Attempting to free address that was not malloced , error on realloc-CodePudding

Question : https://leetcode.com/problems/find-and-replace-in-string/

"""

char * findReplaceString(char * s, int* indices, int indicesSize, char ** sources, int sourcesSize, char ** targets, int targetsSize){

int len = strlen(s);
char *copyS;
char *copy = (char*) malloc(sizeof(char)*len);
memcpy(copy, s, sizeof(char)*len);
copyS = copy;
int x = indicesSize-1;
int indexArr[1001] = {0};
int y;

for(int j=0; j<indicesSize; j  )
{
    indexArr[indices[j]] = j;
}

qsort(indices, indicesSize, sizeof(int), cmp);

while((x >= 0))
{
    y = indexArr[indices[x]];
    copy = copyS (indices[x]);
    if(!(strncmp(copy, sources[y], strlen(sources[y]))))
    {
        copy = (char *)realloc(copy, sizeof(char)*(sizeof(copy)   sizeof(targets[y])));
        strcpy(copy, targets[y]);
    }
        
    x--;
}
return copyS;

}

I am getting a runtime error due to the use of realloc. I was trying to modify the input string 's'. Got a runtime error due to realloc: Trying to free memory that was not malloced. So I malloced new string pointer , *copy. Still getting same error when I use realloc on copy

CodePudding user response：

Once you do this

copy = copyS (indices[x]);

you can no longer use 'copy' as an argument to realloc or free. The pointer you pass to these functions must be the value returned by a prior malloc or realloc (or calloc)

Save the original 'copy' in a variable like 'originalCopy'

CodePudding user response：

There are several problems with the code.

For starters it is unclear whether the dynamically allocated array pointed to by the pointer copy shall contain a string or not.

If it shall contain a string then instead of

char *copy = (char*) malloc(sizeof(char)*len);
memcpy(copy, s, sizeof(char)*len);

you need to write

char *copy = (char*) malloc(sizeof(char)*( len   1 ));
memcpy(copy, s, sizeof(char)*( len   1 ));

Also it is unclear why there is used the magic number 1001 in this declaration

int indexArr[1001] = {0};

The pointer copyS was assigned with the address of the initially allocated memory

char *copyS;
char *copy = (char*) malloc(sizeof(char)*len);
memcpy(copy, s, sizeof(char)*len);
copyS = copy;

but then you are trying to reallocate the memory

copy = (char *)realloc(copy, sizeof(char)*(sizeof(copy)   sizeof(targets[y])));

As a result the pointer copyS can have an invalid value. And this pointer with an invalid value is returned from the function

return copyS

In turn the pointer copy is changed within the while loop

while((x >= 0))
{
    y = indexArr[indices[x]];
    copy = copyS (indices[x]);
    //..

So after such an assignment it does not point to the previously allocated memory extent. Hence using the pointer in the call of realloc

copy = (char *)realloc(copy, sizeof(char)*(sizeof(copy)   sizeof(targets[y])));

invokes undefined behavior.

And again this statement

    copy = copyS (indices[x]);

also invokes undefined behavior because after the memory reallocation the pointer copyS can be invalid.