C: free() invalid pointer; without changing address

Question

I'm using C (not C++) and getting the following error:
Error in './c_rk4': free(): invalid pointer: 0x0000000000a911c0

I was able to trace the error back to the lines (1) and (2). The error in (1) does not occur, if I comment out the line I marked. All other free() usages do not produce errors and the program runs as wished if I comment out all lines with free().

I checked with lines like printf("%p\n", y_n); that the address of y_n is the same after malloc() and before free() (and exactly the address in the error message).

#include <stdio.h>
#include <stdlib.h>
#include <math.h>
#include <complex.h>

void odesolver_rk4 (void (*)(double, _Complex double *, _Complex double **),
            int, double,
            int, _Complex double *, _Complex double ***);
void testfunc (double, _Complex double *, _Complex double **);

int main (int argc, char *argv[argc]) {  
  const int t_num = 300;
  const int y_num = 2;

  _Complex double **y_res;
  y_res = malloc(t_num*sizeof(_Complex double *));
  for (int i = 0; i < t_num; i++)
    y_res[i] = malloc(y_num*sizeof(_Complex double));

  odesolver_rk4(testfunc, t_num, 20.0, y_num, (_Complex double []){1.0, 0.0}, &y_res);

  for (int i = 0; i < t_num; i++) {
    for (int j = 0; j <= y_num; j++) {
      printf("%f %f ", creal(y_res[i][j]), cimag(y_res[i][j]));
    }
    printf("\n");
  }

  for (int i = 0; i < t_num; i++)
    free(y_res[i]); // error (2)
  free(y_res);

  return 0;
}


void odesolver_rk4 (void (*func)(double, _Complex double *, _Complex double **),
            int t_num, double t_end,
            int y_num, _Complex double *y_start, _Complex double ***y_res) {
  double t_step = t_end/t_num;

  double t_n = 0;
  _Complex double *y_n, *y_A, *y_B, *y_C;
  _Complex double *dy_n, *dy_A, *dy_B, *dy_C;

  y_n = malloc(y_num*sizeof(_Complex double));
  y_A = malloc(y_num*sizeof(_Complex double));
  y_B = malloc(y_num*sizeof(_Complex double));
  y_C = malloc(y_num*sizeof(_Complex double));

  dy_n = malloc(y_num*sizeof(_Complex double));
  dy_A = malloc(y_num*sizeof(_Complex double));
  dy_B = malloc(y_num*sizeof(_Complex double));
  dy_C = malloc(y_num*sizeof(_Complex double));

  for (int j = 0; j < y_num; j++)
    y_n[j] = y_start[j];

  (*y_res)[0][0] = t_n;
  for (int j = 0; j < y_num; j++)
    (*y_res)[0][j + 1] = y_start[j];
  for (int i = 1; i < t_num; i++) {
    func(t_n, y_n, &dy_n);
    for (int j = 0; j < y_num; j++)
      y_A[j] = y_n[j] + dy_n[j]*t_step/2;

    func(t_n + t_step/2, y_A, &dy_A);
    for (int j = 0; j < y_num; j++)
      y_B[j] = y_n[j] + dy_A[j]*t_step/2;

    func(t_n + t_step/2, y_B, &dy_B);
    for (int j = 0; j < y_num; j++)
      y_C[j] = y_n[j] + dy_B[j]*t_step;

    func(t_n + t_step, y_C, &dy_C);
    for (int j = 0; j < y_num; j++) {
      y_n[j] += t_step/6*(dy_n[j] + 2*(dy_A[j] + dy_B[j]) + dy_C[j]);

      (*y_res)[i][0] = t_n;
      (*y_res)[i][j + 1] = y_n[j]; // something goes wrong here for (1)
    }

    t_n += t_step;
  }

  free(y_n); // error (1)
  free(y_A);
  free(y_B);
  free(y_C);

  free(dy_n);
  free(dy_A);
  free(dy_B);
  free(dy_C);
}

void testfunc (double t, _Complex double *y, _Complex double **dy) {
  (*dy)[0] = -y[1];
  (*dy)[1] = y[0];
}

Answer 1

The problem is this loop:

for (int j = 0; j < y_num; j++)

and this line of code:

(*y_res)[i][j + 1] = y_n[j]

Either your loop needs to be j < y_num - 1 or your expression should use [j]. Otherwise, you are stepping past the end of the y_res array. When you do that, you are overwriting the malloc header for the y_n allocation which is why free() later complains that it is an invalid pointer.

By the way, valgrind is a really good tool for finding these kinds of problems.

http://valgrind.org

Also recommended from the comments is AddressSanitizer:

http://clang.llvm.org/docs/AddressSanitizer.html