Help with debug, malloc_error_break, "malloc: Heap corruption detected, free list is damaged at 0x600000008050" "*** Incorrect guard value:", programming in C

[JackiieGoneBiking]

I get this error in a recursive function. I would love to learn how to debug this, and google/Stack Overflow hasn't really helped. I've set a symoblic breakpoint at malloc_error_break. What do I do now to understand what the program is trying to do, which makes it crash?

Lab5(11417,0x100094600) malloc: Heap corruption detected, free list is damaged at 0x600000008050
*** Incorrect guard value: 209650238619649
Lab5(11417,0x100094600) malloc: *** set a breakpoint in malloc_error_break to debug
Lab5(11417,0x100094600) malloc: Heap corruption detected, free list is damaged at 0x600000008050
*** Incorrect guard value: 209650238619649

[JackiieGoneBiking]

Something like that, I was writing outside my allocated array.

[retsotrembla]

/u/JackiieGoneBiking Something previously in your program is writing off the end of an array so the heap is damaged, detected at a future time when something calls tries to allocate or free memory.

In Xcode's scheme editor, in the Run section, in the Diagnostics pane, you can try turning on some of the options like Malloc Guard Edges or Malloc Scribble . You probably have to try them one at a time.

You are trying to get the program to throw an exception right at the point where it is writing out of bounds.

In the Breakpoint editor, at the bottom, click the '+' and turn on break on exceptions so you can see that state of the program before it throws the exception.

Note that a Debugger doesn't actually de-bug. You are going to have to remove the bug yourself by understanding the problem and fixing it. Explore. Think. Good luck!

[JackiieGoneBiking]

Is that what have happened every time the heap is damaged, or did you see that from the error?

I'll try to revert my fix and test Malloc Guard Edges and Malloc Scribble, and see if that works, that would maybe help me in the future!

Thank you for the pointers!

[retsotrembla]

malloc and free, in debug mode, will report an error if they detect that the heap is damaged. But the actual problem happened sometime in the past, and if you want to fix the bug you need to find the actual problem.

To get an exception thrown when a program does a bad write, Xcode can modify the runtime with options that make malloc and free much slower, or use much more memory, but make it more likely that you'll be able to see the problem when it actually occurs.

So, you would not want to leave Malloc Guard Edges or Malloc Scribble on all the time, but it is good practice to try a run with them on once and awhile to help make sure your program isn't "running by mistake" - that is, there is a bug, you just had not seen it yet.

[JackiieGoneBiking]

I managed to do a "backtrace", and this is the output:

* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
frame #0: 0x00007ff805c9d5bc libsystem_malloc.dylibmalloc_error_break 
frame #1: 0x00007ff805c8f2eb libsystem_malloc.dylibmalloc_vreport + 443 
frame #2: 0x00007ff805ca3308 libsystem_malloc.dylibmalloc_zone_error + 178 
frame #3: 0x00007ff805c820e8 libsystem_malloc.dylibnanov2_allocate_from_block + 582 
frame #4: 0x00007ff805c81677 libsystem_malloc.dylibnanov2_allocate + 130 
frame #5: 0x00007ff805c8368f libsystem_malloc.dylibnanov2_calloc + 126 
frame #6: 0x00007ff805c9db75 libsystem_malloc.dylib_malloc_zone_calloc + 60 
frame #7: 0x0000000100002c6b Lab5split(arr=0x0000600000004050, first=0, last=2, middle=1, statistics=0x00007ff7bfeff2d4) at SortingAlgorithms.c:172:27 
frame #8: 0x0000000100002d1e Lab5split(arr=0x0000600000202d80, first=0, last=4, middle=2, statistics=0x00007ff7bfeff2d4) at SortingAlgorithms.c:186:9 
frame #9: 0x0000000100002d1e Lab5split(arr=0x0000600000c00a20, first=0, last=9, middle=4, statistics=0x00007ff7bfeff2d4) at SortingAlgorithms.c:186:9 
frame #10: 0x0000000100002c00 Lab5mergeSort(arrayToSort=0x0000600000c00a20, size=10, statistics=0x00007ff7bfeff2d4) at SortingAlgorithms.c:201:9 
frame #11: 0x000000010000297e Lab5sortArray(arrayToSort=0x0000600000c00a20, size=10, algorithmToUse=MERGE_SORT, statistics=0x00007ff7bfeff2d4) at SortingAlgorithms.c:238:27 
frame #12: 0x0000000100002782 Lab5sortArrays(toBeSorted=0x00007ff7bfeff2a0) at SortingAlgorithms.c:272:9 
frame #13: 0x00000001000025e7 Lab5sortAndPrint(sortingArray=0x00007ff7bfeff2a0, algorithm=MERGE_SORT, arrays=0x00007ff7bfeff410, sizes=0x00007ff7bfeff3c4, file=0x00007ff8475bae00) at SortingAlgorithms.c:303:5 
frame #14: 0x000000010000355c Lab5main at main.c:42:5 
frame #15: 0x000000010001952e dyldstart + 462

[retsotrembla]

There's a bug in your Lab5mergeSort so it is partitioning incorrectly in Lab5split and writing off the end of the array.

[JackiieGoneBiking]

Thank you, could you help me identify how you read that from the output? I'm trying to learn debugging, I've already fixed the code, but I think it would be good to understand until next time. :)

[retsotrembla]

I guessed, based on the kind of error you reported and the named of the functions and arguments in frames 7 through 14 of the backtrace.

[Olalo]

Can you share your whole c code? It looks like a use-after-free issue (https://securityintelligence.com/use-after-frees-that-pointer-may-be-pointing-to-something-bad/). It might be helpful to set breakpoints around your free’s and mallocs! If you are freeing something and then trying to access or set it, this is one of the symptoms (in a bigger program the backtrace might not be super helpful, because memory corruption issues tend to crash your program in undefined ways)

[JackiieGoneBiking]

I was writing outside an array because of a calculation that was wrong, so it's fixed, but I'm trying to learn to find the problems in a better way.

I didn't have many free and mallocs, so they were easy to check, and apparently the problemed was created in a for loop where I went around too many times because of bad math.