Where does the error come from? Valgrind / C / insertString - c

Question

for one of my project i have to make a new version of the function insertString,you could see the code below:
This function always gives me the desired result, (I made some Unit test), however the main issue is this one: even if it works in my IDE (compilation etc) it won't pass unit test using Valgrind, is there anyone who could see the error?
char * insertString(const char * src, int insertPosition, const char * toBeInserted,int insertLength)
{
size_t outputSize=stringLength(src)+(size_t)insertLength;
char* output=malloc(sizeof(char)*(outputSize+1));
int i;
if(output==NULL)
{
fatalError("error during memory allocation in InsertString");
}
for(i=0;i<insertPosition;i++)
{
output[i]=src[i];
}
for(i=0;i<insertLength;i++)
{
output[i+insertPosition]=toBeInserted[i];
}
for(i=0;i<=insertLength;i++)
{
output[i+insertPosition+insertLength]=src[insertPosition+i];
}
output[outputSize]='\0';
return output;
}
thank's for everything, and have a good Sunday!

Answer 1

The terminating condition, i<=insertLength, in your last loop:
for(i=0;i<=insertLength;i++)
{
output[i+insertPosition+insertLength]=src[insertPosition+i];
}
has nothing to do with the length remaining in src. If insertLength is large enough, the code will read past the end of src.
Change it to something like (I think):
for(i=0;i<=strlen(src)-insertPosition;i++)
{
output[i+insertPosition+insertLength]=src[insertPosition+i];
}
Also, in my opinion the code could be made much more easily understood (and therefore verifiable) by using a running index for the output buffer instead of resetting it to 0 for each loop and adding other values for the subscript. Alternatively, I think using pointers to traverse the various buffers would be more readable:
char* tmp = output;
for(i=0;i<insertPosition;i++)
{
*tmp++ = *src++;
}
for(i=0;i<insertLength;i++)
{
*tmp++ = *toBeInserted++;
}
for(i=insertPosition;i<=strlen(src);i++)
{
*tmp++ = *src++;
}
*tmp++ = '\0';