Thread: malloc() pointer error

Hi there!

I'm just dealing with a very old piece of code from 1999. It builds fine, but after I run it, I receive the following error message:

pentland(2650) malloc: *** error for object 0x10036d: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug

I know there is a dereferencing issue somewhere, but I have no idea where to look for the problem (since no line reference is provided).

The code is available online.

In order to reproduce the error, proceed in the following manner:
1) Run project
2) Use the following input parameters:

Enter filename for the input image: vase001_128.ucf

Enter the Output filename : depth.txt

Enter the minimum and maximum depth for rescale:

Minimum : -10e10
Maximum : 10e10

Enter the Light Source x y z 0 0 1

Here is the file excerpt which causes the error:

Code:

#include <sys/time.h>
#include <sys/resource.h>
#include <stdio.h>
#include <math.h>
#include <string.h>
#include "../util/ImageTools.h"
#include "../util/UCFReadPic.c"

#define SWAP(a,b) tempr = (a);(a) = (b);(b) = tempr
#define NDIM 2      /* 2D transform */

float         MAX2,MIN2,*real,*imag,pi=3.1415926535;
float         minusone;
float         a,ao,*frequency1(),*frequency() ;
float         *MI,*Magnitude();
float         lx,ly,lz,tilt,slant;
int          size,row,max,max2, *tpic,*cospic,*sinpic;
int           CT=0,BT;
float         *freq,*freq1,B;
FILE          *file,*outfile;
PIC           image,mypic,resultpic;
char          OutFile[66];

typedef struct
{
    int type;
    unsigned int    maxX,
            maxY;
    float    *image;
}    PIC2;

PIC2 F;


main()
{
int x,y,s;
struct rusage rusage;
long bts,btm,ets,etm;


 ReadImage();

 printf("\nEnter the minimum and maximum depth for rescale:\n");
 printf("\nMinimum : ");
 scanf("%f",&MIN2);
 printf("Maximum : ");
 scanf("%f",&MAX2);

 printf("\nEnter the Light Source  x y z: ");
 scanf("%f %f %f",&lx,&ly,&lz);
 if(lx == 0.0 && ly == 0.0) lx = ly = 0.001;

 max = max2 = image.maxX;
 Create_memory();

getrusage(0,&rusage);
bts = rusage.ru_utime.tv_sec;
btm = rusage.ru_utime.tv_usec;

 FFT_mod();

getrusage(0,&rusage);
ets = rusage.ru_utime.tv_sec;
etm = rusage.ru_utime.tv_usec;

printf("\n %ld sec.  %ld usec. \n",ets-bts,etm-btm);

/* Scale the depth map */
 Normalize(F,image);

/* Output the depth */
 outfile = fopen(OutFile,"w");
 for (y=0; y<max; y++)
  for (x=0; x<max; x++)
  {
   s = y*max + x;
   fprintf(outfile,"%f\n",F.image[s]);
  }
 fclose(outfile);

}/* end of main */


FFT_mod()
{
float H,H2,low,high,uj;
float PH,ss,sd;
float f2,f,thet;
float costilt,sintilt,sinslant;
float fl=1;
int go,x,y,z,s,size;
float w1,w2,OK,p,q,th;
float B2,sx,ys,zs,BIG=0,SMALL=1,D,LP,t1,t2,t3;
char ch;

size = max*max;

CtoF(F,image);

FFT(F,real,imag);

for (y=0; y<max; y++)
for (x=0; x<max; x++) {
  s = y*max + x;
  if (y < 2 || y > max-2 || x < 2 || x > max-2)
  {
    real[s] = 0;
    imag[s] = 0;
  }
  }


freq = frequency(max,fl);
MI = (float *)(malloc(max*max*sizeof(float)));
Magnitude2(MI);


D = sqrt(lx*lx + ly*ly + lz*lz);
lx = lx/D + .0001;
ly = ly/D;
lz = lz/D;

tilt = atan2(ly,lx+.0001);
slant = acos(lz);


for (x=0; x<image.maxX*image.maxX;x++) image.image[x] = 0;

costilt = cos(tilt);
sintilt= sin(tilt);
sinslant =  sin(slant);
t3 = (float)(max - 1);
freq[max/2] = freq[max/2-1]/2;

for (y=0; y<max; y++) {
for (x=0; x<max; x++) {

       w2 = freq[x];
       w1 = freq[y];

       f = sqrt (w1 *w1 + w2 * w2);

    if (f > BIG)
        BIG = f;
    if (f < SMALL)
        SMALL = f;

        if (w2 == 0)
          w2 =.001;

       thet = atan2(w1,w2);

       if (thet < 0)
        thet = 2*pi + thet;

       s = (y*max)+x;


       if (cos(tilt-thet) < 0)
       sd = -.65;
       else sd = 0.65;
       p = cos(thet);
       q = sin(thet);
       BIG = sqrt(p*p + q*q + 1*1);

