Random exclamation point at end of strings

Hey,
I did a Google search prior to registering and posting this question, and I found a post on this board with a similar problem. After following the advice in that thead, I still found myself facing the same problem.

I am writing a program that scans a directory of source code files and determines if there are any missing dependencies. The strange problem I am encountering, however, is that at a certain part of my program, an exclamation point is appended to some of the strings. This causes a problem later on, as the program determines that there is not an exact match and that the malformed string is a missing dependency.

After using numerous debug statements, I have narrowed the occurence of the problem to the following segment of code (I will include the whole function):

Code:

---

HashEntry *create_hash_entry(void *val)
{
  HashEntry *he;

//This is the problematic segment:
printf("debug:  val(before): %s\n", val);
  if((he = malloc(sizeof(HashEntry))) == NULL)
  {
      fprintf(stderr, "error: could not allocate space for HashEntry 'he'; function: create_hash_entry()\n");
      abort();
  }
printf("debug:  val(after): %s\n", val);
//End the problematic segment

  he->key = hash(val);
  he->value = val;
  he->next = NULL;

  return he;
}

---

Here are the first few lines of the output:

Code:

---

debug:  val(before): cde_transaction_change.h
debug:  val(after):  cde_transaction_change.h!
debug:  val(before): cde_transaction_delete.h
debug:  val(after):  cde_transaction_delete.h!
debug:  val(before): fl_tpl_retro_summ_recs.h
debug:  val(after):  fl_tpl_retro_summ_recs.h!

---

...and etcetera. The strange thing is that the ONLY strings which have an exclamation mark appended to them are exactly 24 characters long, with the ! making the 25th character(at val[24]).

I have no idea why this particular malloc() call seems to add the exclamation mark. Perhaps somone has encountered and conquered this problem before? I will continue to work on this, but any help is VERY MUCH appreciated!
Thanks!

Hmm... that's strange.

This can only mean you are corrupting the heap. Most likely you are under allocating when you allocate space for val, subsequently writing over some of the bookkeeping information of the allocator.
Check the other places you allocate and make sure they are large enough.

Just curious, but is the `sizeof(HashEntry)' 33?

Soma

The only thing I can think of is that the string val is not properly nul terminated in the first place. I can't see any other way where a malloc can corrupt an "unrelated" variable unless that variable overlaps something it shouldn't.

More likely, you forgot +1 when trying to allocate a string.
You know,
p = malloc( strlen(string) + 1 ); // +1 for the \0

The result is, part of your string is now in someone else's memory.

@phantomotap: This is a 64-bit system, so sizeof(HashEntry) in this case is 24: 8 bytes for the unsigned int 'key,' and 8 bytes each for the pointers to 'value' and 'next.'

@iMalc: I think that fixed the problem. Thanks! I found a function which was stripping off specific characters according to the indices at which they were found. Even though the amount of space allocated for the stripped string had the expected +1 for the terminator, the parsing/math leading up to it created an off-by-one error. So I simply added 2! Seems to have fixed the problem. Thanks!

Salem, that wouldn't explain his problem. He only malloced... whether over or under sized does not matter. He did not assign anything within that newly allocated memory. The string whose pointer is stacked got mysteriously stomped. So the malloc operation, somehow, changes a byte someplace. I still don't understand how that can happen unless the string was mal-allocated itself. Then some memory block overhead action within the malloc algorithm clobbered it.

Are you sure calling malloc doesn't trash anything?

Because malloc HAS to record some information about the new allocation so that it knows the memory is in use, and how much memory there is in order to free it.

++++++++????============

Where
+ is the block allocated for a string
? is the invisible header used by malloc for the hash entry
= is the memory for the hash entry

If the + string is overrun, THEN malloc is called to get a new block, then all the ? bytes are going to get written on, INCLUDING the \0 of the overrun string.