C realloc() 错误中的动态数组

Question

我在运行时收到此错误：

*** Error in `./a.out': realloc(): invalid next size: 0x00000000020bd010 ***

我发现其他人得到了这个答案，但是，我觉得我的不一样。每次用户指定他想输入另一个数字时，我都会尝试分配一个额外的空间。任何帮助是极大的赞赏！谢谢！

这是我的代码，我将在下面链接输出。

#include <stdio.h>
#include <stdlib.h>

int main()
{
        double *ptr = (double*)(malloc(sizeof(double)));
        double *temp;
        char answer = 'y';
        int counter = 1;

        printf("Enter in a double: ");
        scanf("%lf", ptr);

        printf("Your numer is %lf.\n", *ptr);

        printf("Do you want to enter another number? <y/n> : ");
        scanf(" %c", &answer);

        while(answer == 'y' || answer == 'Y')
        {
                temp = realloc((double*)ptr, counter*sizeof(double));
                ptr = temp;

                printf("Enter in a double: ");
                scanf("%lf", &ptr[counter]);

                printf("ptr[%d] = %lf.\n", counter, ptr[counter]);

                counter++;

                printf("Do you want to enter another number? <y/n> : ");
                scanf(" %c", &answer);
        }

        return 0;
}

完整输出（注意，每次我输入 4 个数字时都会发生这种情况）：

Enter in a double: 123.123
Your numer is 123.123000.
Do you want to enter another number? <y/n> : y
Enter in a double: 123.321
ptr[1] = 123.321000.
Do you want to enter another number? <y/n> : y
Enter in a double: 456.321
ptr[2] = 456.321000.
Do you want to enter another number? <y/n> : y
Enter in a double: 453.23456
ptr[3] = 453.234560.
Do you want to enter another number? <y/n> : y
*** Error in `./a.out': realloc(): invalid next size: 0x0000000000c52010 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f64da1777e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x82a5a)[0x7f64da182a5a]
/lib/x86_64-linux-gnu/libc.so.6(realloc+0x179)[0x7f64da183c89]
./a.out[0x400750]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f64da120830]
./a.out[0x4005c9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:05 6183060                            /home/sam/Documents/compsci/sja0128/Labs/LabEC/a.out
00600000-00601000 r--p 00000000 08:05 6183060                            /home/sam/Documents/compsci/sja0128/Labs/LabEC/a.out
00601000-00602000 rw-p 00001000 08:05 6183060                            /home/sam/Documents/compsci/sja0128/Labs/LabEC/a.out
00c52000-00c73000 rw-p 00000000 00:00 0                                  [heap]
7f64d4000000-7f64d4021000 rw-p 00000000 00:00 0 
7f64d4021000-7f64d8000000 ---p 00000000 00:00 0 
7f64d9ee8000-7f64d9efe000 r-xp 00000000 08:05 1709130                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f64d9efe000-7f64da0fd000 ---p 00016000 08:05 1709130                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f64da0fd000-7f64da0fe000 rw-p 00015000 08:05 1709130                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f64da100000-7f64da2bf000 r-xp 00000000 08:05 1726267                    /lib/x86_64-linux-gnu/libc-2.23.so
7f64da2bf000-7f64da4bf000 ---p 001bf000 08:05 1726267                    /lib/x86_64-linux-gnu/libc-2.23.so
7f64da4bf000-7f64da4c3000 r--p 001bf000 08:05 1726267                    /lib/x86_64-linux-gnu/libc-2.23.so
7f64da4c3000-7f64da4c5000 rw-p 001c3000 08:05 1726267                    /lib/x86_64-linux-gnu/libc-2.23.so
7f64da4c5000-7f64da4c9000 rw-p 00000000 00:00 0 
7f64da4d0000-7f64da4f6000 r-xp 00000000 08:05 1726269                    /lib/x86_64-linux-gnu/ld-2.23.so
7f64da6ef000-7f64da6f5000 rw-p 00000000 00:00 0 
7f64da6f5000-7f64da6f6000 r--p 00025000 08:05 1726269                    /lib/x86_64-linux-gnu/ld-2.23.so
7f64da6f6000-7f64da6f7000 rw-p 00026000 08:05 1726269                    /lib/x86_64-linux-gnu/ld-2.23.so
7f64da6f7000-7f64da6f8000 rw-p 00000000 00:00 0 
7fff1d240000-7fff1d261000 rw-p 00000000 00:00 0                          [stack]
7fff1d270000-7fff1d272000 r--p 00000000 00:00 0                          [vvar]
7fff1d272000-7fff1d274000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)

Answer 1

您的代码有一个主要问题：数组索引从 0 开始到 size-1 使用 c。所以使用

temp = realloc((double*)ptr, counter*sizeof(double));

在第一个循环中，您分配单个项目 (counter=1)，然后访问 ptr[counter] 而最大索引可以是 counter-1

而且循环前的代码在循环内是一样的，所以可以避免：

#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    double *ptr = NULL;
    double *temp;
    char answer = 'n';
    int counter = 0;

    do
    {
        temp = realloc(ptr, (counter+1) * sizeof(double));

        if (temp != NULL)
        {
            ptr = temp;

            printf("Enter in a double: ");
            scanf("%lf", &ptr[counter]);

            printf("ptr[%d] = %lf.\n", counter, ptr[counter]);

            printf("Do you want to enter another number? <y/n> : ");
            scanf(" %c", &answer);

            counter++;
        }
    }
    while (((answer == 'y') || (answer == 'Y')) && (temp != NULL));

    free(ptr);

    return 0;
}

如您所见，所有realloc 返回值必须在使用前进行检查。