malloc calloc and free

I got the following weird error when trying to free a structure:

Code:

---

*** glibc detected *** receiver: free(): invalid next size (normal): 0x00000000010855b0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3bbba78228]
/lib64/libc.so.6(cfree+0x76)[0x3bbba7a866]
/lib64/libc.so.6(fclose+0x151)[0x3bbba68731]
receiver[0x400dce]
/lib64/libc.so.6(__libc_start_main+0xfa)[0x3bbba1e32a]
receiver[0x400a39]
======= Memory map: ========
00400000-00402000 r-xp 00000000 00:37 267920                            /p2/hh/project2/receiver
00601000-00602000 rw-p 00001000 00:37 267920                            /p2/hh/project2/receiver
01085000-010a6000 rw-p 01085000 00:00 0                                  [heap]
3bba800000-3bba81d000 r-xp 00000000 fd:01 1384464                        /lib64/ld-2.8.so
3bbaa1c000-3bbaa1d000 r--p 0001c000 fd:01 1384464                        /lib64/ld-2.8.so
3bbaa1d000-3bbaa1e000 rw-p 0001d000 fd:01 1384464                        /lib64/ld-2.8.so
3bbba00000-3bbbb62000 r-xp 00000000 fd:01 1384466                        /lib64/libc-2.8.so
3bbbb62000-3bbbd62000 ---p 00162000 fd:01 1384466                        /lib64/libc-2.8.so
3bbbd62000-3bbbd66000 r--p 00162000 fd:01 1384466                        /lib64/libc-2.8.so
3bbbd66000-3bbbd67000 rw-p 00166000 fd:01 1384466                        /lib64/libc-2.8.so
3bbbd67000-3bbbd6c000 rw-p 3bbbd67000 00:00 0
3ebe600000-3ebe616000 r-xp 00000000 fd:01 1384510                        /lib64/libgcc_s-4.3.0-20080428.so.1
3ebe616000-3ebe815000 ---p 00016000 fd:01 1384510                        /lib64/libgcc_s-4.3.0-20080428.so.1
3ebe815000-3ebe816000 rw-p 00015000 fd:01 1384510                        /lib64/libgcc_s-4.3.0-20080428.so.1
7f9570000000-7f9570021000 rw-p 7f9570000000 00:00 0
7f9570021000-7f9574000000 ---p 7f9570021000 00:00 0
7f957573e000-7f9575740000 rw-p 7f957573e000 00:00 0
7f9575765000-7f9575768000 rw-p 7f9575765000 00:00 0
7fff7d753000-7fff7d768000 rw-p 7ffffffea000 00:00 0                      [stack]
7fff7d7ff000-7fff7d800000 r-xp 7fff7d7ff000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

---

can anyone tell me why? if we call calloc then do we have to free it as well just like malloc

I'm unsure about your error, but definitely, you need to treat calloc'd memory, the same as malloc.
(and free it).

this is weird.. so any ideas on how to debug it?

It looks like your heap was corrupted from something. You can run memcheck (which is part of valgrind). It usually does a pretty good job with these sorts of problems.

Looks like you're trying to free something that has either been mangled by another *thing* in your program, or it's already been destroyed.

Can you set a pointer to that variable and watch it's value as you step through that portion of your program? If it goes to NULL it's been destroyed, if it never changes, then it's been mangled.

quite an off topic but say I have:

Frame* frame_ack = (Frame*) calloc(1, sizeof(Frame));

is that correct or should it be:

Frame* frame_ack = (Frame*) calloc(1, sizeof(Frame*));

The former looks like it should be correct.

Like bithub suggested, run it through memcheck. You may need to throw down a compiler switch to get a more specific location, but I kind of forget which.

I think this is where the problem is, but I don't see anything wrong here:

Code:

---

Frame* frame_ack = (Frame*) calloc(1, sizeof(Frame));
                  frame_ack->hdr.type = TYPE_ACK;
                  frame_ack->hdr.seq = (SeqNum) LFR+10;
                  frame_ack->hdr.size = (u_char) 0;
                  printf("\ntrying to send ACK for %d!\n", LFR);
                  flag = sendto(sock_fd,(void*)frame_ack, sizeof(Frame),0,(struct sockaddr *)&sin, sizeof(sin));
                  if (flag == -1){
                        perror("Error: Can't send the ACK to sender \n");
                        close(sock_fd);
                        exit(1);
                  }
                    printf("flag is %d frame sequence number is %d!\n", flag, frame->hdr.seq);
                  LAF = LFR + RWS;
                  free(frame_ack);

---

when I comment out free(frame_ack) it works... but I want to free it.. any reason why?

valgrind gave me these results:

Code:

