c - 尝试重新排序链表时 free() 无效

Question

我试图通过交换指针来重新排序链表。它一直有效，直到我尝试释放内存然后它给我一个错误。

通过交换数据而不是指针，我已经让它工作了，但我很好奇为什么这会导致我的内存出现问题。这是我的代码

typedef struct myArray {
    void *data;
    struct myArray *next;
} myArray_t;

int main(int argc, char **argv) {
    myArray *ma = paramsToList(argc, argv);
    revArray(&ma);
    printArray(ma);
    free(ma);
    return 0;
}

myArray_t *paramsToList(int ac, char *const *av) {
    myArray *ma = (myArray*)malloc((ac) * sizeof(myArray));
    int i = 0;
    while (i < ac) {
        ma[i].data = av[i];
        if (i < ac - 1) {
            ma[i].next = &ma[i + 1];
        } else {
            ma[i].next = NULL;
        }
        i++;
    }
    return ma;
}

void revArray(myArray_t **begin) {
    myArray *cur = begin[0];
    myArray *prev = NULL;
    myArray *next = cur->next;
    while (cur != NULL) {
        cur->next = prev;
        prev = cur;
        cur = next;
        if (cur != NULL) {
            next = cur->next;
        }
    }
    begin[0] = prev;
}

当我运行代码时出现这个错误

valgrind ./a.out one two three

three
two
one
./a.out
==3662== Invalid free() / delete / delete[] / realloc()
==3662==    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3662==    by 0x400604: main (example.c:20)
==3662==  Address 0x51fc070 is 48 bytes inside a block of size 64 alloc'd
==3662==    at 0x4C2AB80: malloc (in /usr/lib/valgrind    /vgpreload_memcheck-amd64-linux.so)
==3662==    by 0x40062B: paramsToList(int, char* const*) (example.c:26)
==3662==    by 0x4005DC: main (example.c:17)
==3662== 
==3662== 
==3662== HEAP SUMMARY:
==3662==     in use at exit: 64 bytes in 1 blocks
==3662==   total heap usage: 1 allocs, 1 frees, 64 bytes allocated
==3662== 
==3662== LEAK SUMMARY:
==3662==    definitely lost: 64 bytes in 1 blocks
==3662==    indirectly lost: 0 bytes in 0 blocks
==3662==      possibly lost: 0 bytes in 0 blocks
==3662==    still reachable: 0 bytes in 0 blocks
==3662==         suppressed: 0 bytes in 0 blocks
==3662== Rerun with --leak-check=full to see details of leaked memory
==3662== 
==3662== For counts of detected and suppressed errors, rerun with: -v
==3662== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

Answer 1

您只能向 free() 传递一个由 malloc()/realloc()/calloc() 返回的指针，并且您传递的节点是指向 ma 的指针加上一些偏移量，恰好是 &ma[ac - 1]。

您可以只更改节点的内容而不是节点本身，或者只编写一个普通的链表，其中每个节点都使用 malloc() 分配。