Question

I have the following program which tries to tokenize a string (based on space) and write it into a char ** array.

#include <stdio.h>
#include <stdlib.h>

#define len 180

void tokenize(char *str, char **tokens)
{
    int l = 0, index = 0;
    int i = 0;
    int str_i;
    int tok_i;

    while(*str) {
        if (*str == ' ') {
            tokens[i] = malloc(sizeof(char) * l+1);
            if (tokens[i] == NULL) return;

            tok_i = 0;           
            for (str_i=index-len ; str_i<index ; str_i++) {
                tokens[i][tok_i] = str[str_i];
                tok_i++;
            }

            tokens[i][tok_i] = '\0';
            tokens[i++] = NULL;
            l = 0;
            index++;
        }
        str++;
        l++;
        index++;
    }       

    return;         
}

int main()
{
    char str[len] = "this is a test string";
    char **tokens = malloc(100 * sizeof(char *));

    if (str == NULL || tokens == NULL)
        return 1;

    printf("input string: %s\n", str);
    tokenize(str, tokens);

    return 0;
}

The above program compiled fine, but when executing, I got the following assertion in malloc.c

$ gcc -ggdb -Wall prog.c 
$ ./a.out 
input string: this is a test string
a.out: malloc.c:2453: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted (core dumped)
$ 

And the stack trace shows the following:

(gdb) bt
#0  0x0000003b28036285 in raise () from /lib64/libc.so.6
#1  0x0000003b28037b9b in abort () from /lib64/libc.so.6
#2  0x0000003b2807d37d in __malloc_assert () from /lib64/libc.so.6
#3  0x0000003b28080c37 in _int_malloc () from /lib64/libc.so.6
#4  0x0000003b28082595 in malloc () from /lib64/libc.so.6
#5  0x000000000040055f in tokenize (str=0x7fffffffe017 " a test string", tokens=0x601010) at prog.c:15
#6  0x00000000004006de in main () at prog.c:46
(gdb) 

How do I debug this? Any idea would be highly appreciated.

Answer 1

In your for loop

for (str_i=index-len ; str_i<index ; str_i++)

str_i is a negative number.