*** glibc detected *** a.out: realloc()

[msshapira]

hi,
the following fuction work fine under windows. it allocation a new cell to a pointer set to NULL at begging of program.
Running on unix, the program works fine for the first 5 inputs of "months", but then i get this error:
*** glibc detected *** a.out: realloc()
the rest of the error attached after the code. No idea how debug this, as it works fine under windows....

int* AddMonth(int* monthList,int* numOfMonths,int monthNum)
{
	int i=0;
	
	//allocate more mem
	monthList=(int*)realloc(monthList,(*numOfMonths+1)*sizeof(int));/*this is where is crashes!!!*/
	
	//find place for new month
	if (*numOfMonths!=0)
	{
		while (monthList[i]<monthNum && i<*numOfMonths)
			i++;

		//add month to respective place
		MoveRight(monthList,i,*numOfMonths+1);
	
	}
	//add value
	monthList[i]=monthNum;
	
	//increase month counter
	(*numOfMonths)++;


	return monthList;
}

the error i get is:

*** glibc detected *** a.out: realloc(): invalid next size: 0x000000000a5f9010 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3443871e0b]
/lib64/libc.so.6(realloc+0x124)[0x3443872ce4]
a.out[0x4006be]
a.out[0x4013db]
a.out[0x4020e4]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x344381d8a4]
a.out[0x4005d9]
======= Memory map: ========
00400000-00403000 r-xp 00000000 00:20 115039                             /a/filesrv/export/y2009/shapirm5/ver2/a.out
00602000-00603000 rw-p 00002000 00:20 115039                             /a/filesrv/export/y2009/shapirm5/ver2/a.out
0a5f9000-0a61a000 rw-p 0a5f9000 00:00 0 
3442800000-344281a000 r-xp 00000000 fd:00 5701930                        /lib64/ld-2.5.so
3442a19000-3442a1a000 r--p 00019000 fd:00 5701930                        /lib64/ld-2.5.so
3442a1a000-3442a1b000 rw-p 0001a000 fd:00 5701930                        /lib64/ld-2.5.so
3443800000-3443946000 r-xp 00000000 fd:00 5701931                        /lib64/libc-2.5.so
3443946000-3443b46000 ---p 00146000 fd:00 5701931                        /lib64/libc-2.5.so
3443b46000-3443b4a000 r--p 00146000 fd:00 5701931                        /lib64/libc-2.5.so
3443b4a000-3443b4b000 rw-p 0014a000 fd:00 5701931                        /lib64/libc-2.5.so
3443b4b000-3443b50000 rw-p 3443b4b000 00:00 0 
3447400000-344740d000 r-xp 00000000 fd:00 5701936                        /lib64/libgcc_s-4.1.2-20070626.so.1
344740d000-344760d000 ---p 0000d000 fd:00 5701936                        /lib64/libgcc_s-4.1.2-20070626.so.1
344760d000-344760e000 rw-p 0000d000 fd:00 5701936                        /lib64/libgcc_s-4.1.2-20070626.so.1
2b449ce54000-2b449ce57000 rw-p 2b449ce54000 00:00 0 
2b449ce94000-2b449ce96000 rw-p 2b449ce94000 00:00 0 
2b44a0000000-2b44a0021000 rw-p 2b44a0000000 00:00 0 
2b44a0021000-2b44a4000000 ---p 2b44a0021000 00:00 0 
7fff0dc41000-7fff0dc56000 rw-p 7fff0dc41000 00:00 0                      [stack]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0                  [vdso]
Abort (core dumped)

[matsp]

Problem is probably not in this code, but somewhere else that you are going over the limit - probably the memory allocated just before monthList.

--
Mats

[msshapira]

this is the first allocation in the program.
it runs fine for the first 5 allocations, the second i add the sixth alloc, i get the error,

[matsp]

So what does MoveRight do?

Chances are that you are going over the edge in there.

I would also do this as a for-loop:

		while (monthList[i]<monthNum && i<*numOfMonths)
			i++;

Like this:

		for (i = 0; monthList[i]<monthNum && i<*numOfMonths; i++);

--
Mats

[msshapira]

void MoveRight(int* arr,int startPoint,int size)
{
	/*loop get parameter from main and from startPoint till current 
	end off array move data one step right*/
	for (; size>startPoint; size--)
		arr[size]=arr[size-1];
}

[matsp]

Ok, so you call MoveRight with

MoveRight(monthList,i,*numOfMonths+1);

Then

	for (; size>startPoint; size--)
		arr[size]=arr[size-1];

will access [*numOfMonths+1], and you only have numOfMonths+1 elements - you are stepping over the edge [by one]. Remember, an n-element array [or memory allocation] has elements from 0..(n-1).

It just so HAPPENS to work for the smaller sizes because the realloc code is overallocating by a few bytes [and probably not even changing the block you are "reallocing".

--
Mats

[msshapira]

wow, you're right....
sometimes one feels rather stupid

btw
is there a difference between <stdlib.h> and <malloc.h>?

[matsp]

wow, you're right....
sometimes one feels rather stupid

btw
is there a difference between <stdlib.h> and <malloc.h>?

Yes, malloc.h is an old, non-standard header file, stdlib.h is "modern" standard.

--
Mats

[matsp]

By the way, is this really a good solution for the problem? It appears that you are calling realloc for an expansion of 4 bytes (the size of integer) - it seeems like a better approach would be to have a structure that holds the actual size and the max size, and when the actual size is too small, extend the max size by doubling it. Calls to realloc are fairly expensive.

--
Mats

[msshapira]

understood, but this is an assignmennt in which we can not user structs, it's a pointer practice...