C: malloc，结构错误

Question

我不知道我的代码出了什么问题。

这似乎与内存访问有关，但我不知道是什么或为什么。我很感激你的帮助。

代码：

#include <stdio.h>
#include <time.h>
#include "ist.h"

#define LOGMESSAGE "Error. Try again: "
typedef struct {
  usint size;
  double *value;
} Vector;
void showVector(Vector vector);
/*  generateVector(int, int) -> double*/
Vector generateVector( int max, int size ) {
    usint i;
    Vector vector;
    if(size == 0) {
        fprintf( stdout, "1 element added to arrayn" );
        vector.size = 1;
    }
    vector.value = malloc( ((size) * sizeof (double)) + 1);
    for(i = 0; i < size; i++) {
        vector.value[i] = ( (double)rand() * max / (double)RAND_MAX );
    printf("n%fn", vector.value[i]);
    }
    vector.value[size] = '';
    fprintf( stdout, "nVector generatedn" );
    showVector(vector);
    return vector;
}
/*  save(double *) -> void*/
unsigned int save(Vector vector) {
    sint i;
    FILE *f_data = fopen("savedata.txt", "wt");
    if(f_data == NULL) {
        fprintf( stdout, "can't open file" );
        return 1;
    }
    for(i = 0; i < vector.size; i++)
        fprintf( f_data, "%.3fn", vector.value[i] );
    fclose( f_data );
    return 0;
}
/*  showvector(double) -> void*/
void showVector(Vector vector) {
    usint i;
    line( 2, 0 );
    for(i = 0; i < vector.size; i++)
        fprintf( stdout, "[%2.d] %.3lf%c", i, vector.value[i],
                                  (i % 5) ? 't' : 'n' );
    line( 2, 0 );
}
/*  sort(double*) -> double*/
Vector sort(Vector vector) {
    sint i;
    int change = true;
    while(change == true) {
      change = false;
      for(i = 0; i < vector.size; i++)
        if(vector.value[i + 1] > vector.value[i]) {
            double temp = vector.value[i];
        vector.value[i] = vector.value[i + 1];
        vector.value[i + 1] = temp;
        change = true;
        }
    }
    showVector( vector );
    return vector;
}
/*  interface(void) -> int*/
int interface(char **argv) {
    Vector vector;

    clear();
    fseek( stdin, 0, SEEK_END );
    vector = (argv == NULL) ? generateVector( i_dialog( "Max val:   ", LOGMESSAGE ),
                          i_dialog( "Vector size: ", LOGMESSAGE ) )
                            : generateVector( atoi( argv[1] ), atoi( argv[2] ) );
    showVector( vector );
    save( sort(vector) );
    free( vector.value );
    fprintf( stdout, "Press <ENTER>..." );
    CLEARBUFF();

    line( 2, 1 );
    menu( 2, "Repeat", "Exit" );
    return i_dialog( "nchoice: ", LOGMESSAGE ) ? true : false;
}
int main(int argc, char **argv) {
    srand( (unsigned)time(NULL) );
    if(argc != 3)
      argv = NULL;
    while(interface( argv ));
    return 0;
}

输出（错误）：

Vector Size:  4
Max value:    5
0.659987
2.609337
2.122152
1.464432
s1e2: malloc.c:2451: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted (core dumped)

非常感谢

Answer 1

vector.value = malloc( ((size) * sizeof (double)) + 1);

这为size双加一个字节分配了足够的空间。

vector.value[size] = '';

这是个问题。由于value属于double*类型，因此取消引用它会导致获取或设置double值。您使用类型为int的字符文字。它被隐式转换为double，您在分配的内存结束时进行写入，结果是未定义的行为。

也许您想写以下内容，因为您还在sort函数中索引数组的末尾。

vector.value = malloc((size + 1) * sizeof(double));

Answer 2

应为：

vector.value = malloc(size * sizeof(double) + sizeof(int));

和：

*((int *)(&vector.value[size])) = 0;