iPad App crashes only when it is launched manually (from springboard). Memory issue suspected

Question

I have been trying to solve this problem for 2 days now and it is driving me crazy. When Xcode launches the app it works fine, but If I manually launch the app from Springboard it crashes. The console prints out this:

Jan 20 15:26:29 unknown UIKitApplication:com.yourcompany.ThinClient[0x28cf][1119] <Notice>: ThinClient(1119,0x3db0000) malloc: *** error for object 0x643434: incorrect checksum for freed object - object was probably modified after being freed.
Jan 20 15:26:29 unknown UIKitApplication:com.yourcompany.ThinClient[0x28cf][1119] <Notice>: *** set a breakpoint in malloc_error_break to debug
Jan 20 15:26:29 unknown ThinClient[1119] <Error>: ThinClient(1119,0x3db0000) malloc: *** error for object 0x643434: incorrect checksum for freed object - object was probably modified after being freed.
    *** set a breakpoint in malloc_error_break to debug

The stack for the crashed thread (usually) looks like this, although sometimes it crashes in different spots:

Thread 5 Crashed:
0   libsystem_kernel.dylib          0x33d4da1c __pthread_kill + 8
1   libsystem_c.dylib               0x353523b4 pthread_kill + 52
2   libsystem_c.dylib               0x3534abf8 abort + 72
3   libsystem_c.dylib               0x3535e822 szone_error + 210
4   libsystem_c.dylib               0x3535e920 free_list_checksum_botch + 16
5   libsystem_c.dylib               0x35361722 tiny_malloc_from_free_list + 82
6   libsystem_c.dylib               0x35361e76 szone_malloc_should_clear + 166
7   libsystem_c.dylib               0x35362fd4 szone_malloc + 4
8   libsystem_c.dylib               0x35386230 malloc_zone_malloc + 48
9   libsystem_c.dylib               0x35386c2c malloc + 28
10  ThinClient                      0x0000590c -[MySocket readBytes:] (MySocket.m:231)
11  ThinClient                      0x00007b7e -[ThinServerTalker onSocket:readCallbackBytesWaiting:] (ThinServerTalker.m:362)
12  ThinClient                      0x000057e2 ReadDataCB (MySocket.m:201)
13  CoreFoundation                  0x33cca48a __CFSocketDoCallback + 334
14  CoreFoundation                  0x33ccb4a2 __CFSocketPerformV0 + 78
15  CoreFoundation                  0x33cc5a72 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 6
16  CoreFoundation                  0x33cc7758 __CFRunLoopDoSources0 + 376
17  CoreFoundation                  0x33cc84e4 __CFRunLoopRun + 224
18  CoreFoundation                  0x33c58ebc CFRunLoopRunSpecific + 224
19  CoreFoundation                  0x33c9b6d2 CFRunLoopRun + 42
20  ThinClient                      0x00005656 -[MySocket _connect] (MySocket.m:160)
21  Foundation                      0x33d71382 -[NSThread main] + 38
22  Foundation                      0x33de35c6 __NSThread__main__ + 966
23  libsystem_c.dylib               0x3535230a _pthread_start + 242
24  libsystem_c.dylib               0x35353bb4 thread_start + 0

I suspect its from the application writing to memory that has already been freed, so I have already tried a few things:

• I tried debugging the app with guard malloc, scribble, guard edges, zombie objects, malloc stack, etc..
• I tried going to the code where the app crashed and finding an issue there ( i do not believe there is an issue there because the app crashes at different places, but they are all near each other)
• I tried going through and commenting out all of my free() function calls.

I still have not found the problem! If anybody could please shed some light on this it would be much appreciated! Thanks! Any Suggestions?

Edit: The app will crash every time if it is launched from springboard, but if Xcode launches it, it will work fine.

Answer 1

I found the issue. I was returning a direct pointer to the bytes in a NSData object from a function. I simply replaced a function called "-(char*)getBytes" with a function called "-(NSData*)getDataCopy". Get data copy instead returns an autoreleased copy of the data class.

To reiterate:

I had this:

-(char*)getBytes{
    return _data.bytes;}

and I replaced it with this

-(NSData*)getDataCopy{
return [NSData dataWithData:_data];
}

The issue was I was writing to memory that had already been released.