C VS2010 - Heap corruption freeing array of pointer on struct

Question

Hello world (hi people),

First, I'd say this is my first post, so please be clement.
As the title says, I've a heap corruption when I wants to free my object(s). I passed a couple of hours trying to fix it but I just can't see what's wrong even though I'm sure it's obvious!
So that's why I come to you.

My goal is to create some functions to (poorly) mimic some std::vector function in C. All objects are dynamically created. The implementation may be tricky due to the massive use of pointers.
I got the heap corruption when I free the vector object but I don't know if it comes from the pushBack or the destroy function.
Feel free to ask more information. Constructive comments are welcome!

Here is some piece of code:

Header content:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

typedef struct _array
{
    unsigned int size;
    int *pData;
} tArray, *ptArray;

typedef struct _vector
{
    unsigned int size;
    ptArray *pData;
} tVector, *ptVector;

ptArray createArray(unsigned int size);
void destroyArray(ptArray *pArray);

ptVector createVector();
int pushBackArray(ptVector pVector, ptArray pArrayToAppend);
int popBackArray(ptVector pVector);
void destroyVector(ptVector *pVector);

Main content:

int main(char argc, char *argv[])
{
    unsigned int size = 5, i;
    time_t seed = NULL;
    ptArray pArr = createArray(size);
    ptVector pVec = createVector();

    srand(seed);

    for(i = 0; i < pArr->size; i++)
    {
        pArr->pData[i] = rand() % 9 + 1;
    }

    //destroyVector(&pVec); //  Works at this point

    pushBackArray(pVec, pArr);

    destroyArray(&pArr);
    destroyVector(&pVec);   //  Heap corruption on free pVector->pData 

    getchar();
    return 0;
}

Body content:

ptArray createArray(unsigned int size)
{
    ptArray pArray = (ptArray)calloc(1, sizeof(tArray));

    if(pArray)
    {
        pArray->pData = (int*)malloc(size * sizeof(int));

        if(pArray->pData)
            pArray->size = size;
    }

    return pArray;
}

void destroyArray(ptArray *pArray)
{
    if(pArray)
    {
        free((*pArray)->pData);
        free((*pArray));
        (*pArray) = NULL;
    }
}

ptVector createVector()
{
    ptVector pVector = (ptVector)calloc(1, sizeof(*pVector));

    return pVector;
}

int pushBackArray(ptVector pVector, ptArray pArrayToAppend)
{
    int res = 0;

    if(pVector && pArrayToAppend)
    {
        pVector->pData = (ptArray*) realloc(pVector->pData
                                            , sizeof(ptArray) * pVector->size + 1);

        if(pVector->pData)
        {
            pVector->pData[pVector->size] = createArray(pArrayToAppend->size);

            if(pVector->pData[pVector->size])
            {
                memcpy(pVector->pData[pVector->size]->pData
                        , pArrayToAppend->pData
                        , pVector->pData[pVector->size]->size * sizeof(int));
                pVector->size++;
            }
            else
            {
                pVector->pData = (ptArray*) realloc(pVector->pData
                                                    , sizeof(ptArray) * pVector->size);
                res = 3;
            }
        }
        else
            res = 2;
    }
    else
        res = 1;

    return res;
}

void destroyVector(ptVector *pVector)
{   
    if(pVector)
    {
        unsigned int i;

        for(i = 0; i < (*pVector)->size; i++)
            destroyArray( &((*pVector)->pData[i]) );

        free((*pVector)->pData);  //    Heap Corruption throw
        free(*pVector);
        (*pVector) = NULL;
    }
}

Answer 1

specifying the size is incorrect at function pushBackArray

sizeof(ptArray) * pVector->size + 1

to

sizeof(ptArray) * (pVector->size + 1)