C语言 分配大小错误或自由方法使用错误

Question

我有结构，我为它分配内存：

TRANSITION *transitions = malloc(sizeof(TRANSITION *));

我在程序的另一部分为其添加过渡，以便重新分配内存：

TRANSITION *transitions = source->transitions;
transitions = realloc(transitions, (numberTransitions + 1) * sizeof(TRANSITION *));

我有一个想要释放内存的方法：

free(transitions);

当我调用免费方法时，我得到：

"Aborted (core dumped)"

怎么了？

整个代码：

#include <stdio.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>
typedef struct STATE STATE;
typedef struct TRANSITION TRANSITION;
struct STATE
{
    char name[4];
    bool initial_state;
    bool final_state;
    TRANSITION *transitions;
    int numberTransitions;
};
struct TRANSITION
{
    char c;
    STATE *destination;
};
STATE *create_state(char *name, bool is_initial, bool is_final);
void add_transition(STATE *source, char sign, STATE *dest);
void destroy_state(STATE **pp_state);
int main(void)
{
  STATE *state0 = create_state("S'0", true, false);
STATE *state1 = create_state("S'1", false, false);
STATE *state2 = create_state("S'2", false, true);
STATE *zero_state = create_state("0", false, false);
add_transition(state0, 'a', state1);
add_transition(state0, 'b', zero_state);
add_transition(zero_state, 'a', zero_state);
add_transition(zero_state, 'b', zero_state);
add_transition(state1, 'a', state1);
add_transition(state1, 'b', state2);
add_transition(state2, 'a', state1);
add_transition(state2, 'b', state2);
destroy_state(&state0);
}
STATE *create_state(char *name, bool is_initial, bool is_final)
{
    STATE *state = malloc(sizeof(STATE *));
    strcpy(state->name, name);
    state->initial_state = is_initial;
    state->final_state = is_final;
    state->transitions = NULL;
    state->numberTransitions = 0;
    return state;
}
void add_transition(STATE *source, char sign, STATE *dest)
{
    if (source->transitions == NULL)
    {
        TRANSITION *transitions = malloc(sizeof(TRANSITION *));
        transitions->c = sign;
        transitions->destination = malloc(sizeof(STATE *));
        transitions->destination = dest;
        source->transitions = transitions;
        source->numberTransitions = 1;
    }
    else
    {
        TRANSITION *transitions = source->transitions;
        int numberTransitions = source->numberTransitions;
        transitions = realloc(transitions, (numberTransitions + 1) * sizeof(TRANSITION *));
        transitions[numberTransitions].c = sign;
        transitions[numberTransitions].destination = dest;
        (source->numberTransitions)++; 
    }
}
void destroy_state(STATE **pp_state)
{
    TRANSITION *transitions = (*pp_state)->transitions;
    // free(transitions->destination);
    // transitions->destination = NULL;
    free(transitions);
    // transitions = NULL;
    // free(pp_state);
    // pp_state = NULL;
}

Answer 1

我认为你想malloc sizeof（TRANSITION）而不是sizeof（TRANSITION*）。第一个是分配 TRANSITION 结构的大小，第二个只是分配可能小于结构大小的指针的大小。

Answer 2

我更喜欢像这样调用malloc：

T *t = malloc(sizeof(*t));

这样，您的分配始终是指针指向的对象的大小。

这当然相当于：

T *t = malloc(sizeof(T));

但避免在t类型发生变化时出错。

Answer 3

修复分配后，您需要将 realloc 的返回值存储在 source 中。您还需要检查分配是否成功。

目前您将旧指针保留在 source 中，因此当您尝试释放内存时，块已经释放并且实际分配的内存会泄漏，因为它没有存储在任何地方。