realloc(): invalid next size in simple program. Can't figure out the issue

Question

I am currently writing my first program in C, coming from C++. I am running into an issue with realloc.

void addToBuffer(char c,char* buffer,int *bufferSize, int *numInBuffer, int* rightAfterSpace, int* numInSize, int* size, char** words)
{
  if(*numInBuffer == *bufferSize)
    {
      int doub = 2 * (*bufferSize);
      buffer = (char*) realloc(buffer,doub);
      (*bufferSize) *= 2;

    }
  buffer[*numInBuffer] = c;
  (*numInBuffer)++;
  if(c==' ') {
    *rightAfterSpace =1;
  }                                                                              
}

int main()
{
  char* buffer;
  buffer = (char*)malloc(10);
  int bufferSize = 10;
  int numInBuffer =0;

  char** words;
  words = (char**)malloc(10*sizeof(char*));
  int wordsSize = 10;
  int numInWords =0;

  int *size;
  size = (int*)malloc(sizeof(int));
  int currentSize = 0;
  int sizeSize = 2;
  int numInSize=0;

  //Update every time a value is put into words.                                                                             
  int numOfRecords = 0;
  char c;

  int rightAfterSpace = 1;
  //Get rid of any opening spaces                                                                                            
  c = getchar();
  while(c == ' ')
    {
  c =getchar();
    }
  while(c!=EOF){
    addToBuffer(c, buffer, &bufferSize, &numInBuffer, &rightAfterSpace, &numInSize, size, words);
    currentSize++;                                                                                                                    
    c = getchar();
  }
//...more code in main

There are parts of my code that I commented out to verify that they did not contribute to the issue. I deleted those commented out lines before pasting the code here in case it may be distracting. I have gone through this code many times and just cant find the error. Realloc works fine to realloc 20, then 40 bytes, but once it gets to 80 I come across the error. Valgrind gave me the following message, but I am unsure how to interpret it.

==21051== Memcheck, a memory error detector
==21051== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==21051== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==21051== Command: ./s
==21051== 
==21051== Invalid write of size 1
==21051==    at 0x400920: addToBuffer (in /w/home.11/cs/ugrad/t/Documents/CS35L/week5/s)
==21051==    by 0x400B33: main (in /w/home.11/cs/ugrad/t/Documents/CS35L/week5/s)
==21051==  Address 0x4c3b04b is 1 bytes after a block of size 10 free'd
==21051==    at 0x4A06C20: realloc (vg_replace_malloc.c:662)
==21051==    by 0x4008E1: addToBuffer (in /w/home.11/cs/ugrad/t/Documents/CS35L/week5/s)
==21051==    by 0x400B33: main (in /w/home.11/cs/ugrad/t/Documents/CS35L/week5/s)
==21051== 
==21051== 

Any help would be GREATLY appreciated.