What's wrong with strtol? - c

Question

I have this code, which should run fine, but for some reason, the loop would cycle through when I free the string before the conditional check of the loop. And the only way to get out from the loop is by giving integer with more than 3 digits (input > 99 || input < -99).
I'm using gcc to compile this code with code::blocks as IDE.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char* createString(void);
int main() {
int temp = 0;
char* string = 0;
char* error = 0;
do {
printf("\n Integer: ");
string = createString();
temp = strtol(string, &error, 10);
if (*error != '\n' && *error != '\0') printf("\n Input is not an integer");
free(string);
string = 0;
} while (*error != '\n' && *error != '\0');
free(error);
error = 0;
return 0;
}
char* createString() {
char* string = 0;
size_t size = 0;
size_t index = 0;
int ch = EOF;
do {
ch = getc(stdin);
if (ch == EOF || ch == '\n') ch = 0;
if (size <= index) string = (char*) realloc(string, size += 5);
if (!string) {
perror("realloc");
exit(EXIT_FAILURE);
}
string[index++] = ch;
} while(ch);
return string;
}
I did a work-around it by moving the free-ing process to the beginning of the loop cycle and after the loop.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char* createString(void);
int main() {
int temp = 0;
char* string = 0;
char* error = 0;
do {
free(string);
string = 0;
printf("\n Integer: ");
string = createString();
temp = strtol(string, &error, 10);
if (*error != '\n' && *error != '\0') printf("\n Input is not an integer");
} while (*error != '\n' && *error != '\0');
free(string);
string = 0;
free(error);
error = 0;
return 0;
}
char* createString() {
char* string = 0;
size_t size = 0;
size_t index = 0;
int ch = EOF;
do {
ch = getc(stdin);
if (ch == EOF || ch == '\n') ch = 0;
if (size <= index) string = (char*) realloc(string, size += 5);
if (!string) {
perror("realloc");
exit(EXIT_FAILURE);
}
string[index++] = ch;
} while(ch);
return string;
}
The code works fine now, but I'm wondering what is strtol doing.

Answer 1

free(error);
Remove it. error is not allocated in strtol or anywhere else. It is a pointer that points to the middle of string. Freeing it is UB.

Answer 2

You say:
for some reason, the loop would cycle through when I free the string before the conditional check of the loop
Keep in mind that with the call strtol(string, &error, 10); the pointer error will point into the string string. So if you free string before doing this:
if (*error != '\n' && *error != '\0') printf("\n Input is not an integer");
or this:
while (*error != '\n' && *error != '\0')
You'll invoke undefined behavior because error will be pointing to freed memory.