Why is address-sanitizer causing a heap-buffer-overflow error in my multiplication matrix?

Question

The error is: heap-buffer-overflow. I'm running a block of code that multiplies matrices. Address sanitizer is throwing me an error at a specific line while trying to multiply two matrices. On my IDE, no errors or warnings show up, however, address sanitizer is throwing an error here and I'm not too sure why. The matrix has entries scanned in from the user, below is a snippet of the code not working. The snippet address sanitizer is throwing an error on is bolded. Thanks.

snippet:

double **productMatrixT;

productMatrixT = (double **)malloc(rowT*sizeof(double));
for(i = 0; i < rowT; i++)
{
  productMatrixT[i] = malloc(column*sizeof(double));
}

double sum = 0;
for(i = 0; i < column; i++)
{
  for(j = 0; j < row; j++)
   {
     for(k = 0; k < rowT; k++)
      {
        **sum = sum + matrixT[i][k] * matrix[k][j];** <---- /*says this line is a cause for a problem*/
      }
       productMatrixT[i][j] = sum;
       sum = 0;
     }
  }
}

free:

for(i = 0; i < rowT; i++)
{
 free(productMatrixT[i]);
}
free(productMatrixT);

`productMatrixT = (double **)malloc(rowT*sizeof(double));` should be `productMatrixT = malloc(rowT*sizeof(double *));`, or better yet `productMatrixT = malloc(rowT*sizeof(*productMatrixT ));` There's no need for a cast. Note that you're not creating a 2-dimsional matrix - you're creating an array of pointers to one-dimensional matrices. To allocate a true multidimensional matrix, see https://stackoverflow.com/questions/42094465/correctly-allocating-multi-dimensional-arrays — Andrew Henle, Oct 23 '19 at 01:57
You allocate space in `productMatrixT` as a `rowT` x `rowT` matrix, but access it as a `column` x `row` matrix. — 1201ProgramAlarm, Oct 23 '19 at 02:58
@1201ProgramAlarm my friend told me I should free whatever part is in the first malloc, for instance, the rowT, but from your response, I'm assuming I free whatever I access first? — Daniel Larson, Oct 23 '19 at 03:19
Your free is ok, since you free what you allocate. The problem is that `i` runs from 0 to `column`, and you use that as the first subscript to `productMatrixT[i]` but you've only allocated `rowT` elements for `productMatrixT`. If `column` > `rowT` you'll have problems. (Similarly for the `sum` line but you don't show the sizes of `matrix` and `matrixT`.) — 1201ProgramAlarm, Oct 23 '19 at 03:22
@1201ProgramAlarm sorry for the novice questions, but how would I be able to fix it? I tried messing around with parameters to allocate enough space (column in the first malloc and loop) and other parameters but it doesnt seem to work — Daniel Larson, Oct 23 '19 at 04:10
what are the values of ```column``` , ```row``` and ```rowT``` ? — John Doe, Oct 23 '19 at 08:21
For us to 'fix it', you need to post a [mcve] so we can reproduce the problem. — user3629249, Oct 24 '19 at 13:57
OT: regarding: `productMatrixT = (double **)malloc(rowT*sizeof(double));` 1) In C, the returned type is `void*` which can be assigned to any pointer. Casting just clutters the code, making it more difficult to understand, debug, etc Suggest removing the cast. 2) When calling any of the heap allocation functions: `malloc()`, `calloc()` and/or `realloc()`, always check (!=NULL) the returned value to assure the operation was successful. — user3629249, Oct 24 '19 at 14:08

score 1 · Answer 1 · answered Oct 24 '19 at 14:03

regarding:

double sum = 0;

since it is declared as a double, it should be initialized as a double, I.E.

double sum = 0.0;

regarding:

**sum = sum + matrixT[i][k] * matrix[k][j];

since 'sum' is a double and not a pointer to a pointer, the ** dereferencing is resulting in some random address. This is what the address sanitizer is complaining about.

As others have mentioned, there is plenty more wrong with the posted code.

score 0 · Answer 2 · answered Oct 23 '19 at 08:23

Your indexing is wrong, in

sum = sum + matrixT[i][k] * matrix[k][j];

you access matrix as column x rowT and rowT x row but you've allocated it as rowT x column.

Also you should fix

productMatrixT = (double **)malloc(rowT*sizeof(double));

to be

productMatrixT = (double **)malloc(rowT*sizeof(double *));

Why is address-sanitizer causing a heap-buffer-overflow error in my multiplication matrix?

2 Answers2