Issue with deleting a pointer (what it points to)

Question

How to delete the pointer that I assign in the below code:

char* ptr;
ptr=new char(65);   // memory for one char is created and is assigned 'A'
strcpy(ptr,"asdf"); // how can string of length 4 chars are copied
delete ptr;         // why am I getting debug error of Heap corruption detected

I am using Visual C++ 2005

Answer 1

You're allocating a single char instead of an array. Use:

char* ptr;
ptr=new char[65];
strcpy(ptr,"asdf");
delete[] ptr;

As it is now, you're writing the first a to the allocated char, and the rest on some arbitrary memory that was never allocated to you. The runtime detects that (on debug build), and complains.

Making my comment to the question part of my answer:

C++ doesn't have any mechanism to identify the potential error in the question's code. The only way for a compiler to know the size of the buffer that is passed to strcpy is using static analysis, and that may or may not work. But even if it does, the compiler doesn't know the semantics of strcpy. So at compile time, it can't warn you about the error.

Now, when the buffer is passed tostrcpy at runtime, strcpy has no way to tell how large is that buffer. So it just assumes the caller provided a suitable buffer, and goes ahead with the copy. If you're lucky, overflowing the allocated buffer will cause an immediate crash due to a write to unallocated page. If not, you'll get a memory corruption.

The error you do get is the result of a mechanism used on debug builds: the memory manager allocates a few more bytes than what you ask, and writes a special pattern onto them. Then, when the allocated memory is freed, it checks whether that pattern still exists. If not, it complains the user's code has written onto them. In release builds, you don't have those extra checks, and such bugs may cause a corruption without being noticed.

The only way to avoid such cases is to write safer code:

1. Use higher-level constructs like std::string. They do the memory management for you, and save you from having to deal with low-level string functions.
2. Use Microsoft's (non-standard) safe variants - strcpy_s, for example. Those functions take the size of the buffer as well, and fail if it is insufficient - without doing any damage.
3. Use (standard) strncpy, pass the buffer's size as the last argument, and check the return value to see how many chars have been copied. As with the previous suggestion, specifying a wrong buffer size will still cause damage.
4. Bear in mind that if you want to shoot your own toes, C++ will gladly hand you a down-pointing gun. Dealing with raw buffers, pointers and low-level string functions has to be done with care. The language will not save you from your own mistakes.

Answer 2

Because you corrupted the heap by trying to stuff 4 characters "asdf" (actually 5 if count null terminator) into a memory block that is only capable of 1 character by doing this:

strcpy(ptr,"asdf");

Update:

You should allocate as much memory as needed (or more). If you need to copy a 4-character string into a memory block you should make sure that that the memory block will be large enough to keep it, so, in your case, you should use

ptr=new char[5];

to allocate 5 chars (4 chars of the string + 1 null terminator every string should have at its end), and to release the allocated memory, you should use

delete[] ptr;

[] means that you want to delete an array of chars, not just one char.

Answer 3

That's actually wrong. You want:

ptr=new char[65];   // memory for one char is created and is assigned 'A'
strcpy(ptr,"asdf"); // how can string of length 4 chars are copied
delete[] ptr;   

better:

char ptr[65];
strcpy(ptr,"asdf");

best:

std::string str("asdf");

Answer 4

This is a typical case of memory corruption. Heap to be specific. ptr has just 1 byte allocated and you are doing a string copy operation overflowing that 1 byte.

Your program may not necessarily crash immediately, but would result in random crashes or undefined behavior.

Answer 5

First you allocated ptr with a single byte. and assigned 'A' to it.

And then tried to copy string of size 5 to ptr using strcpy.

You might be wondering why it didn't crash at the strcpy call itself. The reason is strcpy does not perform any validation on the size of allocation and hence causing undefined behavior as a result of buffer overflow.

Refer: Segmentation fault in strcpy

char* ptr;
ptr=new char[5];   // I see no point in assigning 'A' as you replace it in next statement.
strcpy(ptr,"asdf");
delete[] ptr;         // delete[] is used as memory is allocated for arrays of elements.

Also, In Visual Studio 2005, you can use the secure alternative for strcpy, strcpy_s.

Refer: strcpy_s, wcscpy_s, _mbscpy_s