malloc：损坏的顶部大小无法找出问题

Question

我想编写一个简单的 C 程序来接收矩阵（首先是它的大小）并反转它，所以我编写了一些代码，编译它，运行并得到大小大于 2 的矩阵的“malloc：损坏的顶部大小”错误。我检查了代码中是否有未释放的内存，但我只是看不出我哪里搞砸了。

代码本身：

#include <ctype.h>
#include <math.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

double det(double **matrix, int n, int m);
int invert(double **matrix, int n, int m);

int input(double ***matrix, int *n, int *m);
void output(double **matrix, int n, int m);

double **allocate_matrix(int n, int m);

int main(void) {
    double **matrix;
    int n, m;
    if (input(&matrix, &n, &m) == 0 && invert(matrix, n, m) == 0) {
        output(matrix, n, m);
        free(matrix);
    } else
        printf("n/a");
    return 0;
}

// Secondary functions

void swap(void *a, void *b, size_t size) {
    void *c = malloc(size);
    memcpy(c, a, size);
    memcpy(a, b, size);
    memcpy(b, c, size);
    free(c);
}

// Matrix allocation

double **allocate_matrix(int n, int m) {
    double **matrix = malloc(n * m * sizeof(double) + n * sizeof(double *));
    double *data = (double *)(matrix + n);
    for (int i = 0; i < n; i++) matrix[i] = data + m * i;
    for (int i = 0; i < n * m; i++) data[i] = 0;
    return matrix;
}

// Matrix operations

void matrix_for_det(double **matrix, int n, int m, double **res, int y, int x) {
    int in = 0, jn = 0;
    for (int i = 0; i < n; i++) {
        if (i == y) continue;
        for (int j = 0; j < m; j++) {
            if (j == x) continue;
            res[in][jn] = matrix[i][j];
            jn++;
        }
        in++;
    }
}

void matrix_const_mul(double **matrix, int n, int m, double c) {
    for (int i = 0; i < n; i++) {
        for (int j = 0; j < m; j++) {
            matrix[i][j] *= c;
        }
    }
}

double det(double **matrix, int n, int m) {
    if (n != m) return NAN;
    if (n == 2) return matrix[0][0] * matrix[1][1] - matrix[0][1] * matrix [1][0];
    if(n == 1) return matrix[0][0];
    double result = 0;
    double **next = allocate_matrix(n - 1, m - 1);
    if (next != NULL) {
        for (int col = 0; col < m; col++) {
            matrix_for_det(matrix, n, m, next, 0, col);
            double atom = matrix[0][col] * det(next, n - 1, m - 1);
            if (col % 2 == 0)
                result += atom;
            else
                result -= atom;
        }
        free(next);
    } else
        result = NAN;
    return result;
}

int transpose(double ***matrix, int *n, int *m) {
    int exit_status = 0;
    double **result = allocate_matrix(*m, *n);
    if (result != NULL) {
        for (int i = 0; i < *n; i++) {
            for (int j = 0; j < *m; j++) {
                result[j][i] = (*matrix)[i][j];
            }
        }
        free(*matrix);
        *matrix = result;
        swap(n, m, sizeof(int));
    } else
        exit_status = -1;
    return exit_status;
}

int invert(double **matrix, int n, int m) {
    int exit_status = 0;
    double **new = allocate_matrix(n, m);
    double **next = allocate_matrix(n - 1, m - 1);
    if (new != NULL && next != NULL) {
        for (int i = 0; i < n; i++) {
            for (int j = 0; j < m; j++) {
                matrix_for_det(matrix, n, m, next, i, j);
                new[i][j] = det(next, n - 1, m - 1);
                if ((i + j) % 2 == 1) new[i][j] *= -1;
            }
        }
        free(next);

        if (transpose(&new, &n, &m) == 0) {
            double det_v = det(matrix, n, m);
            matrix_const_mul(new, n, m, 1. / det_v);

            memcpy(matrix[0], new[0], n * m * sizeof(double));
        } else
            exit_status = -1;

        free(new);
    } else {
        if (new) free(new);
        if (next) free(next);
    }
    return exit_status;
}

// Input Output

int check_string() {
    int exit_status = 0;
    int c;
    while ((c = getchar()) != EOF && c != '\n' && exit_status == 0) {
        if (!isspace(c)) exit_status = -1;
    }
    return exit_status;
}

int input(double ***matrix, int *n, int *m) {
    int exit_status = 0;
    if (scanf("%d %d", n, m) == 2 && *n > 0 && *n == *m) {
        *matrix = allocate_matrix(*n, *m);
        for (int i = 0; i < *n && exit_status == 0; i++) {
            for (int j = 0; j < *m && exit_status == 0; j++) {
                if (scanf("%lf", (*matrix)[i] + j) != 1) exit_status = -1;
            }
        }
        exit_status += check_string();
        if (exit_status != 0) free(*matrix);
    } else
        exit_status = -1;
    return exit_status;
}

void output(double **matrix, int n, int m) {
    for (int i = 0; i < n; i++) {
        for (int j = 0; j < m - 1; j++) {
            printf("%.6lf ", matrix[i][j]);
        }
        if (m > 0) printf("%.6lf", matrix[i][m - 1]);
        if (i < n - 1) puts("");
    }
}

我尝试使用 debug 来查看哪里出了问题，但它告诉我，在

allocate_matrix()

中从

transpose()

中调用的函数初始化 malloc 中止。我不明白为什么它不像内部错误那样返回 NULL，而是中止所有程序。

Answer 1

result

这根本没有意义。

double **matrix = malloc(n * m * sizeof(double) + n * sizeof(double *));