"Corrupted double-linked list" when using malloc() on a 2D array in a structure - malloc

Question

I'm trying to make a small autoCompletion program.
I'm taking strings from a file and put them line by line in a 2D char type array.
This is my code :
Dictionnary.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "Dictionnary.h"
int getDictionnarySize(FILE *theDictionnary)
{
size_t pos = ftell(theDictionnary);
fseek(theDictionnary, 0, SEEK_END);
size_t len = ftell(theDictionnary);
fseek(theDictionnary, pos, SEEK_SET);
return (len);
}
int getNbLines(char *buff)
{
int lines = 1;
int i = 0;
while (buff[i] != '\0')
{
if (buff[i] == '\n')
lines++;
i++;
}
return (lines);
}
int allocDictionnary(t_dictionnary *d, char *buff)
{
d->lines = getNbLines(buff) - 1;
int i;
char str[2048];
int len;
rewind(d->dico);
d->dictionnary = malloc(sizeof(*d->dictionnary) * d->lines);
for (i = 0; i <= d->lines; i++)
{
memset(str, 0, 2048);
fgets(str, 256, d->dico);
len = strlen(str);
printf("len = %d\n", len);
d->dictionnary[i] = malloc(sizeof(**d->dictionnary) * len);
if (d->dictionnary[i] == NULL)
return (1);
strcpy(d->dictionnary[i], str);
printf("String is : %s\n", d->dictionnary[i]);
}
return (0);
}
int initDictionnary(t_dictionnary *d)
{
int size;
char *buff;
if ((d->dico = fopen(d->theDictionnary, "r")) != NULL)
{
size = getDictionnarySize(d->dico);
buff = malloc(size + 1);
fread(buff, size, 1, d->dico);
allocDictionnary(d, buff);
fclose(d->dico);
}
else
{
return (1);
}
free(buff);
return (0);
}
int killDictionnary(char **theDictionnary, int size)
{
int i = 0;
while (i <= size)
{
free(theDictionnary[i]);
i++;
}
free(theDictionnary);
return (0);
}
Dictionnary.h
#ifndef __DICTIONNARRY_H__
# define __DICTIONNARY_H___
/* STRUCTURES */
typedef struct s_dictionnary
{
const char *theDictionnary;
FILE *dico;
char **dictionnary;
int lines;
} t_dictionnary;
/* PROTOTYPES */
int getDictionnarySize(FILE *theDictionnary);
int allocDictionnary(t_dictionnary *d, char *buff);
int initDictionnary(t_dictionnary *dico);
int getNbLines(char *buff);
int killDictionnary(char **theDictionnary, int size);
#endif /* __DICTIONNARY_H__ */
main.c
#include <stdlib.h>
#include <stdio.h>
#include "Dictionnary.h"
int main(int ac, char **av)
{
t_dictionnary d;
d.theDictionnary = "./miniDico";
initDictionnary(&d);
killDictionnary(d.dictionnary, d.lines);
return (0);
}
When I compile, i don't have any errors or warnings.
But when I run this I get :
*** Error in `./a.out': corrupted double-linked list: 0x0000000000f19550 ***
Valgrind result :
==4004== Memcheck, a memory error detector
==4004== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==4004== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==4004== Command: ./a.out
==4004==
==4004== Conditional jump or move depends on uninitialised value(s)
==4004== at 0x40095C: getNbLines (Dictionnary.c:22)
==4004== by 0x40098B: allocDictionnary (Dictionnary.c:34)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
len = 35
==4004== Invalid write of size 1
==4004== at 0x4C2D623: strcpy (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x400AB8: allocDictionnary (Dictionnary.c:50)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d8723 is 0 bytes after a block of size 35 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x400A61: allocDictionnary (Dictionnary.c:47)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
==4004== Invalid read of size 1
==4004== at 0x4E7E1C2: vfprintf (in /usr/lib/libc-2.21.so)
==4004== by 0x4E84E38: printf (in /usr/lib/libc-2.21.so)
==4004== by 0x400AE5: allocDictionnary (Dictionnary.c:51)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d8723 is 0 bytes after a block of size 35 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x400A61: allocDictionnary (Dictionnary.c:47)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
String is : Paris, 458 boulevard Saint-Germain
len = 35
String is : Paris, 343 boulevard Saint-Germain
len = 44
String is : Marseille, 343 boulevard Camille Flammarion
len = 37
String is : Marseille, 29 rue Camille Desmoulins
len = 34
String is : Marseille, 1 chemin des Aubagnens
len = 25
String is : Paris, 12 rue des singes
len = 24
String is : Paris, 34 quai VoLtAiRe
