Segmentation fault on the line operator new

Question

Perfect obscure bug in the function realloc_aray(). In the line node * b = new node [size]; program crashes with segmentation fault. It is not clear why the program falls on the operator new. I debugged it in GDB. The value of the variable size = 9, that is the reason is not a lack of memory ... ?

void compress::compresser::compress_string(const std::string& s, std::string& t)
{
    std::vector<std::string> r;
    tokenize(s, r);
    int l = r.size() - 1;
    node tt[l][l];    
    node* a = new node[l];
    for(int i = 0; i < l; ++i)
    {
         node* rr = m_tree->get_new_node(atoi(r[i].c_str()));
         a[i] = *rr;
    }
    int m = dec_to_bin(l); 
    node* b = get_xor_array(a, l);
//  delete [] a;
    for(int i = 0; i < m; ++i )
    {
        for(int j = 0; j < l; j+=2)
        {
            node* n = m_tree->get_new_xor_node(&b[j], &b[j + 1]);
            tt[i][j] = *n;
            delete n;               
        }
        l = l/2; 
//      delete [] b;
        b = get_xor_array(tt[i], l);            
    }
}

compress::node* compress::compresser::get_xor_array(const node* const a, int  size)
{
    node* b = 0;
    b = realloc_array(a, size);
    return b;
}

compress::node* compress::compresser::realloc_array(const node* const a, int size)
{
    int i = 0;
    node* b = new node[size]; // in this line program crashes with segmentation fault
    for(i = 0; i < size; ++i)
    {
        b[i] = a[i];
    }
    b[size] = 0;
    return b;
}

Answer 1

C++ arrays are zero-based so

node* b = new node[size];

allocates an array with indices [0..size-1]. The line

b[size] = 0;

writes past the end of your allocated memory. This has undefined consequences which can include over-writing memory used by other parts of your program.

If you want to allocate space for size node instances plus a NULL terminator, use

node* b = new node[size+1];