---

==2367== Invalid write of size 1
==2367==    at 0x4A07FF4: memcpy (mc_replace_strmem.c:402)
==2367==    by 0x400F19: main (receiver.c:121)
==2367==  Address 0x4c332bb is not stack'd, malloc'd or (recently) free'd
==2367==
==2367== Invalid write of size 1
==2367==    at 0x4A07FFD: memcpy (mc_replace_strmem.c:402)
==2367==    by 0x400F19: main (receiver.c:121)
==2367==  Address 0x4c332ba is not stack'd, malloc'd or (recently) free'd
==2367==
==2367== Invalid write of size 1
==2367==    at 0x4A08007: memcpy (mc_replace_strmem.c:402)
==2367==    by 0x400F19: main (receiver.c:121)
==2367==  Address 0x4c332b9 is not stack'd, malloc'd or (recently) free'd
==2367==
==2367== Invalid write of size 1
==2367==    at 0x4A08011: memcpy (mc_replace_strmem.c:402)
==2367==    by 0x400F19: main (receiver.c:121)
==2367==  Address 0x4c332b8 is not stack'd, malloc'd or (recently) free'd
Header sequence is 1 and LFR+1 is 1!
==2367==
==2367== Invalid read of size 1
==2367==    at 0x3BBBA73C51: _IO_file_xsputn@@GLIBC_2.2.5 (in /lib64/libc-2.8.so)
==2367==    by 0x3BBBA69D27: fwrite (in /lib64/libc-2.8.so)
==2367==    by 0x400FB3: main (receiver.c:132)
==2367==  Address 0x4c332bb is not stack'd, malloc'd or (recently) free'd
==2367==
==2367== Invalid read of size 1
==2367==    at 0x3BBBA73C6D: _IO_file_xsputn@@GLIBC_2.2.5 (in /lib64/libc-2.8.so)
==2367==    by 0x3BBBA69D27: fwrite (in /lib64/libc-2.8.so)
==2367==    by 0x400FB3: main (receiver.c:132)
==2367==  Address 0x4c332ba is not stack'd, malloc'd or (recently) free'd
==2367==
==2367== Invalid read of size 1
==2367==    at 0x4A089D6: mempcpy (mc_replace_strmem.c:676)
==2367==    by 0x3BBBA73D0E: _IO_file_xsputn@@GLIBC_2.2.5 (in /lib64/libc-2.8.so)
==2367==    by 0x3BBBA69D27: fwrite (in /lib64/libc-2.8.so)
==2367==    by 0x400FB3: main (receiver.c:132)
==2367==  Address 0x4c331c0 is 0 bytes after a block of size 8 alloc'd
==2367==    at 0x4A05174: calloc (vg_replace_malloc.c:397)
==2367==    by 0x400EEE: main (receiver.c:120)
==2367==
==2367== Invalid read of size 1
==2367==    at 0x4A089C8: mempcpy (mc_replace_strmem.c:676)
==2367==    by 0x3BBBA73D0E: _IO_file_xsputn@@GLIBC_2.2.5 (in /lib64/libc-2.8.so)
==2367==    by 0x3BBBA69D27: fwrite (in /lib64/libc-2.8.so)
==2367==    by 0x400FB3: main (receiver.c:132)
==2367==  Address 0x4c331c1 is 1 bytes after a block of size 8 alloc'd
==2367==    at 0x4A05174: calloc (vg_replace_malloc.c:397)
==2367==    by 0x400EEE: main (receiver.c:120)
--2367-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--2367-- si_code=80;  Faulting address: 0x0;  sp: 0x402E8BE50

valgrind: the 'impossible' happened:
  Killed by fatal signal
==2367==    at 0x3802421D: vgPlain_arena_malloc (m_mallocfree.c:206)
==2367==    by 0x38002A75: vgMemCheck_new_block (mc_malloc_wrappers.c:195)
==2367==    by 0x38002CCD: vgMemCheck_calloc (mc_malloc_wrappers.c:270)
==2367==    by 0x380380B7: vgPlain_scheduler (scheduler.c:1277)
==2367==    by 0x38048E40: run_a_thread_NORETURN (syswrap-linux.c:89)

---

what am I doing wrong in my memcpy?

Code:

---

Frame** win_slots = (Frame**) calloc(RWS, sizeof(Frame*));
Frame* frame = (Frame*) calloc(1, sizeof(Frame));
win_slots[current_frame_index] = calloc(1, sizeof(Frame));
memcpy(win_slots[current_frame_index], frame, sizeof(Frame));

---

win_slots is just an array of Frame

Can you post the code in receiver.c from lines 110-140?

hmm.. I think the receiver.c is fixed now, it used to be:

win_slots[current_frame_index] = calloc(1, sizeof(Frame*));

but now I changed it to:

win_slots[current_frame_index] = calloc(1, sizeof(Frame));

I think that's where the problem is.. It doesn't give me that weird long error on the first page again.