len = 23
String is : Paris, 34 rue Voltaire
len = 33
String is : Lille, 120 boulevard Victor Hugo
len = 27
String is : Marseille, 50 rue Voltaire
len = 26
String is : Toulouse, 90 rue Voltaire
len = 30
String is : Strasbourg 84 rue du Bouclier
len = 42
String is : Marseille, 78 boulevard de la libération
len = 27
String is : Lille, 30 rue Victor Danel
len = 38
String is : Mont Saint Martin, 42 rue de Bordeaux
len = 47
String is : Mont de Marsan, 100 avenue Pierre de Coubertin
len = 35
String is : Strasbourg, 391 boulevard de Nancy
len = 38
String is : Lyon, 56 rue du Docteur Albéric Pont
len = 35
String is : Lyon, rue du Docteur Albéric Pont
len = 38
String is : 56 rue du Docteur Albéric Pont, Lyon
len = 19
String is : Lyon 56 grande rue
len = 24
String is : Lille, 90 rue d’Arras
len = 35
String is : Lille, 76 impasse Georges Pompidou
len = 25
==4004== Invalid write of size 8
==4004== at 0x400A62: allocDictionnary (Dictionnary.c:47)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d86b8 is 0 bytes after a block of size 184 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x4009C3: allocDictionnary (Dictionnary.c:40)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
==4004== Invalid read of size 8
==4004== at 0x400A7D: allocDictionnary (Dictionnary.c:48)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d86b8 is 0 bytes after a block of size 184 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x4009C3: allocDictionnary (Dictionnary.c:40)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
==4004== Invalid read of size 8
==4004== at 0x400AA4: allocDictionnary (Dictionnary.c:50)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d86b8 is 0 bytes after a block of size 184 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x4009C3: allocDictionnary (Dictionnary.c:40)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
==4004== Invalid read of size 8
==4004== at 0x400AD1: allocDictionnary (Dictionnary.c:51)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004== Address 0x51d86b8 is 0 bytes after a block of size 184 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x4009C3: allocDictionnary (Dictionnary.c:40)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
String is : Lyon, 2 allée des fleurs
==4004== Invalid read of size 8
==4004== at 0x400BF6: killDictionnary (Dictionnary.c:85)
==4004== by 0x400C53: main (main.c:11)
==4004== Address 0x51d86b8 is 0 bytes after a block of size 184 alloc'd
==4004== at 0x4C29F90: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4004== by 0x4009C3: allocDictionnary (Dictionnary.c:40)
==4004== by 0x400B9F: initDictionnary (Dictionnary.c:67)
==4004== by 0x400C42: main (main.c:10)
==4004==
==4004==
==4004== HEAP SUMMARY:
==4004== in use at exit: 0 bytes in 0 blocks
==4004== total heap usage: 27 allocs, 27 frees, 2,289 bytes allocated
==4004==
==4004== All heap blocks were freed -- no leaks are possible
==4004==
==4004== For counts of detected and suppressed errors, rerun with: -v
==4004== Use --track-origins=yes to see where uninitialised values come from
==4004== ERROR SUMMARY: 54 errors from 8 contexts (suppressed: 0 from 0)

Answer 1

Maybe this loop causing troubles:
for (i = 0; i <= d->lines; i++)
It seems that it should be (I've changed stop condition):
for (i = 0; i < d->lines; i++)
otherwise you write behind allocated space...
UPDATE
Clarification:
Allocating array with d->dictionnary = malloc(sizeof(*d->dictionnary) * d->lines); gives you an arry with exactly d->lines elements. It starts from 0 index and last element could be accessed with d->lines-1 index. So when you use loop from 0 up to and including d->lines the very last loop cycle will write outside of array boundaries (i.e. to d->lines index). That's where you corrup your heap. Very often C runtime doesn't check for such errors and you will only see them on rare ocasions and probably far away from the code which caused them.
"corrupted linked list" is about heap corruption. Blocks allocated with malloc are usually chained into linked lists (this really depends on implementation of you memory allocator). So, when writing outside allocation boundaries - you can corrupt this list. Hence the complaint.