realloc overwrite variable (Xilinx SDK on a Zynq SoC (Cortex A9))

Question

As mentioned I have a Zynq SoC (ZC706 Eval Board) and I'm trying to read an image from the SD Card. To do this I'm using the FatFs lib (http://elm-chan.org/fsw/ff/00index_e.html). In my code I read 4096 Byte from the file and save it to a buffer. After that i copy the buffer to an unsigned char pointer that size I increase after every read operation.

Then I'm using realloc, the for loop in the copyU32ArrayToUnsignedCharArray function 'failed' because the size variable is overwritten by the out array.

Code that overwrite the "size" in the copyU32ArrayToUnsignedCharArray function:

u32 buffer[1024];
unsigned char *img = NULL;
bytesreaded = 0;
for (;;) {
    br=0;
    fr = f_read(&fil, buffer, sizeof(buffer), &br); /* Read a chunk of source file */
    if (fr || br == 0)
        break; /* error or eof */

    img = realloc(img,br);
    copyU32ArrayToUnsignedCharArray(buffer, &img[bytesreaded], br/4); // /4 because u32(32 bit) in to unsigned char(8 bit)
    bytesreaded += br; // update readed bytes 
}

The code that worked:

    u32 buffer[1024];
unsigned char *img = NULL;
img = malloc(512*512*3+100);
bytesreaded = 0;
for (;;) {
    br=0;
    fr = f_read(&fil, buffer, sizeof(buffer), &br); /* Read a chunk of source file */
    if (fr || br == 0)
        break; /* error or eof */

    copyU32ArrayToUnsignedCharArray(buffer, &img[bytesreaded], br/4); // /4 because u32(32 bit) in to unsigned char(8 bit)
    bytesreaded += br; // update readed bytes 
}

The copyU32ArrayToUnsignedCharArray function:

void copyU32ArrayToUnsignedCharArray(u32 *in, unsigned char* out, uint size){
int i,x;

x = 0;
for (i = 0; i < size; i++) {
    if(size != 1024)
        break;
    in[i] = Xil_In32BE(&in[i]);
    out[x] = (u32) in[i] >> 24;
    out[x + 1] = (u32) in[i] >> 16 & 0x00FF;
    out[x + 2] = (u32) in[i] >> 8 & 0x0000FF;
    out[x + 3] = (u32) in[i] & 0x000000FF;
    x += 4;
}
}

I want to use realloc because I don't know how big the image will be that I read.

Update:
Some further information to the code that doesn't work. I debugged it and the pointer to *img isn't null, so the realloc was successfully. If I'm using gdb the following things happen in the copyU32ArrayToUnsignedCharArray function:
- pointer to the variable "out" is 0x001125a8
- the address of the "size" variable is 0x0011309c (the value that is stored at this location is correct)
- the space in memory between this two variables is 0xaf4 = 2804 dec (difference of the two addresses)
- if the for loop within the copyU32ArrayToUnsignedCharArray function reached i=702 and x=2808 the size variable is changed to another value

Sincerely,
Arno

Answer 1

I solved the problem with the hint from Notlikethat. The problem was the small heap size. Increasing the heap is done by editing the linker script file