free(): invalid next size (fast) in Cpp

Question

I get the following error when I try to compile the code below and I don't know why.. I try to delete an object and an array at the end, but when I do it gives me the above error (without those 2 lines it runs and works perfectly fine!). Any help would be appreciated.

#include "PascalsTriangle.h"
#include <stdio.h>
#include <cstdlib>
#include <string>
#include <iostream>
#include <sstream>

using namespace std;

struct error1 {};
struct error2 {};

int main(int argc, char** argv) {

        int n;

        try {
            istringstream ss1(argv[1]);
            if (!(ss1 >> n) || n<0) throw error1();
        }

        catch (...) {
            cout << argv[1] << " - error1" << endl;
            return 0;
        }

        PascalsTriangle* line = new PascalsTriangle(n);

        int* array = line->getTriangle();


        for(int i = 2; i < argc; i++)
        {
            int l;
            try
            {
        istringstream ss2(argv[i]);

        if (!(ss2 >> l)) throw error1();
        if(l < 0 || l > n) throw error2();
            }

            catch(error1&) {
                cout << argv[i] << " - error1" << endl;
                continue;
            }

            catch(error2&) {
                cout << argv[i] << " - error2" << endl;
                continue;
            }

            cout << l << " - " << array[l] << endl;
        }

    delete[] array;
    delete line;
        return 0;
}

the error:

*** Error in `./a.out': free(): invalid next size (fast): 0x000000000162b040 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x80a46)[0x7f464d5d0a46]
./a.out[0x40149e]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7f464d571ea5]
./a.out[0x400ed9]
======= Memory map: ========
00400000-00402000 r-xp 00000000 08:05 530557                             /home/dev/Desktop/lista2/c/a.out
00601000-00602000 r--p 00001000 08:05 530557                             /home/dev/Desktop/lista2/c/a.out
00602000-00603000 rw-p 00002000 08:05 530557                             /home/dev/Desktop/lista2/c/a.out
0162b000-0164c000 rw-p 00000000 00:00 0                                  [heap]
7f464d24b000-7f464d34e000 r-xp 00000000 08:05 786957                     /lib/x86_64-linux-gnu/libm-2.17.so
7f464d34e000-7f464d54e000 ---p 00103000 08:05 786957                     /lib/x86_64-linux-gnu/libm-2.17.so
7f464d54e000-7f464d54f000 r--p 00103000 08:05 786957                     /lib/x86_64-linux-gnu/libm-2.17.so
7f464d54f000-7f464d550000 rw-p 00104000 08:05 786957                     /lib/x86_64-linux-gnu/libm-2.17.so
7f464d550000-7f464d70f000 r-xp 00000000 08:05 786960                     /lib/x86_64-linux-gnu/libc-2.17.so
7f464d70f000-7f464d90e000 ---p 001bf000 08:05 786960                     /lib/x86_64-linux-gnu/libc-2.17.so
7f464d90e000-7f464d912000 r--p 001be000 08:05 786960                     /lib/x86_64-linux-gnu/libc-2.17.so
7f464d912000-7f464d914000 rw-p 001c2000 08:05 786960                     /lib/x86_64-linux-gnu/libc-2.17.so
7f464d914000-7f464d919000 rw-p 00000000 00:00 0 
7f464d919000-7f464d92d000 r-xp 00000000 08:05 784625                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f464d92d000-7f464db2d000 ---p 00014000 08:05 784625                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f464db2d000-7f464db2e000 r--p 00014000 08:05 784625                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f464db2e000-7f464db2f000 rw-p 00015000 08:05 784625                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7f464db2f000-7f464dc14000 r-xp 00000000 08:05 400616                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17
7f464dc14000-7f464de13000 ---p 000e5000 08:05 400616                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17
7f464de13000-7f464de1b000 r--p 000e4000 08:05 400616                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17
7f464de1b000-7f464de1d000 rw-p 000ec000 08:05 400616                     /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17
7f464de1d000-7f464de32000 rw-p 00000000 00:00 0 
7f464de32000-7f464de55000 r-xp 00000000 08:05 784516                     /lib/x86_64-linux-gnu/ld-2.17.so
7f464e036000-7f464e03b000 rw-p 00000000 00:00 0 
7f464e050000-7f464e054000 rw-p 00000000 00:00 0 
7f464e054000-7f464e055000 r--p 00022000 08:05 784516                     /lib/x86_64-linux-gnu/ld-2.17.so
7f464e055000-7f464e057000 rw-p 00023000 08:05 784516                     /lib/x86_64-linux-gnu/ld-2.17.so
7ffff88fc000-7ffff891d000 rw-p 00000000 00:00 0                          [stack]
7ffff89fe000-7ffff8a00000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted (core dumped)

