c++ - What is a glibc free/malloc/realloc invalid next size/invalid pointer error and how to fix it? -

you seeing question because question has been closed duplicate of this. moderately complete list of related questions, please see a long list of possible duplicates — c memory allocation , overrunning bounds on meta stack overflow.

---

example question

from free char*: invalid next size (fast) asked noobie on 2014-04-11.

i freeing char* after concatenation process, receive error:

free(): invalid next size (fast): 0x0000000001b86170 

this code:

void concat(stringlist *list) {     char *res = (char*)malloc(sizeof(char*));      strcpy(res, list->head->string);      list->tmp = list->head->next;     while (list->tmp != null) {         strcat(res, ",");         strcat(res, list->tmp->string);         list->tmp = list->tmp->next;     }      printf("%s\n", res);     free(res); } 

---

generic question

when running program, see error message this:

*** glibc detected *** ./a.out: free(): corrupted unsorted chunks: 0x12345678 *** 

the detailed information can contain of following after *** glibc detected *** , program name, , message followed hexadecimal address (shown 0x12345678) , ***:

• free(): corrupted unsorted chunks: 0x12345678
• free(): invalid next size (fast): 0x12345678
• free(): invalid next size (normal): 0x12345678
• free(): invalid pointer: 0x12345678
• free(): invalid size: 0x12345678
• malloc(): corrupted unsorted chunks: 0x12345678
• malloc(): corrupted unsorted chunks 2: 0x12345678
• malloc(): memory corruption: 0x12345678
• malloc(): memory corruption (fast): 0x12345678
• malloc(): smallbin double linked list corrupted: 0x12345678
• munmap_chunk(): invalid pointer: 0x12345678
• realloc(): invalid next size (fast): 0x12345678
• realloc(): invalid old size (fast): 0x12345678
• realloc(): invalid pointer: 0x12345678
• corrupted double-linked list: 0x12345678

this happens while calling frobnicate() function; wrong function?

answer example question

unwind gave accepted answer example question:

your code wrong.

you allocating space single pointer (malloc(sizeof(char*))), no characters. overwriting allocated space strings, causing undefined behavior (in particular case, corrupting malloc()'s book-keeping data).

you don't need allocate space pointer (res); it's local variable. must allocate space characters wish store @ address held pointer.

since you're going traversing list find strings concatenate, can't know total size upfront. you're going have 2 passes on list: 1 sum strlen() of each string, allocate plus space separator , terminator, pass when concatenation.

generic answer

what seeing result of corruption in internal structures of glibc allocator. when allocating or freeing dynamic memory, allocator has manage memory reserved os and, depending on action requested you, find new chunk hand out, sort freed chunk list of can hand out later again, or give memory operating system. these error messages show data structures uses manage functionality corrupted.

these errors mean of code has modified memory not given use, invoking undefined behaviour. result of overwriting memory quite bit earlier in program, , totally possible error not lie in frobnicate() function.

yes, means error can anywhere in program or 3rd party libraries use.

this not question stack overflow. unless have simple reproduction of problem, community may unable much. cause of error can anywhere in code (and not in function error spotted), , may in code cannot see. stack overflow not collaborative debugging site. when can find flaw in code, unlikely specific question ever future visitor.

common causes

• use after free. have freed/deleted memory , writing afterwards, overwriting structures glibc needs bookkeeping.
• off-by-n error. writing n bytes after allocated chunk unallocated memory glibc uses internally bookkeeping.
• uninitialized pointers. not initializing pointer. coincidence points memory reserved glibc not allocated program , write it.
• allocating wrong amount of space. can because wrote long *data = malloc(number * 4) instead of long *data = malloc(number * sizeof(long)); or (better) long *data = malloc(number * sizeof(*data));. there many other ways size calculation wrong. common 1 forget account null terminator character @ end of string: char *copy = malloc(strlen(str)); instead of char *copy = malloc(strlen(str)+1);.

what need roll sleeves , debug problem

there no simple answer for, or fix. no single syntactical construct using wrong. cause of bug can come in literally thousands of varieties.

tools

• valgrind tool created purpose of finding kinds of errors. if can't find make sure using latest version, , trying out included exp-sgcheck tool. if running multithreaded code, cause might related race condition might want try included race condition checkers drd , helgrind more insight. @ point of writing this, valgrind supports following platforms:
  • x86/linux,
  • amd64/linux,
  • arm/linux,
  • ppc32/linux,
  • ppc64/linux,
  • s390x/linux,
  • mips32/linux,
  • mips64/linux,
  • arm/android (2.3.x , later),
  • x86/android (4.0 , later),
  • x86/darwin ,
  • amd64/darwin (mac os x 10.7, limited support 10.8).
• purify similar tool valgrind, commercial , aimed @ different set of platforms.
• addresssanitizer similar tool, integrated compiler toolchain (gcc , clang).
• efence drop in allocator replacement try crash program earlier, can find out normal debugger write invalid memory happened.
• dmalloc library similar purpose efence.

needing more assistance

if can't solve problem using 1 these tools, should try create mcve (how create minimal, complete, , verifiable example?) or, equivalently, sscce (short, self contained, correct (compilable), example).

remember work on copy of code because creating mcve requires ruthlessly remove code not reproduce problem. using vcs (version control system) assist idea; can record intermediate stages in reducing problem minimum. might new throw-away repository reducing problem manageable size.

with modular design code, should relatively easy create mcve. maybe have unit test better suited fed 1 of above tools. might want create 1 can later serve regression test bug.