Possible heap corruption, debugging with valgrind

Question

I'm working on a project that makes use of a string buffer. I've been getting random errors with free() and malloc() - Like "invalid next size (fast)" and suspects if it is due to some memory heap corruption. I'm using gcc. I used valgrind on the binary file and this is the summary :

ERROR SUMMARY: 26887 errors from 39 contexts (suppressed: 0 from 0)

I think that's a bit too high. I'm attaching a pastebin of the valgrind memcheck output here Most of the problems seem to be from a single function : strbuf_addc(). strbuf is a string buffer that can grow automatically. I'm pasting some strbuf functions here.

int strbuf_add(struct strbuf *string, const char *c)
{
    if(string == NULL || c == NULL) return 0;

    while(*c != '\0') {
        if(!strbuf_addc(string, *c++))
            return 0;
    }

    return 1;
}

 int strbuf_addc(struct strbuf *string, char c)
    {
        size_t space_available;

        assert(string != NULL);

        space_available = string->allocated - string->length;
        if(space_available <= 1) {
            if(!grow_buffer(string)) {
                return 0;
            }
        }
        string->buffer[string->length++] = c;
        string->buffer[string->length] = '\0';

        return 1;
    }
    static int grow_buffer(struct strbuf *string)
{
    char *tmp;
    size_t toallocate;

    assert(string != NULL);

    toallocate = string->allocated + (string->allocated / 2);
    tmp = (char*) realloc(string->buffer, toallocate);
    if(tmp) {
        string->buffer = tmp;
        string->allocated = toallocate;
        return 1;
    }
    return 0;
}

I'm not sure if strbuf_addc is the culprit or some other function that I wrote. Please take a look. I am basically passing string literals as the second argument to strbuf_add. I'm not sure if they will be null terminated, but I suppose string literals in c are null terminated. I've also tried reading strings from a file, still some errors.

Answer 1

toallocate = string->allocated + (string->allocated / 2);

there might be situations where toallocate won't be bigger than string->allocated. so, realloc won't reserve more space for your string and you won't be able to add a character. valgrind keeps saying that :

==4755== Invalid write of size 1

so you just don't have space to append a char.