Why Won't free() Work?

Question

Im getting an error with free() every time I store input above the allocated space in the char*. Heres the error:

*** Error in ./input': free(): invalid next size (fast): 0x09713008 ***

When I remove the free(), the program runs perfectly even though I'm entering more than the allocated size. Why is this happening? How can I prevent it? Here is my code for reference:

int main(void){

  float x; // used to store the float the user entered.
  char c; // character used to check if the user entered a character after the float
  int loop=0;

  char * usr_input = malloc(50); //allocates memory to store the string from the stdin

  // loops until the user enters a float and only a float
  do{
    //gets the input string from stdin
    scanf("%s",usr_input);

    if(usr_input==NULL)
        printf("You've entered a large number that isnt supported. Please use at most 5 digits\n");

    // parses the input received and checks if the user entered a float and only a float.
    // breaks the loop if they did
    else if(sscanf(usr_input,"%f %c",&x,&c) == 1){
        if (x!=inf)
            loop=1;
        else
            printf("Input was too large. Try again");
    }

    // tells the user they entered invalid input. Loop value doesnt change so function loops again
    else{
        printf("Invalid input. Try again\n");
    }
  }

  while(loop==0); // condition for the loop
  free(usr_input);//crashes here
  return x; // returns the valid float that was entered
}

Answer 1

When I remove the free(), the program runs perfectly even though I'm entering more than the allocated size.

Entering more than allocated size is called undefined behavior. This is an error, despite the fact that your program may appear to be "running fine".

The main problem with undefined behavior is that your program does not fail fast. Essentially, the penalty for having undefined behavior is delayed until some future time - for example, when you allocate again, or when you free.

malloc stores some special information in the allocated block that lets free run. The "nvalid next size" error usually means that your code has written over some of that hidden block of data.

To fix this problem you need to change your code so that it never writes past the allocated length. If you are having trouble detecting precisely the spots that need to change, consider using valgrind or another memory profiler.

To prevent scanf from writing over your allocated size use the size in the format string:

scanf("%49s",usr_input); // Pass 49 for the length, because you have 50 bytes, and you need 1 byte for '\0'

Answer 2

the program runs perfectly even though I'm entering more than the allocated size.

No, it does not run perfectly. In fact, the error you get is caused by writing past the bounds of the allocated buffer. Its a buffer overrun and introduces undefined behavior. Your program may work or may crash immediately, though in most cases it will cause problems later, problems that may look completely unrelated and therefore will be very hard to identify and correct.

Make sure you allocate a buffer large enough not to overwrite it.

On the other hand, it makes no sense for you to allocate that small buffer on the heap. It can be a static buffer on the stack and you'd avoid problems with memory allocation and release.