Memory problem using malloc and free

[zanyspydude]

Hello,

I'm writing the great shell repacement program. I am having a problem in that i get this error:

-bash-3.1$ ./shell
% hi htere
hiLooking in /usr/lib/qt-3.3/bin trying to find hi
Looking in /usr/place/bin trying to find hi
Looking in /usr/local/bin trying to find hi
Looking in /bin trying to find hi
Looking in /usr/bin trying to find hi
Error hi was not found.
htereLooking in /usr/lib/qt-3.3/bin trying to find htere
Looking in /usr/place/bin trying to find htere
*** glibc detected *** ./shell: free(): invalid next size (fast): 0x086f5010 ***
======= Backtrace: =========
/lib/libc.so.6[0x4179df7d]
/lib/libc.so.6(cfree+0x90)[0x417a15d0]
./shell[0x8048826]
./shell[0x804894a]
/lib/libc.so.6(__libc_start_main+0xdc)[0x4174ddec]
./shell[0x80485b1]
======= Memory map: ========
[stack]
Aborted

i trace the error to this section of my code

char *lookupPath(char *name)
{
  int counter = 0;
	while (dirs[counter] != NULL && counter < MAXPATHS)
	{    
		printf("Looking in %s trying to find %s\n"
		  , dirs[counter], name);

		if(name != NULL && name[0]  == '/')
		{
			if( access(name, X_OK) == 0 )
				return name;
		}
		else 
		{	  
		  char* pName = (char*) malloc (strlen(name)+strlen(dirs[counter]+strlen("/")+1));
		  sprintf(pName, "%s/%s", dirs[counter], name);
		  if(access(pName, X_OK) == 0)
		    return pName;
		  free(pName);
		}
		counter++;
	}
	printf("Error %s was not found.\n", name);
	return NULL;
}

I need to be freeing the memory of pName, but i'm returning the pointer. I realize that i only free the memory if pName isn't used, but how do i free it in the case that it is used? In case i'm wrong about where the error is, the rest of my code is below.

edit: removed full code. Thanks for looking!

[brewbuck]

I need to be freeing the memory of pName, but i'm returning the pointer. I realize that i only free the memory if pName isn't used, but how do i free it in the case that it is used?

Whoever called lookupPath() is going to have to free it.

I don't see anything wrong with the way you use memory in the lookupPath() function, so the memory corruption must be happening somewhere else. Or, you are double-freeing a pointer, or freeing a bad pointer.

EDIT: Actually I see the problem.

char* pName = (char*) malloc (strlen(name)+strlen(dirs[counter]+strlen("/")+1));

Your parentheses are not in the right places. You want:

char* pName = (char*) malloc (strlen(name)+strlen(dirs[counter])+strlen("/")+1);

[zanyspydude]

thank you SOOOO much for your help. I never would have seen it