;
lst->cn = 0;
return;
}
*err = 0;
lst->ls = ret;
lst->cn = size;
}
void lstEvent_ClearList (LSTEvent * lst)
{
free(lst->ls);
lst->ls = 0;
lst->cn = 0;
}
void lstField_ClearList (LSTField * lst)
{
free(lst->ls);
lst->ls = 0;
lst->cn = 0;
}
struct DM_Field{
__packed uint8_t value;
};
typedef struct DM_Field typeField;
typedef struct LSTField {
__packed uint16_t cn; // Count, number of elements in array
uint8_t * ls; // Array
} LSTField;
struct DM_Command{
// some data
LSTField lstFields;
};
typedef struct DM_Command typeCommand;
Platform: STM32L1XX.
EDIT: This code resembles closer the reality.
Code does not work
typeCommand * p = 0;
for (uint16_t i=0; i<1000; i++)
{
// numEvents gets corrupted after some cycles
lstEvent_NewList(&lstEvent, 1, &err); // creates a list of typeEvent in heap
//...
lstEvent_FirstNode(&lstEvent)->numEvents = events; // access first element of list directly
//...
p = (typeCommand *) malloc(sizeof(typeCommand)); // do some more allocations
lstField_NewList(&p->lstFields, 5, &err); // THIS LINE (was thought to be causing) CORRUPTION IN numEvents
//...
lstEvent_ClearList(&lstEvent);
lstField_ClearList(&p->lstFields);
p = 0;
}
Code does work
typeCommand * p = 0;
typeEvent * pEvent; // use an auxiliar to iterate through the list
for (uint16_t i=0; i<1000; i++)
{
lstEvent_NewList(&lstEvent, 1, &err);
//...
pEvent = lstEvent_FirstNode(&lstEvent);
pEvent->numEvents = events;
//...
p = (typeCommand *) malloc(sizeof(typeCommand)); // do some more allocations
lstField_NewList(&p->lstFields, 5, &err); // all is good
//...
lstEvent_ClearList(&lstEvent);
lstField_ClearList(&p->lstFields);
free(p); // freeing properly now
p = 0;
}