C - String array realloc() memory errors

Question

I'm trying to split a long string into tokens, stored into a NULL terminated string array. To do this, I double the array size with realloc each time it's full. But valgrind is telling me that there are some important problems. Here's the code:

char** split_token(char* str,char* delimiter)
{
int token_buffer_size=256;
int nb_token=0;
char* token;
char** tab_token=calloc(token_buffer_size,sizeof(char*));
test_ptr(tab_token,PARAM_MACRO_TEST);
token=strtok(str,delimiter);
while(token!=NULL) 
{
    if(nb_token>=token_buffer_size)
    {
        token_buffer_size=token_buffer_size*2;
        tab_token=realloc(tab_token,token_buffer_size);
        test_ptr(tab_token,PARAM_MACRO_TEST);
    }
    printf("nb_token : %d\n",nb_token);
    tab_token[nb_token]=calloc(strlen(token)+1,sizeof(char));
    test_ptr(tab_token[nb_token],PARAM_MACRO_TEST);
    strncpy(tab_token[nb_token],token,sizeof(char)*strlen(token));
    nb_token++;
    token=strtok(NULL,delimiter);
}
tab_token[nb_token+1]=NULL;
return tab_token;
}

test_ptr() being a basic function testing if a ptr is NULL or not. The function is called with a long string to split (str), and a delimiter for strtok ("\n" here). When firing valgrind, here's what I get:

nb_token : 256
==8737== Invalid write of size 8
==8737==    at 0x59E8E98: split_token (parse.c:27)
==8737==    by 0x59EAA13: recdir (libplugin.c:439)
==8737==    by 0x401C09: execute_plugin (loadlib.c:53)
==8737==    by 0x400EF9: main (main.c:23)
==8737==  Address 0x5470ce0 is not stack'd, malloc'd or (recently) free'd
==8737== 
==8737== Invalid read of size 8
==8737==    at 0x59E8EB9: split_token (parse.c:28)
==8737==    by 0x59EAA13: recdir (libplugin.c:439)
==8737==    by 0x401C09: execute_plugin (loadlib.c:53)
==8737==    by 0x400EF9: main (main.c:23)
==8737==  Address 0x5470ce0 is not stack'd, malloc'd or (recently) free'd
==8737== 
==8737== Invalid read of size 8
==8737==    at 0x59E8EFA: split_token (parse.c:29)
==8737==    by 0x59EAA13: recdir (libplugin.c:439)
==8737==    by 0x401C09: execute_plugin (loadlib.c:53)
==8737==    by 0x400EF9: main (main.c:23)
==8737==  Address 0x5470ce0 is not stack'd, malloc'd or (recently) free'd
==8737== 
nb_token : 257

So, after reallocating the tab (thus having a size 512 tab_token), it seems that storing a string into tab_token[256] fails. I have absolutely no idea why. Thanks for your attention.

Answer 1

This:

tab_token=realloc(tab_token,token_buffer_size);

Should be:

tab_token=realloc(tab_token, token_buffer_size*sizeof(*tab_token));

calloc() uses item-count and item-size, but realloc() uses bytes. account for that in your resize.