You are overwriting beyond the bounds of array here:
rev[len] = '\0';
You have allocated only len
chars. Instead you can allocate len +1
chars.
Thus causing undefined behaviour. This probably resulted the corruption of meta data which results in free()
's failure.
Also, don't cast the return of malloc()/calloc()
etc. You should also check whether calloc()
succeeded.