double free error freeing 1000 bytes

Question

I've written little program to test allocation+access time inside the memory:

#include <stdio.h>
#include <stdlib.h>

int main (int argc, char *argv[])
{
    if (argc < 2)
    {
        printf("fail, %d args\n", argc);
        return 1;
    }

    char *a;
    int i;

    long long int stress_size = atoi(argv[1]);

    a = malloc(stress_size);
    printf("%Ld bytes allocated\n", stress_size);
    printf("a is here:     %p\n", a);
    for (i = 0; i < stress_size; ++i)
    {
        a++;
        *a = 4;
    }
    printf("a is here now: %p\n", a);

    a -= stress_size / sizeof(char);
    printf("back to original position\n");
    printf("a is here now: %p\n", a);
    printf("pre-free\n");
    free(a);
    printf("free ok\n");
    return 0;
} 

The program works even for high values (400M bytes), but it fails at the exacts number of bytes: 1000.

$ ./main 1000
1000 bytes allocated
a is here:     0x1c81010
a is here now: 0x1c813f8
back to original position
a is here now: 0x1c81010
pre-free
*** glibc detected *** ./main: double free or corruption (!prev): 0x0000000001c81010 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x76d76)[0x7f9133438d76]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f913343daac]
./main[0x4008cf]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7f91333e0ead]
./main[0x4006e9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:03 928478                             /home/alex/programmazione/c/memory_long_stress_test/main
00600000-00601000 rw-p 00000000 08:03 928478                             /home/alex/programmazione/c/memory_long_stress_test/main
01c81000-01ca2000 rw-p 00000000 00:00 0                                  [heap]
7f912c000000-7f912c021000 rw-p 00000000 00:00 0 
7f912c021000-7f9130000000 ---p 00000000 00:00 0 
7f91331ac000-7f91331c1000 r-xp 00000000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91331c1000-7f91333c1000 ---p 00015000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91333c1000-7f91333c2000 rw-p 00015000 08:03 1966084                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f91333c2000-7f9133542000 r-xp 00000000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133542000-7f9133742000 ---p 00180000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133742000-7f9133746000 r--p 00180000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133746000-7f9133747000 rw-p 00184000 08:03 1966099                    /lib/x86_64-linux-gnu/libc-2.13.so
7f9133747000-7f913374c000 rw-p 00000000 00:00 0 
7f913374c000-7f91337b3000 r-xp 00000000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91337b3000-7f91339b3000 ---p 00067000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91339b3000-7f91339bb000 rw-p 00067000 08:03 2502762                    /usr/lib/x86_64-linux-gnu/libgmp.so.10.0.5
7f91339bb000-7f9133a3c000 r-xp 00000000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133a3c000-7f9133c3b000 ---p 00081000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3b000-7f9133c3c000 r--p 00080000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3c000-7f9133c3d000 rw-p 00081000 08:03 1966096                    /lib/x86_64-linux-gnu/libm-2.13.so
7f9133c3d000-7f9133c5d000 r-xp 00000000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e37000-7f9133e3a000 rw-p 00000000 00:00 0 
7f9133e59000-7f9133e5c000 rw-p 00000000 00:00 0 
7f9133e5c000-7f9133e5d000 r--p 0001f000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e5d000-7f9133e5e000 rw-p 00020000 08:03 1966102                    /lib/x86_64-linux-gnu/ld-2.13.so
7f9133e5e000-7f9133e5f000 rw-p 00000000 00:00 0 
7fff41490000-7fff414b1000 rw-p 00000000 00:00 0                          [stack]
7fff41511000-7fff41512000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Continuing trying I discover that the same problem affect also values as: 200, 600, 1000, 1400, ... in general 400n + 200. I really don't understand why happens.

I compiled this using gcc (Debian 4.7.2-5) 4.7.2 under Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux.

Answer 1

You are writing one location past what you own. (See @Oli Charlesworth comment)

for (i = 0; i < stress_size; ++i)
{
    a++;  
    *a = 4;  // Bad: Setting array a_original[1] to a_original[stress_size].
}

Change to:

for (i = 0; i < stress_size; ++i)
{
    *a = 4;  // Setting array a_original[0] to a_original[stress_size-1].
    a++;  
}

BTW: Do you want a lower l here: printf("%Ld bytes allocated\n"...