Calloc/Malloc and freeing to often or too large a space?

Question

Disclaimer, this is help with a school assignment. That being said, my issue only occurs about 50% of the time. Meaning if I compile and run my code without edits sometimes it will make it through to the end and other times it will not. Through the use of multiple print statements I know exactly where the issue is occurring when it does. The issue occurs in my second call to hugeDestroyer(right after the print 354913546879519843519843548943513179 portion) and more exactly at the free(p->digits) portion.

I have tried the advice found here (free a pointer to dynamic array in c) and setting the pointers to NULL after freeing them with no luck.

Through some digging and soul searching I have learned a little more about how free works from (How do malloc() and free() work?) and I wonder if my issue stems from what user Juergen mentions in his answer and that I am "overwriting" admin data in the free list.

To be clear, my question is two-fold.

Is free(p->digits) syntactically correct and if so why might I have trouble half the time when running the code?

Secondly, how can I guard against this kind of behavior in my functions?

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>


typedef struct HugeInteger
{
    // a dynamically allocated array to hold the digits of a huge integer
    int *digits;

    // the number of digits in the huge integer (approx. equal to array length)
    int length;
} HugeInteger;


// Functional Prototypes

int str2int(char str) //converts single digit numbers contained in strings to their int value
{
    return str - 48;
}

HugeInteger *parseInt(unsigned int n)
{
    int i = 0, j = 0;
    int *a = (int *)calloc(10, sizeof(int));
    HugeInteger *p = (HugeInteger *)calloc(1, sizeof(HugeInteger));

    if(n == 0)
    {
        p->digits = (int *)calloc(1, sizeof(int));
        p->length = 1;
        return p;
    }

    while(n != 0)
    {
        a[i] = n % 10;
        n = n / 10;
        i++;
    }

    p->length = i;
    p->digits = (int *)calloc(p->length, sizeof(int));

    for(i = 0; i <= p->length; i++, j++)
        p->digits[j] = a[i];

    return p;
}

HugeInteger *parseString(char *str)  //notice datatype is char (as in char array), so a simple for loop should convert to huge int array
{
    int i = 0, j = 0;
    HugeInteger *p = (HugeInteger *)calloc(1, sizeof(HugeInteger));

    if(str == NULL)
        {
        free(p);
        p = NULL;
        return p;
        }

    else
    {
        for(i=0; str[i] != '\0'; i++)
            ;
        p->length = i;
        p->digits = (int *)calloc(p->length, sizeof(int));

        for(; i >= 0; i--)
            p->digits[j++] = str2int(str[i - 1]);
    }

    return p;
} //end of HugeInteger *parseString(char *str)


HugeInteger *hugeDestroyer(HugeInteger *p)
{
//printf("No problem as we enter the function\n");
    if(p == NULL)
        return p;
//printf("No problem after checking for p = NULL\n");
    if(p->digits == NULL)
    {
        free(p);
        p = NULL;
        return p;
    }
//printf("No Problem after checking if p->digits = NULL\n");  
    //else
    //{
        free(p->digits);
printf("We made it through free(p->digits)\n");
        p->digits = NULL;
printf("We made it through p->digits = NULL\n");
        free(p);
printf("We made it through free(p)\n");
        p = NULL;
printf("We made it through p = NULL\n");
        return p;
    //}

    //return NULL;
}//end of HugeInteger *hugeDestroyer(HugeInteger *p)

// print a HugeInteger (followed by a newline character)
void hugePrint(HugeInteger *p)
{
    int i;

    if (p == NULL || p->digits == NULL)
    {
        printf("(null pointer)\n");
        return;
    }

    for (i = p->length - 1; i >= 0; i--)
        printf("%d", p->digits[i]);
    printf("\n");
}

int main(void)
{
    HugeInteger *p;

    hugePrint(p = parseString("12345"));
    hugeDestroyer(p);

    hugePrint(p = parseString("354913546879519843519843548943513179"));
    hugeDestroyer(p);

    hugePrint(p = parseString(NULL));
    hugeDestroyer(p);

    hugePrint(p = parseInt(246810));
    hugeDestroyer(p);

    hugePrint(p = parseInt(0));
    hugeDestroyer(p);

    hugePrint(p = parseInt(INT_MAX));
    hugeDestroyer(p);

    //hugePrint(p = parseInt(UINT_MAX));
    //hugeDestroyer(p);

    return 0;
}

Answer 1

First of all, really outstanding question. You did a lot of research on topic and generally speaking, solved this issue by yourself, I'm here mainly to confirm your findings.

Is free(p->digits) syntactically correct and if so why might I have trouble half the time when running the code?

Syntax is correct. @Shihab suggested in comments not to release p->digits and release p only, but such suggestion is wrong, it leads to memory leakages. There is a simple rule: for each calloc you must eventually call free, so your current approach in freeing p->digits and then p is totally fine.

However, program fails on a valid line. How is it possible? Quick answer: free can't do its work due to corruption of meta information responsible for tracking allocated/free blocks lists. At some point program corrupted meta information, but this was revealed only on attempt to use it.

As you already discovered, in most implementations memory routines such as calloc results into allocation of buffer with prepended meta-info. You receives pointer to buffer itself, but small piece of information right before this pointer is crucial for further buffer managing (e.g. freeing). Writing 11 integers into buffer intended for 10, you're likely to corrupt meta-info of block following the buffer. Whether corruption actually happens and what would be its consequences, is heavily dependent on both implementation specifics and current memory alignment (what block follows the buffer, what exactly meta-data is corrupted). It doesn't surprise me, that you see one crash per two executions, neither surprises me observing 100% crash reproduction on my system.

Secondly, how can I guard against this kind of behavior in my functions?

Let's start with fixing overflows. There are couple of them:

• parseString: loop for(; i >= 0; i--) is executed length+1 times, so p->digits is overflown
• parseInt: loop for (i = 0; i <= p->length; i++, j++) is executed length+1 times, so p->digits is overflown

Direct access to memory managing in C++ is error prone and troublesome to debug. Memory leakages and buffers overflows are the worst nightmare in programmers life, it's usually better to simplify/reduce direct usage of dynamic memory, unless you are studying to cope with it, of course. If you need to stick with a lot of direct memory managing, take a look at valgrind, it's intended to detect all such things.

By the way, there is also a memory leakage in your program: each call to parseInt allocates buffer for a, but never frees it.