由於realloc不正確，我是否收到分段錯誤？

Question

struct model 
{ 
    char *cam; 
    int *to_location, *go_location; 
    int to_count, go_count; 
    int length, size; 
}; 

struct model * 
initialize(int l) 
{ 
    struct model *c; 
    c = (struct model *)malloc(sizeof(struct model)); 
    assert(c != NULL); 
    c->length = l; 
    c->size = 2 * l; 
    c->cam = (char *)malloc(2 * l * sizeof(char)); 
    assert(c->cam != NULL); 
    c->to_location = (int *)malloc(l * sizeof(int)); 
    assert(c->to_location != NULL); 
    c->go_location = (int *)malloc(l * sizeof(int)); 
    assert(c->go_location != NULL); 
    return c; 
} 

void 
shuffle(struct model *current, struct model *future, int to, int g) 
{ 
    int i1, k, d1; 
    char init[100000]; 
    current->to_count = 0; 
    current->go_count = 0; 
    for (i1 = 0; i1 < g; i1++) 
    { 
     init[i1] = 'G'; 
    } 
    for (i1 = g; i1 < g + to; i1++) 
    { 
     init[i1] = 'T'; 
    } 
    for (i1 = g + to; i1 < current->length; i1++) 
    { 
     init[i1] = '.'; 
    } 
    for(i1 = 0; i1 < future->length; i1++) 
    { 
     d1 = rand() % current->length; 
     current->cam[i1] = init[d1]; 
     if (current->cam[i1] == 'T') 
     { 
      current->to_location[current->to_count] = i1; 
      current->to_count = current->to_count + 1; 
     } 
     if (current->cam[i1] == 'G') 
     { 
      current->go_location[current->go_count] = i1; 
      current->go_count = current->go_count + 1; 
     } 
     for (k = d1; k < current->length; k++) 
     { 
      init[k] = init[k + 1]; 
     } 
     current->length = current->length - 1; 
    } 
    current->length = future->length; 
} 

void 
display(struct model *current) 
{ 
    int i; 
    printf("\n<"); 
    current->to_count = 0; 
    current->go_count = 0; 
    for(i = 0; i < current->length; i++) 
    { 
     if (current->cam[i] == 'T') 
     { 
      current->to_location[current->to_count] = i; 
      current->to_count = current->to_count + 1; 
     } 
     else if (current->cam[i] == 'G') 
     { 
      current->go_location[current->go_count] = i; 
      current->go_count = current->go_count + 1; 
     } 
     printf("%c", current->cam[i]); 
    } 
    printf(">\n"); 
    printf("\nThe total number of to's are %d, and the total number of gos  are %d. The length is %d\n", current->to_count, current->go_count, current->length); 
} 

void 
insert(struct model *current, struct model *future) 
{ 
    int j, k; 
    k = rand() % (current->length + 1); 
    current->length = current->length + 1; 
    for (j = current->length; j > k; j--) 
    { 
     future->cam[j] = future->cam[j - 1]; 
    } 
    future->cam[k] = 'T'; 
    future->size = 2 * current->length; 
    future->cam = (char *)realloc(future->cam, future->size * sizeof(char)); 
    assert(future->cam != NULL); 
    current->size = 2 * current->length; 
    current->cam = (char *)realloc(current->cam, current->size * sizeof(char)); 
    assert(current->cam != NULL); 
} 

int 
main() 
{ 
    int l, to, go, i, k1, k2, j; 
    l = 100; //l,go,to are positive 
    go = 20; 
    to = 20; //go+to cannot be greater than l 
    struct model *current = initialize(l), *future = initialize(l); 
    shuffle(current, future, to, go); 
    display(current); 
    for (i = 0; i < 500; i++) 
    { 
     for (j = 0; j < current->length; j++) 
     { 
      future->cam[j] = current->cam[j]; 
     } 
     insert(current, future); 
     for (j = 0; j < current->length; j++) 
     { 
      current->cam[j] = future->cam[j]; 
     } 
     display(current); 
    } 
    return 0; 
} 

我無法找出分段故障的原因。我檢查了是否正確執行了realloc，但從我可以告訴的那裏可能沒有錯誤。在current->length達到281後發生分段故障，因此在初始大小爲200時可能會發生重新分配，但爲什麼在此之後停止？

Answer 1

在initialize()你：

c->cam = (char *)malloc(2 * l * sizeof(char)); 
assert(c->cam != NULL); 
c->to_location = (int *)malloc(l * sizeof(int)); 
assert(c->to_location != NULL); 
c->go_location = (int *)malloc(l * sizeof(int)); 
assert(c->go_location != NULL); 

然後在insert()你：

current->length = current->length + 1; 
.... 
future->size = 2 * current->length; 
future->cam = (char *)realloc(future->cam, future->size * sizeof(char)); 
assert(future->cam != NULL); 
current->size = 2 * current->length; 
current->cam = (char *)realloc(current->cam, current->size * sizeof(char)); 

然後在display()你：

current->to_count = 0; 
current->go_count = 0; 
for(i = 0; i < current->length; i++) 
... 
     current->to_location[current->to_count] = i; 
     current->to_count = current->to_count + 1; 
... 
     current->go_location[current->go_count] = i; 
     current->go_count = current->go_count + 1; 

類似的事情也發生在shuffle()

所以你寫0到to_location直到current-> length和current->長度因爲insert（）而繼續變大，但to_location不會變大，所以當你增加current-> length時， to_location數組的末尾和clobber重要的東西 - 最終會終止程序。