Question

我有结构，我为它分配内存：

TRANSITION *transitions = malloc(sizeof(TRANSITION *));

我在程序的另一部分添加了转换，所以我重新分配了内存：

TRANSITION *transitions = source->transitions;
transitions = realloc(transitions, (numberTransitions + 1) * sizeof(TRANSITION *));

我有一种想释放记忆的方法：

free(transitions);

当我调用免费方法时，我得到：

"Aborted (core dumped)"

有什么问题？

整个代码：

#include <stdio.h>
#include <stdbool.h>
#include <stdlib.h>
#include <string.h>

typedef struct STATE STATE;
typedef struct TRANSITION TRANSITION;

struct STATE
{
    char name[4];
    bool initial_state;
    bool final_state;
    TRANSITION *transitions;
    int numberTransitions;
};

struct TRANSITION
{
    char c;
    STATE *destination;
};

STATE *create_state(char *name, bool is_initial, bool is_final);
void add_transition(STATE *source, char sign, STATE *dest);
void destroy_state(STATE **pp_state);

int main(void)
{
  STATE *state0 = create_state("S'0", true, false);
STATE *state1 = create_state("S'1", false, false);
STATE *state2 = create_state("S'2", false, true);
STATE *zero_state = create_state("0", false, false);

add_transition(state0, 'a', state1);
add_transition(state0, 'b', zero_state);

add_transition(zero_state, 'a', zero_state);
add_transition(zero_state, 'b', zero_state);

add_transition(state1, 'a', state1);
add_transition(state1, 'b', state2);

add_transition(state2, 'a', state1);
add_transition(state2, 'b', state2);
destroy_state(&state0);
}

STATE *create_state(char *name, bool is_initial, bool is_final)
{
    STATE *state = malloc(sizeof(STATE *));
    strcpy(state->name, name);
    state->initial_state = is_initial;
    state->final_state = is_final;
    state->transitions = NULL;
    state->numberTransitions = 0;
    return state;
}

void add_transition(STATE *source, char sign, STATE *dest)
{
    if (source->transitions == NULL)
    {

        TRANSITION *transitions = malloc(sizeof(TRANSITION *));
        transitions->c = sign;
        transitions->destination = malloc(sizeof(STATE *));
        transitions->destination = dest;
        source->transitions = transitions;
        source->numberTransitions = 1;
    }
    else
    {
        TRANSITION *transitions = source->transitions;
        int numberTransitions = source->numberTransitions;
        transitions = realloc(transitions, (numberTransitions + 1) * sizeof(TRANSITION *));
        transitions[numberTransitions].c = sign;
        transitions[numberTransitions].destination = dest;
        (source->numberTransitions)++; 
    }
}

void destroy_state(STATE **pp_state)
{
    TRANSITION *transitions = (*pp_state)->transitions;
    // free(transitions->destination);
    // transitions->destination = NULL;
    free(transitions);
    // transitions = NULL;
    // free(pp_state);
    // pp_state = NULL;

}

Answer 1

我认为你想要malloc sizeof（TRANSITION）而不是sizeof（TRANSITION *）。首先是分配TRANSITION结构的大小，第二个只是mallocs指针的大小，可能小于结构大小。

Answer 2

我更喜欢像这样调用malloc：

T *t = malloc(sizeof(*t));

这样你的分配总是指针所指向的对象的大小。

这当然等同于：

T *t = malloc(sizeof(T));

但避免在t类型发生变化时出错。

Answer 3

修复分配后，您需要将realloc的返回值存储在source中。您还需要检查分配是否成功。

目前您将旧指针保留在source中，因此当您尝试释放内存时，该块已被释放，并且实际分配的内存已泄漏，因为它未存储在任何位置。

错误的分配大小或错误使用免费方法？

3 个答案: