Heap Corruption Detected -- Malloc issues

Hi I wrote a program that takes a string of words and reverses the order of the words: String : two words ----> words two

The program seems to do what I intended but crashes right after with a HEAP CORRUPTION DETECTED error.

Code:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void reverseWord(char *string, int size);

int main(void){
	int size;
	char *string = "Two words";

	size = (int)strlen(string);

	reverseWord(string, size);

	return 0;
}
void reverseWord(char *string, int size){
	
	char *buffer;
	int currentPos, endWord, startWord, bufferWrite = 0;

	buffer = (char *) malloc(size);

	currentPos = size - 1;

	while(currentPos >= 0){
		if(string[currentPos] == ' '){
			buffer[bufferWrite++] = string[currentPos];
			currentPos--;
		}
		else if(string[currentPos] != ' '){
			endWord = currentPos;
			while(currentPos >= 0 && string[currentPos] != ' '){
				currentPos--;
			}
			startWord = currentPos + 1;
			while( startWord <= endWord ){
				buffer[bufferWrite++] = string[startWord++];
			}
		}
	}
	buffer[bufferWrite] = '\0';
	printf("%s\n", buffer);

	free(buffer);	
}

Im certain it has something to do with malloc but I am not sure.
What can I do to fix this? Thanks!

You need strlen(s)+1 chars to store all the characters AND the \0 which follows.

Originally Posted by Salem

You need strlen(s)+1 chars to store all the characters AND the \0 which follows.

woot! thanks Salem. Works fine without crashes now.

I have a question though. When I do

Code:

	buffer = (char *) malloc(size+1);

	printf("%d\n", strlen(buffer));

for the string "two words", it returns 14. Shouldn't it return 10?

Did you bother to put anything in buffer before you call strlen? If there doesn't happen to be a string terminator in buffer by pure chance, then strlen will keep reading until it finds one. (The fact that it only goes four extra bytes makes you lucky indeed.)

Originally Posted by tabstop

Did you bother to put anything in buffer before you call strlen? If there doesn't happen to be a string terminator in buffer by pure chance, then strlen will keep reading until it finds one. (The fact that it only goes four extra bytes makes you lucky indeed.)

ah, I understand now. Thanks!