Allocating recently freed memory - c

I have a struct that I use to build a linked list as below;
struct my_struct{
char a[16];
struct my_struct *next;
}
I free that linked list by below function;
void free_my_list(struct my_struct* recv) {
if (recv->next != NULL)
free_my_list(recv->next);
free(recv);
recv = NULL;
}
In my program, I use a struct _my_list over and over but free and malloc it every time as below:
struct my_struct *_my_list;
free_my_list(_my_list);
_my_list = (my_list *) malloc(sizeof(my_list));
_my_list->next = NULL;
Every time I fill the list, I print char arrays and then reset _my_struct by above code.
Above code works fine on Ubuntu pc, but on Cent OS after printing first list(after first malloc _my_struct) correctly, following list are printed as corrupted data.
When I don't free and malloc memory during whole program execution it works fine in Cent OS too but I should reset list _my_list between printf() calls.
_my_list is filled and printed via below functions;
/*prints every item in my_list*/
void print_my_list(struct my_struct *recv, FILE *fd) {
my_list *tmp;
tmp = recv;
while (tmp != NULL) {
if (fwrite(tmp->a, 1, strlen(tmp->a), fd) == -1) {
pritnf("error\n");
}
tmp = tmp->next;
}
}
/*Add 'a' string to _my_list*/
void add_recv_to_list(struct my_struct **recv_list, char *recv) {
struct my_struct *tmp;
tmp = *recv_list;
if (*recv_list == NULL) {
*recv_list = (struct my_struct *) malloc(sizeof(struct my_struct));
tmp = *recv_list;
} else {
while ((tmp->next) != NULL) {
tmp = tmp->next;
}
tmp->next = (struct my_struct *) malloc(sizeof(struct my_struct));
tmp = tmp->next;
}
strncpy(tmp->a, recv, MAX_NAME_LEN);
tmp->next = NULL;
}
What can be the reason, any ideas?

I think that your problem may start here:
struct my_struct *_my_list;
free_my_list(_my_list);
_my_list = (my_list *) malloc(sizeof(my_list));
_my_list->next = NULL;
When you initialize the struc: struct my_struct *_my_list; you don't assign it any value, so it holds whatever garbage data was in memory beforehand. When you free() that in free_my_list, the behavior is undefined (you are freeing something that you never malloc()ed - so the result may very well be corruption of something or other later on. Try changing your declaration to: struct my_struct *_my_list = NULL; (always a good practice to initialize pointers to NULL, anyway) and changing your free_my_list function to:
void free_my_list(struct my_struct* recv) {
if (recv == NULL)
return;
if (recv->next != NULL)
free_my_list(recv->next);
free(recv);
recv = NULL;
}

Related

Different behaviour for malloc(sizeof(struct Node)) vs malloc(sizeof(nodeptr))

