Search code examples
cfree

What does the 'free(): invalid next sign (fast)' error really mean?


Let's say I've got a program foo that allocates and frees memory. I run it like this:

./foo something.foo

It works perfectly, exits with no errors. Now, if I set the first line of the file to #!/path/foo, change the permissions, and run it as ./something.foo, the program runs correctly, but before exiting, I see this:

*** Error in '/path/foo': free(): invalid next size(fast): 0x019e2008 ***
Aborted

I've seen a lot of questions about free(): invalid next sign(fast), all with specific code examples. So I've got two questions:

  • Why might the error appear when using #!/path/foo instead of ./foo?
  • What exactly does the error mean - what conditions must be present for it to appear?

Huh, fixed this by changing

some_var = malloc(sizeof(char *));

to

some_var = malloc(CONSTANT);

Solution

  • It means you have heap corruption in your program. The message is telling you how the C library detected the corruption, not how the corruption occurred.

    Heap corruption is a particularly insidious bug to track down as it generally does not manifest at the point where the bug occurs, but rather at some later point. Its quite possible for the program to continue to work despite the corruption, meaning it might be a bug that has been present in your code for weeks or months and has nothing to do with any recent changes you are testing and debugging.

    The best response to heap corruption is usually a tool like valgrind, which can run along with your program and will often (though not always) be able to pinpoint where the offending code is.