C语言realloc()无效下一个大小错误排查求助

运行代码时出现以下错误：

realloc(): invalid next size
Aborted (core dumped)

需求是在循环中动态扩展初始malloc分配的数组，用于存储函数零点，但代码仅在第五次realloc前正常工作。

原始代码 #

#include <stdio.h>
#include <stdlib.h>
#include <math.h>

#define ARGMAX 5
#define ARGUMENTS_ERROR -3
#define REALLOC_FAILURE -2

typedef struct{
  double x;
  double y;
}point;

point Func(point p,double dt);
double Tzero(double x1,double x2,double dt,int i);

//START
int main(int argc,char* argv[]){

  int n,i,nzeri=0;
  point p,pp;
  double *tzeri, *temp;
  tzeri=(double *)malloc(0*sizeof(double));
  pp.x=atof(argv[1]);
  pp.y=atof(argv[2]);
  double dt=atof(argv[3]);
  double tmax=atof(argv[4]);

  n=(int)tmax/dt;
  for(i=0;i<n;i++){
    p=Func(pp,dt);
    printf("%lf %lf\n",dt*(i+1),p.x);
    if(pp.x*p.x<=0.){
      nzeri++;
      temp=(double *)realloc(tzeri,nzeri*sizeof(double));
      if(temp==NULL){
        printf("--------ERROR-------\nrealloc failed\n");
        exit(REALLOC_FAILURE);
      }
      tzeri[nzeri-1]=Tzero(pp.x,p.x,dt,i);
      printf("----------\n%d %lf\n----------\n",nzeri,tzeri[nzeri-1]);
    }
    
    pp.x=p.x;
    pp.y=p.y;
  }
  
}//END

point Func(point p,double dt){
  point p2;
  p2.x=p.x-0.1;
  if(p2.x<-3)p2.x=3.;
  return p2;
}

double Tzero(double x1,double x2,double dt,int i){
  double d,t;
  d=x1*dt/(x1-x2);
  t=dt*i+d;
  return t;
}

更新：AddressSanitizer检测日志 #

==6465==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000010 at pc 0x55fe8cdcc642 bp 0x7fff53fd3280 sp 0x7fff53fd3270                   
WRITE of size 8 at 0x602000000010 thread T0                                  
    #0 0x55fe8cdcc641 in main /home/gerry/Desktop/FisComp/2088811/error.c:42
    #1 0x7ff3aaa29d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #2 0x7ff3aaa29e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #3 0x55fe8cdcc244 in _start (/home/gerry/Desktop/FisComp/2088811/a.x+0x1244)

0x602000000011 is located 0 bytes to the right of 1-byte region [0x602000000010,0x602000000011)                                                           
freed by thread T0 here:                                                     
    #0 0x7ff3aaeb4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x55fe8cdcc5a6 in main /home/gerry/Desktop/FisComp/2088811/error.c:37
    #2 0x7ff3aaa29d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

previously allocated by thread T0 here:
    #0 0x7ff3aaeb4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55fe8cdcc3b6 in main /home/gerry/Desktop/FisComp/2088811/error.c:25
    #2 0x7ff3aaa29d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-use-after-free /home/gerry/Desktop/FisComp/2088811/error.c:42 in main
Shadow bytes around the buggy address:
  0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa[fd]fa fa fa 00 fa fa fa fa fa fa fa fa fa
  0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==6465==ABORTING

核心错误是realloc后没有更新tzeri指针：

当realloc需要扩展内存时，可能会在新地址分配更大的空间，同时释放原来的旧内存。你现在把新地址存在temp里，但tzeri仍然指向已经被释放的旧内存，后续写入tzeri[nzeri-1]就会触发ASan检测到的**堆内存释放后使用（heap-use-after-free）**错误，这也是realloc(): invalid next size的根源。

修复方法 #

在确认temp不为NULL后，必须将tzeri指向新的内存地址：

temp=(double *)realloc(tzeri,nzeri*sizeof(double));
if(temp==NULL){
    printf("--------ERROR-------\nrealloc failed\n");
    exit(REALLOC_FAILURE);
}
tzeri = temp; // 补上这行，更新tzeri指针
tzeri[nzeri-1]=Tzero(pp.x,p.x,dt,i);

额外优化 #

初始的tzeri=(double *)malloc(0*sizeof(double));虽然符合C标准，但部分实现可能返回NULL，更稳妥的写法是直接初始化为NULL——因为realloc(NULL, size)等价于malloc(size)，代码更健壮：

double *tzeri = NULL, *temp;

总结：补上tzeri = temp;后，tzeri始终指向有效的内存空间，就能解决内存错误问题。

内容的提问来源于stack exchange，提问作者Dario Rubriante