malloc 非法操作问题

MyungJee

在malloc执行过程中出现非法操作是怎么回事 ?

1. 
   
2. void WaypointAddPath(edict_t *pEntity, short int add_index, short int path_index, float fDistance)
   
3. {
   
4.    int i;
   
5. 
   
6.    if (add_index == path_index)
   
7.       return; // Deny creation of paths from any waypoint to itself
   
8. 
   
9.    if (IsConnectedWithWaypoint(add_index, path_index))
   
10.       return; // Don't allow paths get connected twice
    
11. 
    
12.    // ALERT(at_console, "Path added from %d to %d\n", add_index, path_index);
    
13. 
    
14.    PATH *p = paths[add_index];
    
15.    PATH *prev = NULL;
    
16. 
    
17.    // Check for free space in the connection indices
    
18.    while (p != NULL)
    
19.    {
    
20.       for (i = 0; i < MAX_PATH_INDEX; i++)
    
21.       {
    
22.          if (p->index[i] == -1)
    
23.          {
    
24.             p->index[i] = path_index;
    
25.             p->distance[i] = fDistance;
    
26.             p->connectflag[i] = 0;
    
27.             p->vecConnectVel[i] = g_vecZero;
    
28.             p->distance[i] = 0;  
    
29.             return;
    
30.          }
    
31.       }
    
32. 
    
33.       prev = p;     // save the previous node in linked list
    
34.       p = p->next;  // go to next node in linked list
    
35.    }
    
36. 
    
37.    // There wasn't any free space
    
38.    p = (PATH *)malloc(sizeof(PATH));  // !!! 非法操作 !!!
    
39. 
    
40.    for (i = 0; i < MAX_PATH_INDEX; i++)
    
41.    {
    
42.       p->index[i] = -1;
    
43.       p->connectflag[i] = 0;
    
44.       p->vecConnectVel[i] = g_vecZero;
    
45.       p->distance[i] = 0;  
    
46.    }
    
47. 
    
48.    p->index[0] = path_index;
    
49.    p->distance[0] = fDistance;
    
50.    p->next = NULL;
    
51. 
    
52.    if (prev != NULL)
    
53.       prev->next = p;  // link new node into existing list
    
54. 
    
55.    if (paths[add_index] == NULL)
    
56.       paths[add_index] = p;  // save head point if necessary
    
57. }
    

复制代码

call stack 基本是这样的:

malloc_*** (记不请了)
malloc_***
malloc
WaypointAddPath
WaypointLoad
DispatchSpawn

congy

是不是 sizeof(PATH) 参数有问题？