c - 为什么这个 free 语句会导致堆损坏错误？

Question

我编写了一些代码，但不确定如何正确释放函数内部动态分配的内存。

在不导致堆损坏的情况下释放内存的正确方法是什么，或者更好的是，在尝试释放“returnedAry”时导致损坏的原因是什么

  #include <stdio.h>
#include <stdlib.h>
#define MAX_NUM_DIGITS 10

void displayMainMenu(void);
int* extractUncommonDigit(int*, int);

int main() {
    displayMainMenu();

    return 0;
}

void displayMainMenu() {
    int* userAry = NULL;
    int* returnedAry = NULL;
    int menuOption;
    int numOfInts;
    int i;

    do {
        printf("\n\n*********************************************\n"
            "*                     MENU                  *\n"
            "* 1. Calling extractUncommonDigit()         *\n"
            "* 2. Quit                                   *\n"
            "*********************************************\n"
            "Select an option (1 or 2): ");
        scanf_s("%d", &menuOption);

        switch (menuOption) {
        case 1:
            printf("\n  How many integers? ");
            scanf_s("%d", &numOfInts);
            userAry = (int*)malloc(numOfInts * sizeof(int));

            for (i = 0; i < numOfInts; i++) {
                printf("    Enter integer #%d: ", i + 1);
                scanf_s("%d", &userAry[i]);
            }

            printf("\n  The original array: \n");
            for (i = 0; i < numOfInts; i++) {
                printf("    %d\n", userAry[i]);
            }

            printf("\n  Calling extractUncommonDigit() -\n");
            returnedAry = extractUncommonDigit(userAry, numOfInts);
            printf("\n  Displaying after returning the array"
                " -- The uncommon digits: ");

            if (returnedAry[0] != 0) {
                printf("\n    There is/are %d uncommon digit(s)", returnedAry[0]);
                for (int i = 1; i < returnedAry[0] + 1; i++) {
                    printf("\n      %d", *(returnedAry + i));
                }
            } else {
                printf("\n   There is/are no uncommon digit(s)");
            }
            break;
        case 2:
            free(userAry);
            /* This line causes heap corruption error
            -----------------------------------------
            free(returnedAry);
            -----------------------------------------
            */
            printf("\n  Fun Excercise ...");
            break;
        default:
            printf("\n  WRONG OPTION!");
            break;
        }
    } while (menuOption != 2);

    free(userAry);

    return;
}

int* extractUncommonDigit(int* ary, int size) {
    int* assembledAry = 0;
    int tmp;
    int** digitInfoAry = (int**)malloc(size * sizeof(int*));
    int i, j;
    int digitAry[10] = { 0 };
    int uncommonCount = 0;

    for (i = 0; i < size; i++) {
        *(digitInfoAry + i) = (int*)calloc(MAX_NUM_DIGITS, sizeof(int));
    }

    for (i = 0; i < size; i++) {
        tmp = *(ary + i) < 0 ? -(*(ary + i)) : *(ary + i);

        do {
            *(*(digitInfoAry + i) + tmp % 10) = 1;
            tmp /= 10;
        } while (tmp != 0);
    }

    for (i = 0; i < MAX_NUM_DIGITS; i++) {
        for (j = 0; j < size; j++) {
            digitAry[i] += *(*(digitInfoAry + j) + i);
        }
    }

    for (i = 0; i < MAX_NUM_DIGITS; i++) {
        if (digitAry[i] == 1) {
            uncommonCount++;
        }
    }

    assembledAry = (int*)malloc(uncommonCount * sizeof(int) + 1);
    *assembledAry = uncommonCount;

    if (uncommonCount != 0) {
        for (i = 0, j = 1; i < MAX_NUM_DIGITS; i+=2) {
            if (digitAry[i] == 1) {
                assembledAry[j] = i;
                j++;
            }
        }
        for (i = 1; i < MAX_NUM_DIGITS; i+=2) {
            if (digitAry[i] == 1) {
                assembledAry[j] = i;
                j++;
            }
        }
    }

    free(digitInfoAry);

    return assembledAry;
}

注释文本显示运行调试器后程序崩溃的位置。我做错了什么？

Answer 1

我预计问题就在这里，您没有分配足够的内存，然后注销 block 的末尾，调用未定义的行为:

assembledAry = (int*)malloc(uncommonCount * sizeof(int) + 1);

您实际上需要 (uncommonCount + 1) * sizeof(int) 字节。

不相关，但在释放 digitInfoAry 时也会发生泄漏(因为您没有释放它包含的所有已分配指针)，并且双重释放 userAry就在离开main之前。