       /* Pentlands */
       H = (a*a + f*f)/(2.0*ao*a + (1-ao)*(a*a+f*f));
       H2 = (a*a )/(2.0*ao*a + (1-ao)*(a*a));
          B= 2 * pi * (f) * sinslant * (sd + w2*lx + w1*ly);

             if ((p*lx + q*ly)>0.0  )
             p =  (imag[s]/B) ;
             q = (-real[s]/B) ;

        imag[s] =  q;
            real[s] = p;


}
}

for (y=0; y<max; y++)
for (x=0; x<max; x++) {
  s = y*max + x;
  if (y < 2 || y > max-2 || x < 2 || x > max-2)
  {
  real[s] =0;
  imag[s] = 0;
  }
}

invfourier(F,real,imag);

}


CtoF(F,frame)
PIC2 F;
PIC frame;
{
int s,x,y,z;

for (y=0; y<max; y++)
for (x=0; x<max; x++) {
  s = y*max + x;

  if(frame.image[s])
  F.image[s] = ((float)frame.image[s]);
  else F.image[s] =0;
  }
  }


Normalize(F,frame)
PIC2 F;
PIC frame;
{
float low,high;
int s,x,y,z;



low = 255000000;
high = -25000000;
for (y=0; y<max; y++)
    for (x=0; x<max; x++)
    {
        if (low > F.image[x+y*max]) low = F.image[x+y*max];
        if (high < F.image[x+y*max]) high = F.image[x+y*max];
    }


for (y=0; y<max; y++)
    for (x=0; x<max; x++)
      F.image[y*max+x]=((F.image[(y)*max+(x)]-low) * (MAX2-MIN2)/(high-low) + MIN2);

 }

float *vector(nl,nh)
int nl,nh;
{
 float *v;

 v = (float *)malloc((unsigned) (nh-nl+1)*sizeof(float));
 if (!v) {
    printf("error in vector() \n");
    exit(-3);
  }
  return v-nl;
}

int *ivector(nl,nh)
int nl,nh;
{
 int *v;

 v = (int *) malloc((unsigned) (nh-nl+1)*sizeof(int));
 if (!v) {
    printf("error in ivector() \n");
    exit(-2);
 }
 return v-nl;
}

free_vector(v,nl,nh)
float *v;
int nl,nh;
{
 free((char*) (v+nl));
}

free_ivector(v,nl,nh)
int v,nl,nh;
{
 free((char*) (v+nl));
}

  /*     This procedure computes the inverse fourier transform          */

invfourier(ipic,real,imag)
PIC2 ipic;
float *real,*imag;
{
 float tempf,HIST[1000];
 float tr1,trd;
 float *data,*addr,tr;
 int uz,zu,TEMP;
 float SMALL=255,SMALL1,BIG=0,BIG1;
 int x,y,i,isign,j,k,l,ll,ndum,*nn,addri,size;
 unsigned char *addrc;

 nn = ivector(1,NDIM);
 data = vector(1,2*ipic.maxX*ipic.maxY);
 nn[1] = ipic.maxX;
 nn[2] = ipic.maxY;
 isign = (0-1);                         /* perform inverse fourier transform */
 for (y=1;y<=ipic.maxY;y++)
    for (x=1;x<=ipic.maxX;x++) {
    l = x + ((y-1)*ipic.maxX);
    ll = 2*l-1;
    addri = (x-1) +((y-1)*ipic.maxX);
    data[ll] = real[addri];
    data[ll+1] = imag[addri];
    }
 fourn(data,nn,NDIM,isign);


 for (y=1;y<=ipic.maxY;y++)
    for (x=1;x<=ipic.maxX;x++) {
    l = x + ((y-1)*ipic.maxX);
    ll = 2*l-1;
    addri = (y-1) + ((x-1)*ipic.maxY);

    trd = (float) (x+y-2.0);
        tr1 = pow(minusone,trd);
        data[ll] = (float) (tr1* data[ll]);
    tempf = data[ll] / (float) (mypic.maxX);


        ipic.image[addri] = tempf;
     }




     free_ivector(nn,1,NDIM);
     free_vector(data,1,2*ipic.maxX*ipic.maxY);
}

FFT(ipic,Real,Imag)
PIC2 ipic;
float *Real,*Imag;
{
 FILE *fp;
 char Ifile[80], str[40];
 int size;
 float K;

 minusone = (0-1);
 mypic.type = 0;
 mypic.maxX = ipic.maxX;
 mypic.maxY = ipic.maxY;
 size = ipic.maxX * ipic.maxY;
 /*
 Real = vector(0,size-1);
 Imag = vector(0,size-1);
*/
 fourier(ipic,Real,Imag);

