Question

This is program is input some string from a file, then, push strings into LineBuf one by one, after we push one string into LineBuf, print LineBuf,then, make LineBuf empty.

This is my code:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *LineBuf = NULL;
int BufLen = 0;

void PushToBuf(char c)
{
    LineBuf = (char *)realloc(LineBuf, (BufLen+2)*sizeof(char));
    LineBuf[BufLen] = c;
    BufLen++;
    LineBuf[BufLen] = '\0';
}

int main()
{
    char temp[20];
    int i;
    FILE *fp;
    fp = fopen("input", "r");

    while (fgets(temp, 20, fp) > 0)
    {
        /*Push temp into buf*/
        for (i = 0; i < strlen(temp); i++)
            PushToBuf(temp[i]);

        /*print buf*/
        printf("%s\n", LineBuf);
        printf("%d\n", BufLen);

        /*make buf empty*/
        free(LineBuf);
        BufLen = 0;
    }
    return 0;
}

This is my input stream:

This is a test. Good evening
bye~

This is run result:

This is a test file
19
. Good evening

15
 glibc detected  ./a.out: double free or corruption (fasttop): 0x00000000023fa250 

======= Backtrace: =========

/lib/libc.so.6(+0x775b6)[0x7f2ad01bf5b6]
/lib/libc.so.6(cfree+0x73)[0x7f2ad01c5e83]
./a.out[0x400868]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7f2ad0166c4d]
./a.out[0x400699]

Answer 1

How realloc ( void * ptr, size_t size ) works:

The size of the memory block pointed to by the ptr parameter is
changed to the size bytes, expanding or reducing the amount of memory
available in the block. The function may move the memory block to a new location, in which
case the new location is returned.

In case that ptr is NULL, the function behaves exactly as malloc,
assigning a new block of size bytes and returning a pointer to the
beginning of it.

In your case the pointer is already freed, but still isn’t NULL, so when the program tries to move this memory block, it causes memory corruption.

To solve it, you should do one of the following:

• Remove free().
• Use malloc instead of realloc.
• Set LineBuf to NULL after free().