I was trying to allocate memory using malloc, I am not able to understand why I am getting a different result for these two malloc calls.
The line below gives me wrong result even though with gdb I see the
data is getting the correct value assigned.
nodeptr n = malloc(sizeof(nodeptr));
Value head->data: '!'
Value head->eq->data: ''
And when I do this get the correct result:
nodeptr n = malloc(sizeof(struct Node));
Value head->data: 'w'
Value head->eq->data: 'X'
I followed this post, I think I am doing it correctly.
In both ways, while allocation I get the same amount of memory, just I see the different results in the end.
typedef struct Node
{
struct Node *left, *right, *eq;
char data;
bool isEnd;
} *nodeptr;
nodeptr newNode(const char c) {
nodeptr n = malloc(sizeof(nodeptr));
// nodeptr n = malloc(sizeof(struct Node));
n->data = c;
n->left = NULL;
n->right = NULL;
n->left = NULL;
n->isEnd = false;
return n;
}
void insert(nodeptr *node, const char *str) {
if (*node == NULL) {
*node = newNode(*str);
}
nodeptr pCrawl = *node;
if(pCrawl->data < *str) {
insert(&pCrawl->right, str);
} else if (pCrawl->data > *str) {
insert(&pCrawl->left, str);
} else {
if(*(str+1)) {
insert(&pCrawl->eq, str + 1);
} else {
pCrawl->isEnd = true;
}
}
}
int main(int argc, char const *argv[])
{
const char* const strs[5]= {
"w.",
};
nodeptr head = NULL;
for(int i = 0; i<1; i++) {
insert(&head, strs[i]);
}
return 0;
printf("Value head->data: \'%c\'\n", head->data);
printf("Value head->eq->data: \'%c\'\n", head->eq->data);
}
sizeof(nodeptr) == sizeof(struct Node*) != sizeof(struct Node) == sizeof(*nodeptr)
sizeof(nodeptr) will always be the size of a pointer (like 8 bytes on a 64-bit CPU)
sizeof(struct Node) refers to the struct contents
sizeof(*nodeptr) is equivalent to sizeof(struct Node) with the extra dereference operator in there.
The reason it may appear to "work" (not segfault) is that malloc suballocates from a larger block of heap memory. However, the code is writing out-of-bounds of the requested allocation, which can eventually lead to heap corruption or segfaults at some point.
The two different versions aren't allocating the same amount of memory. sizeof(nodeptr) is the size of a pointer and sizeof(struct Node) is the size of your struct. These are not the same things and they're not the same size. On my computer these values are 8 and 32.
You want to use:
nodeptr n = malloc(sizeof(struct Node));
or perhaps:
nodeptr n = malloc(sizeof(*n)); // size of the type that n points too

Passing a struct to multiple other functions

I'm relatively new to programming and I am having some issues passing my struct to other functions. Here is what my actual code looks like:
typedef struct Memcheck {
char *memoryAdd;
char *file;
int line;
struct Memcheck_struct *next;
} Memcheck;
char *strdup2( char *str )
{
char *new;
new = malloc( strlen(str)+1 );
if (new)
strcpy( new, str );
return new;
}
/*Allocate memory for a ptr, and add it to the top of the linked list*/
void *memcheck_malloc(size_t size, char *file, int line){
Memcheck * new_memoryCheck = NULL;
Memcheck * head = NULL;
head = malloc(sizeof(Memcheck));
new_memoryCheck = malloc(sizeof(Memcheck));
new_memoryCheck->memoryAdd = malloc(sizeof(new_memoryCheck->memoryAdd));
new_memoryCheck->file = malloc(sizeof(new_memoryCheck->file));
new_memoryCheck->file = strdup2(file);
new_memoryCheck->line = line;
new_memoryCheck->next = head;
return new_memoryCheck;
}
/*Prints the error messages*/
void printList(Memcheck *new_memoryCheck) {
Memcheck * head = NULL;
Memcheck * current = head;
head = malloc(sizeof(Memcheck));
current = malloc(sizeof(Memcheck));
printf("new_mem file: %s\n", new_memoryCheck->file);
printf("current file: %s\n", current->file);
while (current != NULL) {
printf("in loop\n");
printf("memcheck error: memory address %p which was allocated in file \"%s\", line %d, was never freed\n", current, current->file, current->line);
current = current->next;
}
}
int memcheck_main(Memcheck new_memoryCheck){
printf("newmem file: %s\n", new_memoryCheck.file);
printf("Entering printList\n");
printList(&new_memoryCheck);
return 0;
}
I have strdup2 because apparently ansi doesn't have stdrup.
I know to use pass by reference to some degree but I'm not exactly sure where to use the * and & operators
Since it appears that you are writing a surrogate for malloc() that records which memory was allocated where, you probably need code similar to:
typedef struct Memcheck Memcheck;
struct Memcheck
{
void *data;
size_t size;
const char *file;
int line;
Memcheck *next;
};
static Memcheck *memcheck_list = 0;
/* Allocate memory and record the allocation in the linked list */
void *memcheck_malloc(size_t size, const char *file, int line)
{
Memcheck *node = malloc(sizeof(*node));
void *data = malloc(size);
if (node == 0 || data == 0)
{
free(node);
free(data);
return 0;
}
node->data = data;
node->size = size;
node->file = file;
node->line = line;
node->next = memcheck_list;
memcheck_list = node;
return data;
}
Note that if either (or both) memory allocations fails, the memory is all freed before returning. Using free() on a null (0) pointer is a no-op. Thus the clean-up is safe. The information can simply be copied into the structure as shown; no need for extra memory allocations for the file name, for example, as long as you pass __FILE__ to the function (which is a string literal, and therefore has a lifetime as long as the rest of the program).