Valgrind with --leak-check=full

==30110== Memcheck, a memory error detector
==30110== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==30110== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==30110== Command: ./a.out 5 4
==30110== 
--30110-- Valgrind options:
--30110--    --suppressions=/usr/lib/valgrind/debian-libc6-dbg.supp
--30110--    --leak-check=full
--30110--    -v
--30110-- Contents of /proc/version:
--30110--   Linux version 3.8.0-31-generic (buildd@panlong) (gcc version 4.7.3 (Ubuntu/Linaro 4.7.3-1ubuntu1) ) #46-Ubuntu SMP Tue Sep 10 20:03:44 UTC 2013
--30110-- Arch and hwcaps: AMD64, amd64-sse3-cx16-avx
--30110-- Page sizes: currently 4096, max supported 4096
--30110-- Valgrind library directory: /usr/lib/valgrind
--30110-- Reading syms from /home/dev/Desktop/lista2/c/a.out
--30110-- Reading syms from /lib/x86_64-linux-gnu/ld-2.17.so
--30110--   Considering /lib/x86_64-linux-gnu/ld-2.17.so ..
--30110--   .. CRC mismatch (computed 5d246d73 wanted cbf42dbe)
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/ld-2.17.so ..
--30110--   .. CRC is valid
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/ld-2.17.so ..
--30110--   .. CRC is valid
--30110-- Reading syms from /usr/lib/valgrind/memcheck-amd64-linux
--30110--   Considering /usr/lib/valgrind/memcheck-amd64-linux ..
--30110--   .. CRC mismatch (computed 8dadd6e3 wanted 096f8488)
--30110--    object doesn't have a symbol table
--30110--    object doesn't have a dynamic symbol table
--30110-- Scheduler: using generic scheduler lock implementation.
--30110-- Reading suppressions file: /usr/lib/valgrind/debian-libc6-dbg.supp
--30110-- Reading suppressions file: /usr/lib/valgrind/default.supp
==30110== embedded gdbserver: reading from /tmp/vgdb-pipe-from-vgdb-to-30110-by-dev-on-???
==30110== embedded gdbserver: writing to   /tmp/vgdb-pipe-to-vgdb-from-30110-by-dev-on-???
==30110== embedded gdbserver: shared mem   /tmp/vgdb-pipe-shared-mem-vgdb-30110-by-dev-on-???
==30110== 
==30110== TO CONTROL THIS PROCESS USING vgdb (which you probably
==30110== don't want to do, unless you know exactly what you're doing,
==30110== or are doing some strange experiment):
==30110==   /usr/lib/valgrind/../../bin/vgdb --pid=30110 ...command...
==30110== 
==30110== TO DEBUG THIS PROCESS USING GDB: start GDB like this
==30110==   /path/to/gdb ./a.out
==30110== and then give GDB the following command
==30110==   target remote | /usr/lib/valgrind/../../bin/vgdb --pid=30110
==30110== --pid is optional if only one valgrind process is running
==30110== 
--30110-- REDIR: 0x4018f40 (strlen) redirected to 0x3806c7e1 (???)
--30110-- Reading syms from /usr/lib/valgrind/vgpreload_core-amd64-linux.so
--30110--   Considering /usr/lib/valgrind/vgpreload_core-amd64-linux.so ..
--30110--   .. CRC mismatch (computed 7ae7d82a wanted 34ea3d89)
--30110--    object doesn't have a symbol table
--30110-- Reading syms from /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so
--30110--   Considering /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so ..
--30110--   .. CRC mismatch (computed 272279e5 wanted bc83f658)
--30110--    object doesn't have a symbol table
--30110-- REDIR: 0x4018db0 (index) redirected to 0x4c2d440 (index)
--30110-- REDIR: 0x4018e30 (strcmp) redirected to 0x4c2e480 (strcmp)
--30110-- Reading syms from /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17
--30110--   Considering /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17 ..
--30110--   .. CRC mismatch (computed 397a007e wanted 2d914133)
--30110--    object doesn't have a symbol table
--30110-- Reading syms from /lib/x86_64-linux-gnu/libgcc_s.so.1
--30110--   Considering /lib/x86_64-linux-gnu/libgcc_s.so.1 ..
--30110--   .. CRC mismatch (computed 3e210681 wanted d01e18f4)
--30110--    object doesn't have a symbol table
--30110-- Reading syms from /lib/x86_64-linux-gnu/libc-2.17.so
--30110--   Considering /lib/x86_64-linux-gnu/libc-2.17.so ..
--30110--   .. CRC mismatch (computed 08d04634 wanted e58fe8a7)
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.17.so ..
--30110--   .. CRC is valid
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.17.so ..
--30110--   .. CRC is valid
--30110-- Reading syms from /lib/x86_64-linux-gnu/libm-2.17.so
--30110--   Considering /lib/x86_64-linux-gnu/libm-2.17.so ..
--30110--   .. CRC mismatch (computed 0f18ff95 wanted 109dbed1)
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libm-2.17.so ..
--30110--   .. CRC is valid
--30110--   Considering /usr/lib/debug/lib/x86_64-linux-gnu/libm-2.17.so ..
--30110--   .. CRC is valid
--30110-- REDIR: 0x53daa30 (strcasecmp) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x53d6dc0 (strnlen) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x53dcd00 (strncasecmp) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x53d9840 (memset) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x53d97f0 (memcpy@GLIBC_2.2.5) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x53d87b0 (__GI_strrchr) redirected to 0x4c2d260 (__GI_strrchr)
--30110-- REDIR: 0x53d6ce0 (__GI_strlen) redirected to 0x4c2d7c0 (__GI_strlen)
--30110-- REDIR: 0x53d51a0 (strcmp) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x54867c0 (__strcmp_sse42) redirected to 0x4c2e3e0 (strcmp)
--30110-- REDIR: 0x53d6c90 (strlen) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x54b72f0 (__strlen_sse2_pminub) redirected to 0x4c2d7a0 (strlen)
--30110-- REDIR: 0x4e93650 (operator new(unsigned long)) redirected to 0x4c2c740 (operator new(unsigned long))
--30110-- REDIR: 0x4e91950 (operator delete(void*)) redirected to 0x4c2b530 (operator delete(void*))
--30110-- REDIR: 0x4e93760 (operator new[](unsigned long)) redirected to 0x4c2bfd0 (operator new[](unsigned long))
==30110== Invalid write of size 4
==30110==    at 0x401110: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:42)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110==  Address 0x5a1b164 is 0 bytes after a block of size 20 alloc'd
==30110==    at 0x4C2C037: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30110==    by 0x4010D8:PascalsTriangle::PascalsTriangle(int) (WierszTrojkataPascala.cpp:39)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110== 
--30110-- REDIR: 0x4e91980 (operator delete[](void*)) redirected to 0x4c2afb0 (operator delete[](void*))
==30110== Invalid write of size 4
==30110==    at 0x401146: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:45)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110==  Address 0x5a1b164 is 0 bytes after a block of size 20 alloc'd
==30110==    at 0x4C2C037: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30110==    by 0x4010D8: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:39)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110== 
--30110-- REDIR: 0x53df3e0 (memcpy@@GLIBC_2.14) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x549c6b0 (__memcpy_ssse3_back) redirected to 0x4c2e7b0 (memcpy@@GLIBC_2.14)
--30110-- REDIR: 0x53d9200 (bcmp) redirected to 0x4a25710 (_vgnU_ifunc_wrapper)
--30110-- REDIR: 0x54b1c20 (__memcmp_sse4_1) redirected to 0x4c2f570 (bcmp)
4 - 5
--30110-- REDIR: 0x53d09b0 (free) redirected to 0x4c2ba00 (free)
==30110== 
==30110== HEAP SUMMARY:
==30110==     in use at exit: 0 bytes in 0 blocks
==30110==   total heap usage: 11 allocs, 11 frees, 260 bytes allocated
==30110== 
==30110== All heap blocks were freed -- no leaks are possible
==30110== 
==30110== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)
==30110== 
==30110== 1 errors in context 1 of 2:
==30110== Invalid write of size 4
==30110==    at 0x401146: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:45)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110==  Address 0x5a1b164 is 0 bytes after a block of size 20 alloc'd
==30110==    at 0x4C2C037: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30110==    by 0x4010D8: WierszTrojkataPascala::WierszTrojkataPascala(int) (WierszTrojkataPascala.cpp:39)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110== 
==30110== 
==30110== 1 errors in context 2 of 2:
==30110== Invalid write of size 4
==30110==    at 0x401110: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:42)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110==  Address 0x5a1b164 is 0 bytes after a block of size 20 alloc'd
==30110==    at 0x4C2C037: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==30110==    by 0x4010D8: PascalsTriangle::PascalsTriangle(int) (PascalsTriangle.cpp:39)
==30110==    by 0x4012D4: main (main.cpp:27)
==30110== 
--30110-- 
--30110-- used_suppression:      2 dl-hack3-cond-1
==30110== 
==30110== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 2 from 2)