    /* call fourier, returns real+imag*/

 resultpic.image = (unsigned char *) malloc(mypic.maxX*mypic.maxY);
 resultpic.type = mypic.type;
 resultpic.maxX = mypic.maxX;
 resultpic.maxY = mypic.maxY;
}


  /* This procedure prepares the original image data for sending to the  */
  /* actual fourier (fourn) procedure. The image data is placed in the   */
  /* real part, and the imaginary part is left blank or initialized. The */
  /* result after calling fourn is in both the real and imaginary parts. */

fourier(ipic,real,imag)
PIC2 ipic;
float *real,*imag;
{
 float tr1,trd;
 float *data,*addr,tr;
 int x,y,i,isign,j,k,l,ll,ndum,*nn,addri,size;
 unsigned char *addrc;

 nn = ivector(1,NDIM);
 data = vector(1,2*ipic.maxX*ipic.maxY);
 nn[1] = ipic.maxX;
 nn[2] = ipic.maxY;
 for (k=1;k<=ipic.maxX;k++)
    for (j=1;j<=ipic.maxY;j++) {
    l = k+((j-1)*ipic.maxY);
    ll = 2*l-1;
    tr = (float) ipic.image[(j-1)+(ipic.maxX*(k-1))];
    trd = (float) (k+j-2.0);

      /* multiply by k+j to power -1 so that the fourier image is centered */

        tr1 = pow(minusone,trd);
    data[ll] = (float) (tr1* (ipic.image[(j-1)+(ipic.maxX*(k-1))]));
    data[ll+1] = ll+1;
    }
 isign = 1;     /* perform forward fourier transform */
 fourn(data,nn,NDIM,isign);
 for (y=1;y<=ipic.maxY;y++)
    for(x=1;x<=ipic.maxX;x++) {
        l = x + ((y-1)*ipic.maxX);
        ll = 2*l-1;
        addri = (x-1) + ((y-1)*ipic.maxX);
        *(real + addri) = data[ll]/(float) mypic.maxX;
        *(imag + addri) = data[ll+1]/(float) mypic.maxX;
    }
 free_ivector(nn,1,NDIM);
 free_vector(data,1,2*ipic.maxX*ipic.maxY);
}

  /* This procedure replaces data by its ndim (ndimensional) discrete
     Fourier transform if isign = 1. nn[1..ndim] is an integer array containing
     the lengths of each dimension (number of complex values), which must
     be powers of 2. data is a real array of length twice the product of these
     lengths, in which data are stored as in a multidimensional complex array:
     real and imaginary parts of each element are in consecutive locations, and
     the rightmost index of the array increases most rapidly as you proceed
     along data. For a 2D array, this means you store by rows. If isign = -1
     then data is replaced by the INVERSE transform times the product of the
     lengths of all dimensions.
 */

fourn(data,nn,ndim,isign)
float data[];
int nn[],ndim,isign;
{
 float theta,wi,wpi,wpr,wr,wtemp;
 float tempi,tempr;
 int i1,i2,i3,i2rev,i3rev,ip1,ip2,ip3,ifp1,ifp2,x;
 int ibit,idim,k1,k2,n,nprev,nrem,ntot;

