Dynamic string list and free() crashing application

Question

I wrote a simple C code that should store a list of string addresses (char*) inside a struct. The list is dynamic, so every time a new string is added, I reserve enough memory to store all the current string addresses plus the new one. Then I free the old buffer and assign the new one to the struct. The problem is that it crashes on free().

I am sure I am free()ing the exact address i got from calloc(), but still, it crashes.

here is the output:

main(3618,0x7fff7a83f300) malloc: *** error for object 0x7f9902404bd0: incorrect checksum for freed object - object was probably modified after being freed.

The code is:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct StructNODE{
    char** stringlist;
    int stringcount;
    struct StructNODE* next;
} NODE;


void Addstring(NODE* node, const char* string)
{
    int currentBufferSize = node->stringcount * sizeof(char*);

    // make room for the current string list plus the new one
    char** addrList = (char**) calloc( 1, currentBufferSize );
    printf("malloc: %d bytes starting at 0x%X\n",currentBufferSize, addrList);

    // copy all current addresses to the new list
    memcpy(addrList, node->stringlist, currentBufferSize);

    printf("freeing mem at 0x%X\n",node->stringlist);
    free(node->stringlist);

    // Append the new address to the end of the address buffer
    addrList[node->stringcount] = (char*)string;

    //make the node point to the new buffer
    node->stringlist = addrList;

    // Increment the string number counter
    node->stringcount++;

}

void PrintStringlist(NODE* node)
{
    int i;
    for ( i=0; i < node->stringcount; i++)
    {
        printf("string %d: %s\n",i, node->stringlist[i]);
    }
}

int main(int argc, char** argv)
{
    NODE* node = (NODE*) calloc(1 , sizeof(NODE));

    Addstring(node, "Lewis Skolnick");
    Addstring(node, "Gilbert Lowe");    
    Addstring(node, "Arnold Poindexter");       
    Addstring(node, "Harold Wormser");
    Addstring(node, "Booger");
    Addstring(node, "Takashi Toshiro");
    Addstring(node, "Lamar Latrelle");
    Addstring(node, "Judy");    

    PrintStringlist(node);

    return 0;
}

What am I overlooking ?

Answer 1

Your buffer is too small - you forgot to add the space for an extra element. The fist function line should read:

    int currentBufferSize = (node->stringcount + 1) * sizeof(char*);

Answer 2

The signature of calloc is the following:

void* calloc (size_t num, size_t size);

So, assuming stringcount is the actual amount, you should call it with different arguments, eg

calloc(sizeof(char*), node->stringcount +1)

In any case there is another useful function in stdlib which is realloc, this allows you to resize directly the allocated memory without the need of copying all the data back by yourself or releasing the previous memory:

node->stringList = realloc(node->stringList, (node->stringcount+1)*sizeof(char*));
node->stringList[node->stringcount] = (char*)string;