PascalsTriangle class:

#include "PascalsTriangle.h"
#include <stdio.h>
#include <cstdlib>
#include <string>
#include <iostream>
#include <sstream>

using namespace std;

int lineNr;
int* triangle;

int PascalsTriangle::coeff(int m)
{
        int n=lineNr;
        int* aux= new int[n+1];

        aux[0]=1;

        for(int i=1; i<=n; i++)
        {
            aux[i]=1;
            for(int l=i-1; l>0; l--)
            {
                aux[l]=aux[l]+aux[l-1];
            }
        }

    int coeff=aux[m];
    delete [] aux;
        return coeff;
}


int* PascalsTriangle::getTrangle() {return triangle;}

PascalsTriangle::PascalsTriangle(int n)
{
        triangle=new int[n];
        lineNr=n;

        triangle[0] = 1; triangle[n] = 1;

        for(int i = 1; i <= n; i++)
                triangle[i] = coeff(i);
}

Answer 1

You seem to forget that indexing of arrays, allocated like arrays or from the heap with new, are indexed from zero to size minus one.

In the PascalsTriangle constructor you have a loop from one n (inclusive) but the index of triangle is from zero to n - 1.

You have the same misunderstanding in a loop in PascalsTriangle::coeff as well.

---

By having aloop from 1 to n (inclusive) you overwrite the allocated memory, and writing beyond allocated memory leads to undefined behavior. In this case it seems that you have a memory allocator which checks for overwrites like these, and adds a special value beyond the memory you allocate. If that value is not correct when calling delete (which calls free) you will get a runtime error.