检测到glibc - 双重免费或腐败

Question

我在C中编写一个简单的堆栈程序,最后有一个灵活的void*数组.当需要更多的元素来推入数组时,我使用realloc()来创建一个新的堆栈,释放旧的堆栈并将新的分配给旧的堆栈.(我目前没有pop()函数).

#include <stdlib.h>
#include <stdio.h>

typedef struct Stack
{
    int top, length;
    void* start_ptr[];
} Stack;

Stack* init_stack(int n_items)
{
    Stack* stack;
    stack = malloc(sizeof(int) * 3 + sizeof(void*) * n_items);

    stack->top = -1;
    stack->length = n_items;

    return stack;
}

Stack* increase_stacksize(Stack* stack, int n_itemsToAdd)
{
    Stack* newstack;    
    newstack = realloc(stack, sizeof(*stack) + sizeof(void*) * (n_itemsToAdd + stack->length));

    if(newstack != NULL)
         //printf("\nDebug print - array reallocated\n");

    free(stack);
    stack = newstack;

    stack->length += n_itemsToAdd;

    return stack;
}

Stack* push(Stack* stack, void* item)
{
    if(stack->top + 1 == stack->length){

        stack = increase_stacksize(stack, 10);
    }

    int pos = stack->top + 1;

    stack->start_ptr[pos] = item;
    ++(stack->top);

    return stack;
}

void printstack(Stack* stack)
{
     printf("Number of items in the stack = %d\n", stack->top + 1);
     printf("Capacity of the stack = %d\n", stack->length);

     printf("Elements in the stack are: \n");

    int i;

    for(i = 0; i <= stack->top; i++){
        int* item_ptr;
        void* address;

        address = stack->start_ptr[i];

        item_ptr = (int*)address;

        printf("Position = %d, Item = %d \n", i, *item_ptr);
    }
}

int main(void)
{    
    Stack* stack;
    stack = init_stack(5);

    int a[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10};
    int i;

    for(i = 0; i < 10; i++)
    {
        stack = push(stack, (void*)(a+i));
    }

    printstack(stack);

    free(stack);

    return 1;
}

问题是当我完成一条消息在stderr中打印后,我在main()中释放堆栈()

*** glibc detected *** ./prog: double free or corruption (fasttop): 0x096ee008 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7721fd4]
/lib/libc.so.6(cfree+0x9c)[0xb772387c]
./prog[0x8048731]
./prog[0x8048461] 
 ======= Memory map: ========

输出upto printstack()很好.即使我删除了free(stack)行,我在ideone.com中也遇到了运行时错误,但是没有stderr消息.我猜它可能是由于零大小的数组.这可能是什么问题？

Answer 1

realloc如果需要,释放旧块,这样你就应该删除该free(stack)行increase_stacksize