SIGABRT upon free()

Hello all,

For some reason when I free(buffer) below, I always get a SIGABRT and I have no clue why. :(
Looking at the values buffer contains just before the free(), it has exactly what I'd expect,
just a few bytes worth of data, and num_bytes seems to have the correct amount. The original
malloc() returns a valid address, not NULL, so that seemed to work. Any ideas??

Code:

---


int ReceiveFeedback(comm_data_t* port, char *result, int *MPTR, int *timestamp)
{
  int      bytesReceivedSoFar = 0;  /* how many bytes we've read thus far */
  int      bufferSize = 1024;    /* size of buffer */
  int      select_value;        /* what select() returns */
  char      *buffer;              /* what we can grab from our port at each select iteration */
  char      *stringSoFar;        /* our total string built thus-far */
  int      num_bytes;            /* the number of bytes we read from our port */
  fd_set    watchset;            /* fd_set we want to watch for reading */
  struct timeval loopdelay;      /* str dictating how long select() should wait */
  int      junkInt;              /* garbage used to double-check sscanf */
  char      junkChar;            /* garbage used to double-check sscanf */
  const int bytesExpectedForSuccess = 40;  /* minimum bytes needed for success. stringSoFar value tested also */

  buffer = malloc (sizeof(char) * (2000));
  strcpy(buffer, "");

  stringSoFar = malloc (sizeof(char) * (30000));
  strcpy(stringSoFar, "");

  while (1)
  {
      strcpy(buffer, "");
      loopdelay.tv_sec = 5;  /* wait a long time before giving up */
      loopdelay.tv_usec = 0; /* must reset this for each call    */
      FD_ZERO(&watchset);    /* clear all bits in this set        */
      FD_SET(port->fd, &watchset);  /* watch our data instrument */

      /*  now keep reading data until we have our full menu */
      if ((select_value = select((port->fd)+1, &watchset, NULL, NULL, &loopdelay)) > 0)
      {
        /* all we're listening to is 1 port so no need for FD_ISSET */

        /* we got some data */
        num_bytes = read(port->fd, buffer, bufferSize);

        if (num_bytes > 0)
        {
            /* we read something! */
            /* take whatever we read this time and append it to what we've read over the past */
            buffer[num_bytes] = 0x00;
            bytesReceivedSoFar += num_bytes;
            strncat(stringSoFar, buffer, num_bytes);

            /* does what we've read contain our substring? */
            if (sscanf(stringSoFar, "%*[^A]A%i L+%i C%*c%*c%*c%c", &junkInt, MPTR, &junkChar) == 3)
            {
              /* we found our substring. see if there's enough data to send onward */
              if (bytesReceivedSoFar < bytesExpectedForSuccess)
              {
                  /* we found the end of the CR10's response, but we know we didn't get any meaningful data */
                  strcpy(result, "");
                  free (buffer);
                  free (stringSoFar);
                  return (-1);
              } /* end if */

              else
              {
                  /* we found the end and we have enough bytes to have meaningful data */
                  strcpy(result, stringSoFar);
                  free (buffer); /* ------------------------- ALWAYS CAUSES SIGABRT on free()???? --- */
                  free (stringSoFar);
                  return (1);
              } /* end else */

            } /* end if sscanf == 3 */

        } /* end if num_bytes > 0 */

      } /* end if select > 0 */

      else if (select_value == 0)
      {
        /* select returned 0, nothing more to ever read */
        strcpy(result, stringSoFar);
        free (buffer);
        free (stringSoFar);
        return (-2);
      } /* end else select == 0 */

      else
      {
        /* select returned negative value like EINTR so ignore */
        ;
      } /* end else */

  } /* end while */

  /* we should never get here */
  strcpy(result, stringSoFar);
  free (buffer);
  free (stringSoFar);
  return (-3);

} /* end ReceiveFeedback(...) */

---

Thanks for any help.

Code:

---

strcpy(buffer, "");

---

You should probably be memset-ting these.

You should provide debug lines and fflush the output of said lines before you call free() to see which one is crashing. (Or in fact, to be sure it is free that is actually crashing it.)

Is there a reason you need a 30K buffer?
Are you sure it is not NULL? I don't see you checking the return value of malloc any place.

Quzah.

Thanks for the great feedback. I'll give your suggestions a try and see if I can improve my code.