Free generic linked list in C - segfault

I am writing a generic linked list in C (following Kyle Loudon's book),
but when it comes to free it, I got a segfault.
Data types used for the list definition:
typedef struct list_elem_
{
void *data;
struct list_elem_ *next;
} list_elem;
typedef struct link_list_
{
int size;
int (*match)(const void *key1, const void *key2);
void (*destroy)(void *data);
list_elem *head;
list_elem *tail;
} link_list;
Function that is used to destroy caller's data:
void destroy_data(void *data)
{
if(data)
free(data);
return;
}
Destroy passed by a function pointer:
void list_init(link_list *list, void (*destroy)(void *data))
{
list->size = 0;
list->destroy = destroy;
list->head = NULL;
list->tail = NULL;
return;
}
Free the list:
void list_destroy(link_list *list)
{
void* data;
while(list_size(list) > 0)
if(list_rem_next(list, NULL, (void**)&data) == 0 && list->destroy != NULL)
list->destroy(data);
memset(list,0,sizeof(link_list));
return;
}
The segfault is triggered by the free in the destroy_data.
============== EDIT ====================
Remove a list element
int list_rem_next(link_list *list, list_elem *element, void **data)
{
list_elem *OldElement;
if(list_size(list) ==0)
return -1;
/* Remove the head */
if(element == NULL)
{
*data = list->head->data;
OldElement = list->head;
list->head = list->head->next;
if(list_size(list) == 1)
list->tail = NULL;
/* Remove other than head */
} else {
if(element->next == NULL)
return -1;
*data = element->data;
OldElement = element->next;
element->next = element->next->next;
if(element->next == NULL)
list->tail = element;
}
free(OldElement);
list->size--;
return 0;
}
=================== EDIT 2 ==========================
Inside main
link_list myList;
int i;
int *iptr;
char *chrPtr;
list_init(&myList, destroy_data);
for(i = 0; i < 4; i++)
{
iptr = malloc(sizeof(int));
*iptr = i;
list_ins_next(&myList, NULL, iptr);
}
chrPtr = malloc(sizeof("uno\0"));
chrPtr = "uno\0";
list_ins_next(&myList,NULL,chrPtr);
chrPtr = malloc(sizeof("stringa numero due\0"));
chrPtr = "stringa numero due\0";
list_ins_next(&myList,NULL,chrPtr);
chrPtr = NULL;
iptr = NULL;
getchar();
list_destroy(&myList);
In your code from main() you have:
chrPtr = malloc(sizeof("uno\0"));
chrPtr = "uno\0";
Why the explicit \0 when C adds one after it automatically?
Can you say 'memory leak'? You allocate memory; you immediately overwrite the only pointer to that allocated memory by assigning the address of the string literal to the same pointer.
What happened to strcpy()?
As a result of this abuse, you are passing unallocated memory pointers to free(); in fact, you're passing pointers to string constants to free(). That's undefined behaviour and can very easily lead to crashes!
The problem wasn't in the code you showed at first; it was in the other code. That's also why the MCVE (Minimal, Complete, Verifiable Example) — aka SSCCE (Short, Self-Contained, Correct Example) mentioned by Greg Hewgill — is so important. There's no way for us to debug code you don't show — and it is unnecessarily hard work establishing that the problem isn't in the code you do show.
You could probably use:
chrPtr = strdup("uno"));
list_ins_next(&myList, NULL, chrPtr);
chrPtr = strdup("stringa numero due");
list_ins_next(&myList,NULL,chrPtr);
to avoid the trouble. Failing that, you could use:
chrPtr = malloc(sizeof("uno"));
strcpy(chrPtr, "uno");
list_ins_next(&myList, NULL, chrPtr);
chrPtr = malloc(sizeof("stringa numero due"));
strcpy(chrPtr, "stringa numero due");
list_ins_next(&myList,NULL,chrPtr);
Neither of these checks that the memory allocation succeeded; that too should be done in production code, and arguably in school assignments.
Note that sizeof("string literal") counts the null byte, so the length is correct. Note equally that strlen("string literal") does not count the null byte — be careful!
There could still be other problems in the code; I've not verified that everything is clean. But this part will be cleaner and more likely to work correctly.
The functions list_size() and list_ins_next() are not shown. The size can be guessed; the list_ins_next() is not so easy.
I also observe that the code inserts 4 integers and then 2 strings into the list. There's no way to know that's what was inserted after the fact. The code in main() is dreadfully non-general. The support code can handle it — but heterogeneous lists are tricky; don't try it until you don't run into this sort of problem. One list of integers; fine. One list of strings; fine. One list of integers and strings — dodgy!

