What can explain heap corruption on a call to free()?

Question

I have been debugging a crash for days now, that occurs in the depths of OpenSSL (discussion with the maintainers here). I took some time investigating so I\'ll try to make this

Answer 1

In general the possibilities include:

1. Duplicate free.
2. Prior duplicate free.
3. (Most probable) Your code wrote beyond the limits of the allocated chunk of memory, either before the beginning or after the end. malloc() and friends put extra bookkeeping information in here, such as the size, and probably a sanity-check, which you will fail by overwriting.
4. Freeing something that hadn't been malloc()-ed.
5. Continuing to write to a chunk that had already been free()-d.