c - c free()崩溃:“ntdll!RtlpNtEnumerateSubKey()没有可用的源

当我尝试释放我的对象PokemonTrainer时，我的程序在Eclipse上崩溃了。我在this article中尝试了该解决方案，但没有帮助。

PokemonTrainer pokemonTrainerCreate(char* name, Pokemon initial_pokemon,
    int max_num_local, int max_num_remote)
{
    PokemonTrainer trainer = malloc(sizeof(PokemonTrainer));

    if ((name == NULL) || (initial_pokemon == NULL) || (trainer == NULL) ||
        (max_num_local < 0) || (max_num_remote < 0))
        return NULL;

    char tmp_name[strlen(name)];
    strcpy(tmp_name, name);
    trainer->name = tmp_name;
    trainer->max_num_local = max_num_local;
    trainer->max_num_remote = max_num_remote;
    trainer->pokemons_local = malloc(sizeof(Pokemon)
        trainer->max_num_local);
    trainer->pokemons_remote = malloc(sizeof(Pokemon)
        trainer->max_num_remote);

    if (trainer->pokemons_remote == NULL) {
        free(trainer->pokemons_local);
        return NULL;
    } else if (trainer->pokemons_local == NULL) {
        free(trainer->pokemons_remote);
        return NULL;
    }

    trainer->pokemons_local[0] = pokemonCopy(initial_pokemon);
    trainer->curr_num_local = 1;
    trainer->curr_num_remote = 0;

    return trainer;
}

void pokemonTrainerDestroy(PokemonTrainer trainer)
{
    if (trainer == NULL)
        return;

    if (trainer->curr_num_local > 0)
        for (int i = trainer->curr_num_local - 1; i >= 0; i--)
            pokemonDestroy(trainer->pokemons_local[i]);

    if (trainer->curr_num_remote > 0)
        for (int i = trainer->curr_num_remote - 1; i >= 0; i--)
            pokemonDestroy(trainer->pokemons_remote[i]);

    free (trainer);  // here it's crashed
}

正是在堆栈中的free（）执行期间，我收到了“没有可用的源代码用于“ ntdll！RtlpNtEnumerateSubKey（）在0x77cf04e5处”的错误”。

最佳答案

PokemonTrainer trainer = malloc(sizeof(PokemonTrainer));不太可能正常工作，因为您分配的是指针的大小，而不是实际数据的大小。

您将没有足够的存储空间=>发生不确定的行为，并且对于您来说，释放内存（损坏的内存列表）时会发生

我会这样做：

 PokemonTrainer trainer = malloc(sizeof(*PokemonTrainer));

因此sizeof采用PokemonTrainer指向的结构的大小。

编辑：出于完整性考虑，BLUEPIXY建议您在此处丢失1个字节（因为以null终止符char）：

char tmp_name[strlen(name)];
strcpy(tmp_name, name);

而且这个分配的空间是临时的，所以我建议：

char *tmp_name = strdup(name);

它将分配正确的大小并执行动态分配，即使从例程返回后，该分配仍保持有效。