  ntot = 1;
  for (idim=1;idim<=ndim;idim++) ntot *= nn[idim];
  nprev = 1;
  for (idim=ndim;idim >=1;idim--) {
     n = nn[idim];
     nrem = ntot/(n*nprev);
     ip1 = nprev << 1;
     ip2 = ip1*n;
     ip3 = ip2*nrem;
     i2rev = 1;
     for (i2=1;i2<=ip2;i2+=ip1) {
     if (i2 < i2rev) {
             for (i1=i2;i1<=i2+ip1-2;i1+=2) {
         for (i3=i1;i3<=ip3;i3+=ip2) {
                    i3rev = i2rev + i3 - i2;
            SWAP(data[i3],data[i3rev]);
            SWAP(data[i3+1],data[i3rev+1]);
                 }
             }
         }
         ibit = ip2 >> 1;
     while ((ibit >= ip1) && (i2rev > ibit)) {
         i2rev -= ibit;
         ibit >>= 1;
         }
         i2rev += ibit;
    }
    ifp1 = ip1;
    while (ifp1 < ip2) {
    ifp2 = ifp1 << 1;
    theta = isign * 6.28318530717959/(ifp2/ip1);
    wtemp= sin(0.5*theta);
    wpr = -2.0*wtemp*wtemp;
    wpi = sin(theta);
    wr = 1.0;
    wi = 0.0;
    for (i3=1;i3<=ifp1;i3+=ip1) {
            for (i1 = i3;i1<=i3+ip1-2;i1+=2) {
           for (i2=i1;i2<=ip3;i2+=ifp2) {
                   k1 = i2;
           k2 = k1 + ifp1;
           tempr = wr*data[k2] - wi*data[k2+1];
           tempi = wr*data[k2+1] + wi*data[k2];
           data[k2] = data[k1] - tempr;
           data[k2+1] = data[k1+1] - tempi;
           data[k1] += tempr;
           data[k1+1] += tempi;
                }
            }
            wr = (wtemp=wr)*wpr-wi*wpi+wr;
        wi = wi*wpr+wtemp*wpi+wi;
         }
         ifp1 = ifp2;
    }
    nprev *= n;
 }
}

Magnitude2(MI)
float *MI;
{
 int y,x;

 y = max*max;
 for (x=0;x<y;x++)
 {
 MI[x] = sqrt((real[x]*real[x]+imag[x]*imag[x]));
 if (MI[x] < 0)
    MI[x]=0;
    }
}


float *frequency(S,f)
int S;
float f;
{
 int M=1, x;
 float *v;

 v = (float *)malloc(S*sizeof(float));
 if (!v) {
     printf("error in freq() \n");
     exit(-3);
 }
 for (x=0; x<S/2; x++) {
     v[x] = (float) -.5+ (x/(S*f)) ;
     v[x+S/2] = (float) (x)/(S*f) ;
 }
 return v;
}

 /* this module reads in the image file */

ReadImage()
{

 char imagename[101];
 char fname[101];

 printf("\nEnter filename for the input image: ");
 scanf("%s",imagename);
 sprintf(fname, "../images/%s", imagename);

 if((file = fopen(fname,"r")) != NULL) image = UCFReadPic(file);
 else {
    printf("\nUNABLE TO OPEN THE FILE");
    exit(-1);
 }
 fclose(file);

 printf("\nEnter the Output filename : ");
 scanf("%s",OutFile);

// sprintf(outputfilename,"../depthmaps/%s_%d%d%d_tsai.txt", imagename, (int) Sx, (int) Sy, (int) Sz);
// printf("\nOutput depth map in %s!\n", outputfilename );


}


/* allocating space in the heap */

Create_memory()
{
 unsigned int s;

 s = max*max;

 imag = (float *)calloc(max2*max2,sizeof(float));
 if( imag == NULL) {
     printf(" SCRIPT TABLE ALLOCATION FAILURE! \n");
     exit(0);
}
 real = (float *)calloc(max2*max2,sizeof(float));
 if( real == NULL) {
     printf(" SCRIPT TABLE ALLOCATION FAILURE! \n");
     exit(0);
}
 F.image = (float *)calloc(max2*max2,sizeof(float));
 if( F.image == NULL) {
     printf(" SCRIPT TABLE ALLOCATION FAILURE! \n");
     exit(0);
}
    F.type = 0;
    F.maxX = max;
    F.maxY = max;

