Heap corruption during free()

Question

Here is the Debug information,

HEAP[opencv_CoTraining2.exe]: Heap block at 0AD15168 modified at 0AD15594 past requested  size of 424
Windows has triggered a breakpoint in opencv_CoTraining2.exe.

This may be due to a corruption of the heap, which indicates a bug in opencv_CoTraining2.exe or any of the DLLs it has loaded.

This may also be due to the user pressing F12 while opencv_CoTraining2.exe has focus.

The output window may have more diagnostic information.

and here is my code:

void GetKCent(Mat& mat)
{
    double** tmp=(double**)calloc(mat.rows,sizeof(double*));
    double f[128];
    memset(f,0,sizeof(f));
    double max=0;
    for (int i=0;i<mat.rows;i++) 
    {
        tmp[i]=(double*)calloc(mat.cols,sizeof(double));
        for (int j=0;j<mat.cols;j++)
        {
                tmp[i][j]=mat.at<float>(i,j);
                if (tmp[i][j]>max) max=tmp[i][j];
        }
    }
    for (int i=0;i<mat.cols;i++) for (int j=0;j<mat.rows;j++) tmp[j][i]/=max;
    k_means(tmp,mat.rows,128,K_CLUSTER,KMEANSDIS,kcent);
    for (int i=0;i<K_CLUSTER;i++) for (int j=0;j<128;j++) kcent[i][j]*=max;
    for (int i=0;i<mat.rows;i++)free(tmp[i]);
    free(tmp);
}

The fault ocurred in this line,

for (int i=0;i<mat.rows;i++)free(tmp[i]);

and the function k_means() doesn't change the first parameter. Who can help me?

P.S. Here is the definition of k_means()

int k_means(double **data, int n, int m, int k, double t, double **centroids)

and here is the _double** kcent_

kcent=(double**)calloc(K_CLUSTER,sizeof(double*));
for (int i=0;i<K_CLUSTER;i++) kcent[i]=(double*)calloc(128,sizeof(double));

I think this part is correctly.

Answer 1

The error message seems to be very clear that that it is heap corruption.

Try to move the free() for loop, above the function call k_means() and comment out the rest of your program.

I am suspicious that this is what corrupting the Heap!

If this experiment frees the memory correctly, You know the bug is in k_means() function...

Answer 2

you dont use pointer address you got from calloc in free, therefore memory start address pointed by free() argument differs. If i am not wrong you can't get whole bunch of memory then free them in parts , if this is what are you trying to achieve. At least with malloc.

In free() use same value what you got from calloc().