invalid write size of 1 in C

I trying to write a queue(String Version) program in C by using linked lists.
Here is the structure:
struct strqueue;
typedef struct strqueue *StrQueue;
struct node {
char *item;
struct node *next;
};
struct strqueue {
struct node *front;//first element
struct node *back;//last element in the list
int length;
};
I creates a new StrQueue first
StrQueue create_StrQueue(void) {
StrQueue q = malloc(sizeof (struct strqueue));
q->front = NULL;
q->back = NULL;
q->length = 0;
return q;
}
makes a copy of str and places it at the end of the queue
void push(StrQueue sq, const char *str) {
struct node *new = malloc(sizeof(struct node));
new->item = NULL;
strcpy(new->item,str);//invalid write size of 1 ?
new->next = NULL;
if (sq->length == 0) {
sq->front = new;
sq->back = new;
} else {
sq->back->next = new;
sq->back = new;
}
sq->length++;
}
frees the node at the front of the sq and returns the string that was first in the queue
char *pop(StrQueue sq) {
if (sq->length == 0) {
return NULL;
}
struct node *i = sq->front;
char *new = sq->front->item;
sq->front = i->next;
sq->length --;
free(sq->front);
return new;
}
I got invalid write size of 1 at strcpy(new->item,str); I dont understand why I got this error.
Can anyone tell me why and tell me how should I fix it? Thanks in advance.
Okay, first things first, in the answer below I am NOT fixing your doubly linked list concepts, I am just showing you how you should fix the code above within the scope of your question. You may want to look into how doubly linked lists are done.
In:
void push(StrQueue sq, const char *str) {
struct node *new = malloc(sizeof(struct node));
new->item = NULL;
The next statement is wrong:
strcpy(new->item,str);
There are two ways you can solve it:
Make sure that *str is a valid pointer outside of the list management context while the list is being used.
Let the list manage the string allocation (and possibly deallocation).
is the quick and dirty method, it's easier to debug later but larger codebase makes it cumbersome.
cleaner looking code, but requires initial setup discipline, you should create object (string) management routines in addition to list management routines. can be cumbersome in its own right.
CASE 1: const char *str is guaranteed to be valid for life of StrQueue (this is what you are looking for really)
It should be:
new->item = str;
Here we assume str was a dynamic string allocated elsewhere
Now, in pop when you pop off the string you are okay. because the pointer you are returning is still valid (you are guaranteeing it elsewhere)
CASE 2: const char *str is not guaranteed to be valid for life of StrQueue
Then use:
new->item = strdup(str);
Now, in pop when you pop off the string you can either
de-allocate the strdup and not return anything, (not quite the same things as you did)
pass a container pointer to pop where contents of item are copied (clean)
return the popped off pointer, but you must deallocate it separately when you are done with it (ugly)
Which would make your pop function one of the following:
Case 2.1:
void pop(StrQueue sq) {
if (sq->length == 0) {
return NULL;
}
struct node *node = sq->front;
sq->front = node->next;
sq->length--;
free(node->item);
free(node);
}
Case 2.2:
char *pop(StrQueue sq, char *here) {
if (sq->length == 0) {
return NULL;
}
struct node *node = sq->front;
sq->front = node->next;
sq->length--;
strcpy(here, node->item);
free(node->item);
free(node);
}
Case 2.3:
char *pop(StrQueue sq) {
char *dangling_item = NULL;
if (sq->length == 0) {
return NULL;
}
struct node *node = sq->front;
sq->front = node->next;
sq->length--;
dangling_item = node->item;
free(node);
return dangling_item;
}
I got invalid write size of 1 at strcpy(new->item,str); I dont understand why I got this error. Can anyone tell me why and tell me how should I fix it?
Why:
This code:
new->item = NULL;
strcpy(new->item,str);//invalid write size of 1 ?
You're not suppose to pass a null pointer to the first argument, it should be a pointer to allocated memory. The reason why you're getting this error message, I can imagine, is because the implementation of strcpy probably looks like this:
for (int i = 0; str2[i]; i++) str1[i] = str2[i];
And in the first iteration of the for loop, it writes to address 0 (a read-only section of memory) - this gives you the invalid write of size 1. I'm not sure, however, why you are only getting a size of 1, though (I would imagine it would be the entire size of the string). This could be because either a) str is only of size 1 or b) because the signal, SIGSEGV stops the program.
How to fix:
Allocate space for new->item before calling strcpy, like this:
new->item = malloc (strlen (str) + 1); // + 1 for null-terminating character
But you could probably include some error checking, like this:
int len = strlen (str) + 1;
if (len){
new->item = malloc (len);
if (!new->item){
return;
}
}