}

Well....
$ make
cc -g -o pentland pentland.c -lm
In file included from pentland.c:16:0:
../util/UCFReadPic.c: In function ‘UCFReadPic’:
../util/UCFReadPic.c:46:9: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
../util/UCFReadPic.c:50:26: warning: incompatible implicit declaration of built-in function ‘calloc’ [enabled by default]
../util/UCFReadPic.c:53:7: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c: In function ‘FFT_mod’:
pentland.c:124:16: warning: incompatible implicit declaration of built-in function ‘malloc’ [enabled by default]
pentland.c: In function ‘vector’:
pentland.c:254:15: warning: incompatible implicit declaration of built-in function ‘malloc’ [enabled by default]
pentland.c:257:5: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c: In function ‘ivector’:
pentland.c:267:14: warning: incompatible implicit declaration of built-in function ‘malloc’ [enabled by default]
pentland.c:270:5: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c: In function ‘free_vector’:
pentland.c:279:2: warning: incompatible implicit declaration of built-in function ‘free’ [enabled by default]
pentland.c: In function ‘free_ivector’:
pentland.c:285:2: warning: incompatible implicit declaration of built-in function ‘free’ [enabled by default]
pentland.c:285:7: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
pentland.c: In function ‘FFT’:
pentland.c:362:38: warning: incompatible implicit declaration of built-in function ‘malloc’ [enabled by default]
pentland.c: In function ‘frequency’:
pentland.c:515:15: warning: incompatible implicit declaration of built-in function ‘malloc’ [enabled by default]
pentland.c:518:6: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c: In function ‘ReadImage’:
pentland.c:542:5: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c: In function ‘Create_memory’:
pentland.c:564:18: warning: incompatible implicit declaration of built-in function ‘calloc’ [enabled by default]
pentland.c:567:6: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c:572:6: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]
pentland.c:577:6: warning: incompatible implicit declaration of built-in function ‘exit’ [enabled by default]

On 64-bit machines, casting a pointer to an int and back again will LOSE INFORMATION.

Code:

(gdb) print sizeof(int)
$1 = 4
(gdb) print sizeof(void*)
$2 = 8

Running it in GDB gives me
(gdb) where
#0 0x00007ffff77ed3a5 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff77f0b0b in __GI_abort () at abort.c:92
#2 0x00007ffff7826d63 in __libc_message (do_abort=2, fmt=0x7ffff7917e58 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff78316e6 in malloc_printerr (action=3, str=0x7ffff7914e6f "free(): invalid pointer", ptr=<optimized out>) at malloc.c:6283
#4 0x00007ffff78359cc in __GI___libc_free (mem=<optimized out>) at malloc.c:3738
#5 0x0000000000401c8d in free_ivector (v=6311948, nl=1, nh=2) at pentland.c:286
#6 0x000000000040237c in fourier (ipic=..., real=0x619270, imag=0x609260) at pentland.c:411
#7 0x000000000040202b in FFT (ipic=..., Real=0x619270, Imag=0x609260) at pentland.c:359
#8 0x00000000004010fe in FFT_mod () at pentland.c:111
#9 0x0000000000400eea in main () at pentland.c:71
(gdb) frame 5
#5 0x0000000000401c8d in free_ivector (v=6311948, nl=1, nh=2) at pentland.c:286
286 free((char*) (v+nl));
(gdb) list
282
283 free_ivector(v,nl,nh)
284 int v,nl,nh;
285
286 free((char*) (v+nl));
287
288
289 /* This procedure computes the inverse fourier transform */
290

Notice that free_ivector uses K&R notation.
This has been OBSOLETE since 1989!

The first thing to do would be to comb through the code and make proper prototypes for all the functions, and then fix whatever it starts complaining about.

Hey Salem!

Thanks a lot for going through the code!

I know it's very old, but I might be working on an extension of it, so I need to make it run.

I just googled the error and managed to remove the warning, by changing two int-declaration into intptr declarations and adding the appropriate header-file.
See Link.

Code:

free_vector(v,nl,nh)
float *v;
intptr_t nl,nh;
{
 free((char*) (v+nl));
}

free_ivector(v,nl,nh)
intptr_t v,nl,nh;
{
 free((char*) (v+nl));
}

The error has vanished, but when I run the code, I still get the exact same 'pointer being freed not allocated' error!
New code location

You would be better off removing the pointer cast (from all your code) and adding #include <stdlib.h> at the top. Since modern versions of free() accept a void pointer, the (char *) is unnecessary unless you are using truly ancient compilers.

Odds are, somewhere your code is freeing a pointer that has not been dynamically allocated. For example,

Code:

#include <stdlib.h>

int main()
{
      int *x = malloc(sizeof(int));

       /*   And in some other code so the relationship is not always easy to see ... */

      free(x + some+nonzero_value);
}

will sail past the compiler, but potentially cause the type of problem you are seeing.

The fact that your functions are receiving a pointer, adding a value to it, and then passing that to free() means you are probably doing exactly that. Changing the offsets to be of type intptr_t will not change a non-zero value of n1 to a zero value.

It is the programmer's responsibility to ensure the pointers passed to free() are the exact same pointers returned by malloc() (or realloc() or calloc()). And that such pointers are released exactly once.