free( ) issue

In my current program, I'm using two malloced arrays:

Code:

  check_start = malloc( sizeof( int ) * num_checks );
  assert( check_start != NULL );
  check_dir = malloc( sizeof( int ) * num_checks );
  assert( check_dir != NULL );

When I free check_dir, it works properly, but when I try to free check_start, I get the following error message:

Code:

free(): invalid pointer 0x804a8d0!

I've checked, and check_start is still pointing to the same address that it was when it was malloced.

Was that the only memory you allocated?

What sort of loops did you use to access the ints within those malloc'ed blocks of memory.

My guess is, you trashed the malloc memory pool elsewhere, and now you're paying for it.

>>Was that the only memory you allocated?
Yes.

>>What sort of loops did you use to access the ints within those malloc'ed blocks of memory.
Just simple for loops. I've double-checked and I'm not going out-of-bounds anywhere.

Also, if I change the order of my mallocs, it seems that the first chunk to be allocated is the one which can't be freed.

Paste OS/Compiler and a sample program which crashes.

I'm using Linux/GCC, and I've narrowed it down to this function:

Code:

int run_ai( void )
{
  
  int num_checks = 3 * BOARDSIZE * BOARDSIZE + 3 * BOARDSIZE + 4;
  int cur_cell, cur_count, cur_check, cur_type, max_cell = 0, max_cell_count = 0, rand_cell;

  for( cur_cell = 0; cur_cell < get_cell_number( BOARDSIZE, BOARDSIZE, BOARDSIZE ); ++cur_cell )
    {
      
      weight[ cur_cell ] = 0;
      
    }

  for( cur_check = 0; cur_check < num_checks; ++cur_check )
    {
      
      cur_count = 0;
      cur_type = CELL_EMPTY;
      for( cur_cell = check_start[ cur_check ]; cur_cell < check_start[ cur_check ] + BOARDSIZE * check_dir[ cur_check ]; cur_cell += check_dir[ cur_check ] )
	{
	  
	  if( board[ cur_cell ] == cur_type || board[ cur_cell ] == CELL_EMPTY || cur_type == CELL_EMPTY )
	    {
	      
	      cur_type = ( board[ cur_cell ] == CELL_EMPTY ? cur_type : board[ cur_cell ] );
	      cur_count += ( board[ cur_cell ] == CELL_EMPTY ? 0 : 1 );
	      
	    }
	  else
	    {
	      
	      cur_count = -1;
	      break;
	      
	    } 
	  
	}

      if( cur_count != -1 )
	{
	  
	  switch( cur_type )
	    {
	      
	    case CELL_EMPTY:
	      
	      cur_count *= MULT_EMPTY;
	      cur_count += BONUS_EMPTY;
	      if( EXP_EMPTY )
		cur_count *= cur_count;
	      break;
	      
	    case CELL_P1:

	      cur_count *= MULT_ENEMY;
	      cur_count += BONUS_ENEMY;
	      if( EXP_ENEMY )
		cur_count *= cur_count;
	      break;
	      
	    case CELL_P2:
	      
	      cur_count *= MULT_SELF;
	      cur_count += BONUS_SELF;
	      if( EXP_SELF )
		cur_count *= cur_count;
	      break;
	      
	    }

	  if( moves_made == 0 )
	    {
	      
	      cur_count = 1;
	      
	    }
	  
	  for( cur_cell = check_start[ cur_check ]; cur_cell < check_start[ cur_check ] + BOARDSIZE * check_dir[ cur_check ]; cur_cell += check_dir[ cur_check ] )
	    {

	      weight[ cur_cell ] += ( board[ cur_cell ] == CELL_EMPTY ? cur_count : 0 );
	      
	    }
	  
	}
      
    }

  for( cur_cell = 0; cur_cell < get_cell_number( BOARDSIZE, BOARDSIZE, BOARDSIZE ); ++cur_cell )
    {
      
      if( weight[ cur_cell ] > weight[ max_cell ] )
	{
	  
	  max_cell = cur_cell;
	  max_cell_count = 1;
	  
	}
      else if( weight[ cur_cell ] == weight[ max_cell ] )
	{
	  
	  ++max_cell_count;
	  
	}
      
    }

  rand_cell = rand( ) % max_cell_count;

  max_cell_count = 0;
  for( cur_cell = 0; max_cell_count <= rand_cell; ++cur_cell )
    {
      
      if( weight[ cur_cell ] == weight[ max_cell ] )
	{
	  
	  ++max_cell_count;
	  max_cell = cur_cell;
	  
	}
      
    }
  
  return max_cell;
  
}

Alright, I fixed it.

>>get_cell_number( BOARDSIZE, BOARDSIZE, BOARDSIZE )
I forgot that it was zero-based counting, so once I changed those to BOARDSIZE - 1, it works fine. Heh.

Since you didn't post something I could run, you'll have to do it

Run with a memory debugger
gcc -g prog.c -lefence
Run the program inside the debugger, and hopefully electric fence will spot the array overstep and drop you into the debugger at the offending line of code.

Methinks you missed the post I made just above yours. It's fixed.