Error using free() in C

Question

I am trying to write a program in C language which has one function split_array. It takes a pointer to a dynamically allocated array and then splits it into two halves viz., left and right.

The code for the sample of the program is:

#include<stdio.h>
#include<stdlib.h>

void split_array(int *A, int x)
{
    int *left=NULL, *right=NULL, i, mid=0;

    mid=x/2;
    left=(int*)malloc(sizeof(int)*mid);
        if(left==NULL)
        {
            printf("\nError allocating memory. Aborting!\n\n");
            exit(1);
        }

    if(x%2==0)
    {
            right=(int*)malloc(sizeof(int)*mid);
            if(right==NULL)
            {
                    printf("\nError allocating memory. Aborting!\n\n");
                    exit(1);
            }
    }
    else
    {
        right=(int*)malloc(sizeof(int)*(mid+1));
            if(right==NULL)
            {
                    printf("\nError allocating memory. Aborting!\n\n");
                    exit(1);
            }
    }

        for(i=0;i<mid;i++)
           left[i]=A[i];

        for(i=mid;i<x;i++)
           right[i]=A[i];

        printf("\nleft: ");
        for(i=0;i<mid;i++)
            printf("%d ", left[i]);
        printf("\n");
        printf("\nright: ");
        for(i=mid;i<x;i++)
            printf("%d ", right[i]);
        printf("\n");

    free(left);
    free(right);

    left=NULL;
    right=NULL;
}

int main()
{
    int *arr=NULL, i, l=0;

    printf("Enter number of elements required in array: ");
    scanf("%d", &l);

    arr=(int*)malloc(sizeof(int)*l);
    if(arr==NULL)
    {
        printf("\nError allocating memory. Aborting!\n\n");
        exit(1);
    }

    printf("Enter the elements: ");
    for(i=0;i<l;i++)
        scanf("%d", &arr[i]);

    printf("\nYou entered the elements: ");
    for(i=0;i<l;i++)
        printf("%d ", arr[i]);
    printf("\n");

    split_array(arr, l);

    free(arr);
    arr=NULL;

return 0;
}

As long as length of the array less than or equal to 6, it executes normally. But when the length is more than or equal to 7, it starts throwing error messages.

A sample of the output is:

Enter number of elements required in array: 7 Enter the elements: 1 2 3 4 5 6 7

You entered the elements: 1 2 3 4 5 6 7

left: 1 2 3 

right: 4 5 6 7 
*** glibc detected *** ./a.out: free(): invalid next size (fast): 0x0000000002451060 ***
======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x76a16)[0x7f1d2d616a16] /lib/x86left: 1 2 3 

right: 4 5 6 7 
*** glibc detected *** ./a.out: free(): invalid next size (fast): 0x00000_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f1d2d61b7bc] ./a.out[0x400910] ./a.out[0x400a3e] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7f1d2d5beead] ./a.out[0x400619]
======= Memory map: ======== 00400000-00401000 r-xp 00000000 08:01 25954902                           /home/ralph/Desktop/a.out 00600000-00601000 rw-p 00000000 08:01 25954902                         /home/ralph/Desktop/a.out 02451000-02472000 rw-p 00000000 00:00 0      [heap] 7f1d28000000-7f1d28021000 rw-p 00000000 00:00 0  7f1d28021000-7f1d2c000000 ---p 00000000 00:00 0  7f1d2d38a000-7f1d2d39f000 r-xp 00000000 08:01 17957772                 /lib/x86_64-linux-gnu/libgcc_s.so.1 7f1d2d39f000-7f1d2d59f000 ---p 00015000 08:01 17957772                   /lib/x86_64-linux-gnu/libgcc_s.so.1 7f1d2d59f000-7f1d2d5a0000 rw-p 00015000 08:01 17957772                   /lib/x86_64-linux-gnu/libgcc_s.so.1 7f1d2d5a0000-7f1d2d722000 r-xp 00000000 08:01 17956950                   /lib/x86_64-linux-gnu/libc-2.13.so 7f1d2d722000-7f1d2d922000 ---p 00182000 08:01 17956950                   /lib/x86_64-linux-gnu/libc-2.13.so 7f1d2d922000-7f1d2d926000 r--p 00182000 08:01 17956950                   /lib/x86_64-linux-gnu/libc-2.13.so 7f1d2d926000-7f1d2d927000 rw-p 00186000 08:01 17956950                   /lib/x86_64-linux-gnu/libc-2.13.so 7f1d2d927000-7f1d2d92c000 rw-p 00000000 00:00 0  7f1d2d92c000-7f1d2d94c000 r-xp 00000000 08:01 17957749                   /lib/x86_64-linux-gnu/ld-2.13.so 7f1d2db2c000-7f1d2db2f000 rw-p 00000000 00:00 0  7f1d2db47000-7f1d2db4b000 rw-p 00000000 00:00 0  7f1d2db4b000-7f1d2db4c000 r--p 0001f000 08:01 17957749                 /lib/x86_64-linux-gnu/ld-2.13.so 7f1d2db4c000-7f1d2db4d000 rw-p 00020000 08:01 17957749                   /lib/x86_64-linux-gnu/ld-2.13.so 7f1d2db4d000-7f1d2db4e000 rw-p 00000000 00:00 0  7fff59345000-7fff59366000 rw-p 00000000 00:00 0      [stack]

7fff593ff000-7fff59400000 r-xp 00000000 00:00 0                        [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0         [vsyscall] Aborted

I am using GNU/Linux amd64 with gcc 4.7.2. Any expositions as to why this is happening?

Thanks

Suspect right should be `right=(int*)malloc(sizeof(int)*(x-mid));` On 2nd thought, that is just a simplification. — chux - Reinstate Monica, Feb 06 '15 at 04:43

score 5 · Accepted Answer · answered Feb 06 '15 at 04:44

These lines

for(i=mid;i<x;i++)
   right[i]=A[i];

and these lines

for(i=mid;i<x;i++)
   printf("%d ", right[i]);

are wrong. You are accessing right out of bounds, and are causing undefined behavior.

They need to be:

for(i=mid;i<x;i++)
   right[i-mid]=A[i];

and

for(i=mid;i<x;i++)
   printf("%d ", right[i-mid]);

score 3 · Answer 2 · edited May 23 '17 at 11:43

You are copying into the wrong areas in the right array, or (more precisely) you are copying outside the space allocated for the right array. Your loop is:

for(i=mid;i<x;i++)
   right[i]=A[i];

It needs to be:

for (i = mid; i < x; i++)
    right[i-mid] = A[i];

The printing loop has the equivalent problem and should be written:

for (i = mid; i < x; i++)
    printf("%d ", right[i - mid]);

You should also review the code:

if(x%2==0)
{
    right=(int*)malloc(sizeof(int)*mid);
    if(right==NULL)
    {
        printf("\nError allocating memory. Aborting!\n\n");
        exit(1);
    }
}
else
{
    right=(int*)malloc(sizeof(int)*(mid+1));
    if(right==NULL)
    {
        printf("\nError allocating memory. Aborting!\n\n");
        exit(1);
    }
}

That's a huge repeat that should be:

int rsize = x - mid;
right = (int*)malloc(sizeof(*right)* rsize);
if(right==NULL)
{
    printf("\nError allocating memory. Aborting!\n\n");
    exit(1);
}

With that in place, you could also rewrite the loops as:

for (i = 0; i < rsize; i++)
    right[i] = A[i + mid];

for (i = 0; i < rsize; i++)
    printf("%d ", right[i]);

There are those who would castigate you for casting the return from malloc().

Error using free() in C

2 Answers2