segfault with linked list

I am having trouble with linked lists in C, I have only done data structures such as this in c++.
Gdb is giving me a
Program received signal SIGSEGV, Segmentation fault.
0x0804a23c in addArg (base=0x1, argument=0x804e410 "is") at myshell.c:42
42 while ( (curr != NULL) && (curr->n != NULL) )
I am familiar with segmentation faults having to do with memory, however I thought I have allocated memory correctly. What am I doing wrong?
addArg is being called as addArg(currentCmd->args, lexeme);and currentCmd is a pointer to a node struct
struct lnode {
char *x;
struct lnode *n;
};
struct node
{
char *command;
struct lnode *args;
int input;
int output;
int error;
char *in;
char *out;
char *err;
struct node *next;
struct node *prev;
};
void addArg(struct lnode *base, char *argument)
{
struct lnode *curr = base;
//this is line 42
while ( (curr != NULL) && (curr->n != NULL) )
curr = curr->n;
curr -> n = malloc(sizeof(struct lnode));
curr = curr->n;
curr->x = strdup(argument);
curr->n = NULL;
}
struct node* createNode(char *command_, int input_, int output_, int error_, char *in_, char *out_, char *err_, struct node *prev_)
{
struct node *n;
n = malloc(sizeof (struct node));
n->command = strdup(command_);
n->prev = prev_;
n->next = NULL;
n->input = input_;
n->output = output_;
n->error = error_;
n->in = in_;
n->out = out_;
n->err = err_;
n->args=malloc(sizeof(struct lnode));
return n;
}
It looks like currentCmd->args is an invalid pointer. Perhaps a pointer to free()d memory. Or an uninitialized pointer, or a pointer to a local variable that's gone out of scope (though these latter two don't appear to be the case here).
Or perhaps you've accidentally overwritten out-of-bounds memory somewhere else in your program. Pointer issues aren't always at the point of failure; sometimes they're in earlier code, unrelated code even.
I solved this issue by making the lnode *args into lnode args and making the required changes to memory managment.
What i can see from your gdb output, the problem with while ( (curr != NULL) && (curr->n != NULL) ) is that if curr == NULL you are still trying to access curr->n to compare, so you should change that condition to only compare curr, and handle curr->n only if curr is not null, maybe breaking the cicle inmediatly if curr->n == NULL.

Resources