收缩时由 realloc 造成的堆损坏

Question

我应该构建一个数据库，通过将动态分配的数组移动到数组末尾来“删除”一个元素。当这种元素的块变得足够大时，应该重新分配内存以缩小数组并永久删除那些无用的元素。
错误：
Realloc 正在抛出：
realloc()：下一个大小无效
中止

重现错误的步骤（简化）： 从界面中选择删除选项。

代码（简化）：
在 main() 中：

 printf("\nEnter id to delete:");
                    scanf("%d",&idtoDelete);
                    delete(&log,idtoDelete);

在functions.c中：

int delete(petCatalog *log, int idtoDelete) {
    //search to find which log has the id to delete.
    pet temp;
    int distance = 0;//between size and the pet to be deleted (temp) dld idtoDelete.
    int calibration = 0;
    int i = 0, j = 0;//virginslots from size-1 to thee first that awaits to be deleted dld virgin slots
    for (i = 0; i < log->size; i++) {
        if (log->array[i].id == idtoDelete) {            
            //move toDelete to my temp
            deepcopy_pet(&temp, &log->array[i], YES);
            log->virginSlots = log->size - i;
            //crerate a gap and fill the gap by overwriting
            distance = log->size - idtoDelete;
            calibration = distance + idtoDelete;
            for (j = i + 1; j < calibration; j++) {
                deepcopy_pet(&log->array[j - 1], &log->array[j], NO);                
            }
            log->size--;
            //temp to cap 
            deepcopy_pet(&log->array[log->cap], &temp, YES);        
            log->awaitDelete++; //all good till here
            log->virginSlots = log->cap - log->awaitDelete - log->size;
            if (log->virginSlots <= DOWNLIM) {
                log->cap = log->cap - log->awaitDelete;//meaning dump everything after: size+virginslots
                log->array = realloc(log->array, log->cap * sizeof(pet));
                if (log->array == NULL) {
                    printf("deletion failed to realloc");
                    exit(EXIT_FAILURE);
                }
            } else if (log->virginSlots >= UPLIM) {
                log->array = realloc(log->array, sizeof(pet) * (log->size) + DEFAULTVIRGIN);
                if (log->array == NULL) {
                    printf("\nfailed to realloc cause of UPLIM");
                    exit(EXIT_FAILURE);
                }
                log->cap = log->size + DEFAULTVIRGIN;
            }
        }
        //sort the array by breed again
    }
    return 0;
}

int deepcopy_pet(pet *dest, pet *source, int mallocDest) {          
    if (mallocDest == YES) {
        dest->sex = (char*)malloc(sizeof(char) * STRLIM);
        if (dest->sex == NULL) {
            printf("failed to malloc dest->breed");
            exit(EXIT_FAILURE);
        }     
       
        dest->breed = (char*)malloc(sizeof(char) * STRLIM);
        if (dest->breed == NULL) {
            printf("failed to malloc dest->breed");
            exit(EXIT_FAILURE);
        }
        
        dest->pet_age = (age*)malloc(sizeof(age));
        if (dest->pet_age == NULL) {
            printf("failed to malloc dest->breed");
            exit(EXIT_FAILURE);
        }
    }
    dest->id = source->id;
    strcpy(dest->sex, source->sex);
    strcpy(dest->breed, source->breed);
    dest->pet_age->years = source->pet_age->years;
    dest->pet_age->months = source->pet_age->months;
    return 0;
}

以及head.h中结构的描述：

typedef struct age { 
    int years, months;
} age;

typedef struct pet {
    int id;
    char *sex;
    char *breed;
    age *pet_age;
} pet;

typedef struct petCatalog {
    pet *array;
    int size;//how many of them i got
    int cap;//how big is the array 
    //cap-count = empty_cells;
    int awaitDelete;
    int virginSlots;
} petCatalog;

Valgrind 输出（简化）：

==1260== Invalid write of size 8
==1260==    at 0x109621: deepcopy_pet (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x1094A9: delete (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x10A507: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==  Address 0x4a47108 is 8 bytes after a block of size 192 alloc'd
==1260==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1260==    by 0x10A3D2: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260== 
==1260== Invalid read of size 8
==1260==    at 0x109629: deepcopy_pet (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x1094A9: delete (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x10A507: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==  Address 0x4a47108 is 8 bytes after a block of size 192 alloc'd
==1260==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1260==    by 0x10A3D2: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260== 
==1260== Invalid write of size 8
==1260==    at 0x10965E: deepcopy_pet (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x1094A9: delete (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x10A507: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==  Address 0x4a47110 is 16 bytes after a block of size 192 alloc'd
==1260==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1260==    by 0x10A3D2: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260== 
==1260== Invalid read of size 8
==1260==    at 0x109666: deepcopy_pet (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x1094A9: delete (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x10A507: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==  Address 0x4a47110 is 16 bytes after a block of size 192 alloc'd
==1260==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1260==    by 0x10A3D2: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260== 
==1260== Invalid write of size 8
==1260==    at 0x10969B: deepcopy_pet (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x1094A9: delete (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==    by 0x10A507: main (in /mnt/c/Users/georg/Desktop/projects/strays/a.out)
==1260==  Address 0x4a47118 is 24 bytes after a block of size 192 in arena "client"
==1260== 

valgrind: m_mallocfree.c:305 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.

我真的不明白，为什么我应该在每个 malloc 中非法写入 8 个字节 deepcopy_pet() 函数，并在每次分配给这些变量之一时读取 8 个字节 我刚刚分配了？

我的问题是这样形成的，考虑到引用： “堆错误起源于以前的内存分配，但通常发生在一堆这些之后......”。

有什么建议吗？谢谢。

完整的源代码可在 GitHub here 上找到。
附：另外，一份备忘录可以帮助您（如果您愿意）了解删除变量名的算法。无论如何，它都是可选的，因为我希望您专注于堆损坏的解释。

Answer 1

你的代码太复杂了：你为什么要把pet结构放在数组的末尾？只需释放分配的字段，复制元素，如果低于某个阈值，可能会重新分配数组。深度复制在这里是多余的。为age 使用分配的结构似乎也没有必要，并且为字符串分配STRLIM 字节似乎既浪费又不安全，因为您不检查原始字符串长度是否最多为STRLIM-1。你应该改用strdup()。

这是一个简化版：

int delete(petCatalog *log, int idtoDelete) {
    //search to find which log has the id to delete.
    for (int i = 0; i < log->size; i++) {
        if (log->array[i].id == idtoDelete) {
            // free the element data
            free(log->array[i].sex);
            free(log->array[i].breed);
            free(log->array[i].pet_age);
            // copy the remaining elements over the deleted entry
            memmove(&log->array[i], &log->array[i + 1], (log->size - i - 1) * sizeof(log->array[i]));
            log->size--;
            if (log->cap - log->size >= DOWNLIM) {
                // shrink the array, cannot fail.
                int new_cap = log->size + 2; // what ever you shrink it to.
                pet *new_array = realloc(log->array, new_cap * sizeof(log->array[0]));
                if (new_array != NULL) {
                    log->array = new_array;
                    log->cap = new_cap;
                }
            }
            // no need to sort after deleting an element
            return 1;  // element was deleted
        }
    }
    return 0;  // element was not found
}