free (malloc) and glibc

[jaknight]

When I run a program it spits out the following message:

*** glibc detected *** corrupted double-linked list: 0x08b9cb08 ***
Aborted (core dumped)

It is reproducible for certain parameter values, but for most there is no problem.

Backtrace listed the following:

#0 0xffffe410 in ?? ()
#1 0xbfff7954 in ?? ()
#2 0x00000006 in ?? ()
#3 0x0000655e in ?? ()
#4 0xb7eb96e5 in raise () from /lib/tls/libc.so.6
#5 0xb7ebb049 in abort () from /lib/tls/libc.so.6
#6 0xb7eed7ba in __fsetlocking () from /lib/tls/libc.so.6
#7 0xb7ef41f8 in malloc_trim () from /lib/tls/libc.so.6
#8 0xb7ef437a in free () from /lib/tls/libc.so.6
#9 0x0804e200 in free_matrix (m=0x8b9ca20, nrl=1, nrh=57, ncl=1, nch=57)
at nrutil.c:257
#10 0x0804b6d1 in main (argc=5, argv=0xbffff674) at struccons.c:638

struccons is my program, and free_matrix is used to free up an allocated 2d pointer that runs from nrl-nrh in the first dimension, and ncl-nch in the second dimension (this is a pre-written sub-routine from Numerical Recipes).

Anyone have any idea what's going on?

 

[sedj]

looks like you might be free'ing memory twice, or free'ing some memory which has broken its bounds (ie writing beyond the space allocated for an array or struct).

--------------------------------------------------
Free Java/J2EE Database Connection Pooling Software

http://www.primrose.org.uk

 

[jaknight]

It's strange. The error always occurs when freeing memory.

The code is located within a loop. So I allocate memory for a 2D pointer, then when I'm finished with the pointer I free it up for use during the next iteration. This works fine for 5-10 iterations and then this bug appears. The pointer is intialized with a certain size and then that exact same size is freed.

I'm actually doing this with four different pointers. Sometimes the abort occurs during the freeing process for one pointer, sometimes for a different one.

 

[sedj]

you're definitely corrupting memory somewhere, and without seeing any code, its hard to offer any more advice.

Double check your code, and run it through a debugger too.

--------------------------------------------------
Free Java/J2EE Database Connection Pooling Software

http://www.primrose.org.uk

 

[jaknight]

I've been running it through a debugger, but what I can glean from it is minimal.

I'll give some code:

for(...){

/* initializing matrix (matrix subroutine below) */

X=matrix(1, x, 1, y);

...

/* freeing matrix */

free_matrix(X, 1, x, 1, y);
}

float **matrix(long nrl, long nrh, long ncl, long nch)
/* allocate a float matrix with subscript range m[nrl..nrh][ncl..nch] */
{
long i, nrow=nrh-nrl+1,ncol=nch-ncl+1;
float **m;

/* allocate pointers to rows */
m=(float **) malloc((size_t)((nrow+NR_END)*sizeof(float*)));
if (!m) nrerror("allocation failure 1 in matrix()");
m += NR_END;
m -= nrl;

/* allocate rows and set pointers to them */
m[nrl]=(float *) malloc((size_t)((nrow*ncol+NR_END)*sizeof(float)));
if (!m[nrl]) nrerror("allocation failure 2 in matrix()");
m[nrl] += NR_END;
m[nrl] -= ncl;

for(i=nrl+1;i<=nrh;i++) m=m[i-1]+ncol;

/* return pointer to array of pointers to rows */
return m;
}

void free_matrix(float **m, long nrl, long nrh, long ncl, long nch)
/* free a float matrix allocated by matrix() */
{
free((FREE_ARG) (m[nrl]+ncl-NR_END));
free((FREE_ARG) (m+nrl-NR_END));
}

 

[Diancecht]

Check that the values with all that add and multiply stuff when freeing are always correct and consistent with those provided at initialitation.

And remember that the fact the error is appearing freeing a piece of memory does not neccesarily means the error is there, maybe its overlapping with another non-freed memory zone.

Cheers,
Dian

 

[jaknight]

The error was in intialization. I was initializing from 1 instead or 0. Changing it has fixed the problem.

Thanks for the help.