Got "invalid next size" when executing free()

Question

I was trying to learn the memory management of c.

I allocated the memory for

1. char** a
2. char** b
3. char* b[0] ~ b[99]

and

I freed the memory for

1. char** a
2. char* b[0] ~ b[99]
3. char** b

However, I got an error at the line33, which is free(b[0])

Why does it produces invalid next size free (fast)?

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main()
{

  char** a = (char**)malloc(100 * sizeof(char*));
  a[0] = "Hello Again!";



  char** b = (char**)malloc(100 * sizeof(char*));
  int i = 0;
  for(i = 0; i < 100; i++){
    b[i] = (char*)malloc(10 * sizeof(char));
  }

  strcpy(b[0], *a);

  free(a);

  printf("%s", b[0]);

  for(i = 0; i < 100; i++){
      free(b[i]);
  }

  free(b);
  return 0;

}

Answer 1

The string "Hello Again!" is 13 characters long (including the terminating \0).

The memory you allocate for it is not enough (you allocate just 10 chars), so when calling strcpy you are overwriting past the allocated memory, and probably overwriting the memory location used by the library to keep track of allocations.

The next time that the library will try and use the information stored there, it finds that it is inconsistent, so it aborts with the error you mentioned. That is only one of the many messages that the library can print if it is able to find any such discrepancy.

In general, do not rely on the library flagging those errors for you: in this case you were "lucky" that the info were corrupted in a recognizable way. If you are unlucky, your program might just exhibit undefined behavior.

Answer 2

For each b[i], you only allocate space for 10 chars, but the strcpy copies the string "Hello Again!", which is certainly more than 10 chars. This is undefined behavior.

Answer 3

When you execute this line,

strcpy(b[0], *a);

you are writing over memory that you were not supposed to use. That leads to undefined behavior.

Some environments store useful information at the end of the allocated block of memory. By writing over that memory, you have destroyed that useful information.

Answer 4

The error is this line:

strcpy(b[0], *a);

You allocate 10 bytes for b[0], but you copy 13 bytes, thereby writing beyond the end of the allocated memory.

Answer 5

It's a buffer overrun because strlen(a[0]) + 1 > 10. You need to allocate more than 10 characters for b[0], specifically at least strlen(a[0]) + 1.