But now I have a problem with the sender.c

it says:

==6195== Invalid read of size 1
==6195== at 0x4A07B24: strlen (mc_replace_strmem.c:242)
==6195== by 0x3BBBA4A56F: vfprintf (in /lib64/libc-2.8.so)
==6195== by 0x3BBBA51079: printf (in /lib64/libc-2.8.so)
==6195== by 0x401653: main (sender.c:193)
==6195== Address 0x4c35384 is 0 bytes after a block of size 260 alloc'd
==6195== at 0x4A05174: calloc (vg_replace_malloc.c:397)
==6195== by 0x4015FF: main (sender.c:190)

line 190 was just:
Frame* frame = (Frame*) calloc(1, sizeof(Frame));
line 193 was just:
printf("body is %s\n", frame->body);

and here's the struct Frame:

Code:

---

typedef struct Frame {
    FrameHdr        hdr;                /* Frame header */
    u_char        body[256];        /* Body */
} Frame;

---

Quote:

---

Originally Posted by -EquinoX-

I think this is where the problem is, but I don't see anything wrong here:

Code:

---

Frame* frame_ack = (Frame*) calloc(1, sizeof(Frame));
                  frame_ack->hdr.type = TYPE_ACK;
                  frame_ack->hdr.seq = (SeqNum) LFR+10;
                  frame_ack->hdr.size = (u_char) 0;
                  printf("\ntrying to send ACK for %d!\n", LFR);
                  flag = sendto(sock_fd,(void*)frame_ack, sizeof(Frame),0,(struct sockaddr *)&sin, sizeof(sin));
                  if (flag == -1){
                        perror("Error: Can't send the ACK to sender \n");
                        close(sock_fd);
                        exit(1);
                  }
                    printf("flag is %d frame sequence number is %d!\n", flag, frame->hdr.seq);
                  LAF = LFR + RWS;
                  free(frame_ack);

---

when I comment out free(frame_ack) it works... but I want to free it.. any reason why?

---

I have two questions about the line of code in red:

1) Shouldn't a pointer to the frame be calloc'd to the size of the frame pointer, instead of the size of the frame itself?

2) I thought it was incorrect to cast the return from calloc/malloc ? That it hid the error when you forgot to include stdlib.h?

and why do you want to malloc/free a variable which needs to be available only in one function? why not to make it simple automatic var?

Quote:

---

Originally Posted by Adak

1) Shouldn't a pointer to the frame be calloc'd to the size of the frame pointer, instead of the size of the frame itself?

---

No, the size specified should be the size of each object for which space is to be allocated.

Quote:

---

Originally Posted by Adak

2) I thought it was incorrect to cast the return from calloc/malloc ? That it hid the error when you forgot to include stdlib.h?

---

I think it is more a matter of bad practice than "incorrect", since it would be correct if the code is intended to be compilable as C++. However, I think that you may be right: a failure to #include <stdlib.h> could be the problem.

I think there's no problem with casting to the return value of malloc...

Quote:

---

Originally Posted by -EquinoX-

I think there's no problem with casting to the return value of malloc...

---

Usually, yes. Just to confirm: did you #include <stdlib.h>?

It looks like your string at u_char body[256]; was not NULL terminated.

Quote:

---

Originally Posted by Maz

It looks like your string at u_char body[256]; was not NULL terminated.

---

so u_char body[255] isn't null terminated? how can I make it to be NULL terminated without declaring it as a char?

Quote:

---

Originally Posted by -EquinoX-

so u_char body[255] isn't null terminated? how can I make it to be NULL terminated without declaring it as a char?

---

why it should be?

why it should be nul-terminated?
why it should be char to be nul-terminated?

-EquinoX-, please answer my question.

Quote:

---

Originally Posted by laserlight

-EquinoX-, please answer my question.

---

yes I did

Quote:

---

Originally Posted by vart

why it should be?

why it should be nul-terminated?
why it should be char to be nul-terminated?

---

because I want to print it out

Quote:

---

Originally Posted by -EquinoX-

because I want to print it out

---

You do? I haven't seen a line of code where you use it.

I wrote this in my previous page:
line 193 was just:
printf("body is %s\n", frame->body);

Quote:

---

Originally Posted by -EquinoX-

I wrote this in my previous page:
line 193 was just:
printf("body is %s\n", frame->body);

---

And where do you initialize it?

Quote:

---

Originally Posted by vart

And where do you initialize it?

---

initialize what? if you ask initialize frame->body, then here's how I do it:

fread(frame->body, 1 , 256, stdin);

Quote:

---

Originally Posted by -EquinoX-

initialize what? if you ask initialize frame->body, then here's how I do it:

fread(frame->body, 1 , 256, stdin);

---

so you enter exactly 256 characters into it? there is no place for nul-terminator then

use

fprintf("%256.256s", frame->body);

to print it

or

fprintf("%*.*s", len,len,frame->body);
to print len bytes of it