C RPC Server malloc memory corruption

Question

I'm doing a RPC program and in the server side I'm getting memory corrupted but I don't know exactly why, all the functions works fine but this one.

I tried first with strndup and then change it for malloc and strcpy on the struct variables, but both don't work.

EDIT: Tried strdup as well, still memory corruption

EDIT FIXED: The problem was the malloc on "persona", the sizeof was wrong.

Structs

struct facturar {
    int idReserva;
    int idReg;
    int idPlaza;
    int fila;
    int asiento;
    char *nombre;
    char *dni;
    struct facturar *siguiente;
};
typedef struct facturar facturar;

struct datos_facturacion {
    struct facturar *lista;
};
typedef struct datos_facturacion datos_facturacion;

static datos_facturacion result;
char buffer[200];
struct facturar * persona;
xdr_free((xdrproc_t)xdr_datos_facturacion,(char *)&result);
// ...
f = fopen("DatosReservas", "r");
    f2 = fopen("Ffacturacion", "a");
    idr = argp->idVuelo;

while(fgets(buffer, sizeof(buffer), f) != NULL){
        c2 = malloc(strlen(buffer) + 1);
        strcpy(c2, buffer);
        c = strtok_r(c2, ":", &c1);
        printf("%d-%d-\n", idr, atoi(c));
        if(idr == atoi(c)){
            persona = malloc(sizeof(persona));;
            persona->idReserva = idr;
            fprintf(f2, "%d:", idr);
            c = strtok_r(NULL, ":", &c1);
            printf("%s\n", c);
            persona->idReg = idreg;
            fprintf(f2, "%d:", idreg);
            c = strtok_r(NULL, ":", &c1);
            printf("%s\n", c);
            persona->idPlaza = atoi(c);
            fprintf(f2, "%d:", atoi(c));
            if(asAsignado == asiento){
                fAsignada = fAsignada + 1;
                asAsignado = 1;
            }
            persona->fila = fAsignada;
            fprintf(f2, "%d:", fAsignada);
            persona->asiento = asAsignado;
            fprintf(f2, "%d:", asAsignado);
            c = strtok_r(NULL, ":", &c1);
            printf("Cadena antes de Malloc: %s\n", c);
            persona->nombre = malloc(strlen(c) + 1);
            strcpy(persona->nombre, c);
            fprintf(f2, "%s:", c);
            c = strtok_r(NULL, ":", &c1);
            printf("Cadena dps de malloc %s\n", persona->nombre);
            printf("Cadena antes de Malloc2: %s\n", c);
            persona->dni = malloc(strlen(c) + 1);
            strcpy(persona->dni, c);
            printf("Cadena despues de Malloc2: %s\n", persona->dni);
            fprintf(f2, "%s\n", persona->dni);
            persona->siguiente = result.lista;
            result.lista = persona;
        }
        free(c2);
    }
    fclose(f);
    fclose(f2);
return &result;

In the last iteration I got the error in the last malloc

Error : malloc(): memory corruption aborted (core dumped)

New output to test :

Cadena before of Malloc: Alberto // printing "c" of strtok_r Cadena after of malloc Alberto // printing persona->nombre after malloc Cadena before of Malloc2: 33445511J Cadena after of Malloc2: 33445511J //printing persona->dni after malloc

Cadena before of Malloc: Juan Cadena after of malloc Juan Cadena before of Malloc2: 92312321C Cadena after of Malloc2: 92312321C

Cadena antes of Malloc: Pepe Macias Cadena dps of malloc Pepe Macias Cadena antes of Malloc2: 39421294D Cadena despues of Malloc2: 39421294D

Cadena before of Malloc: Ignacio Gutierrez Povedilla Cadena after of malloc Ignacio Gutierrez Povedilla Cadena before of Malloc2: 92123421Y malloc(): memory corruption Abortado (`core' generado)

Answer 1

    c2 = malloc(strlen(buffer));
    strcpy(c2, buffer);

There is no room in c2 for the final \0.

---

I hope buffer and persona are not formal parameters to a function. If yes,

sizeof(buffer)

and

sizeof(persona)

definitely return a lot less than you expect.

---

About persona, why do you make it a pointer, instead of a regular variable?! malloc() should be used only when there is no other chance, exactly because it is dangerous when used improperly.

---

I will tell you if I find more.