Function copyStringBuf() uses sizeof(*fb->indexPtr) as size of elements in fb->indexPtr, while addClStringN() usess 'sizeof(long)' for the same elements. Both functions copy indexPtr, but each with different size. Therefore, if addClStringN() is called after copyStringBuf(), it may copy more bytes than copyStringBuf() created -> SIGSEGV (or 'Invalid read of size XYZ' in Valgrind logs). 'sizeof(*buf->indexPtr)' should be consistently used in ClStrBuf.indexPtr and ClArrayBuf.indexPtr. diff -up sblim-sfcb-1.3.16/objectImpl.c.invalid-read sblim-sfcb-1.3.16/objectImpl.c --- sblim-sfcb-1.3.16/objectImpl.c.invalid-read 2013-04-19 14:03:04.920602183 +0200 +++ sblim-sfcb-1.3.16/objectImpl.c 2013-04-19 14:04:10.229391267 +0200 @@ -208,7 +208,7 @@ addClStringN(ClObjectHdr * hdr, const ch buf->bMax = nmax; buf->bUsed = buf->iUsed = 0; buf->iMax = 16; - setStrIndexPtr(buf, malloc(sizeof(long) * 16)); + setStrIndexPtr(buf, malloc(sizeof(*buf->indexPtr) * 16)); hdr->flags |= HDR_Rebuild; } @@ -222,17 +222,17 @@ addClStringN(ClObjectHdr * hdr, const ch if (!isMallocedStrIndex(buf)) { void *idx = buf->indexPtr; buf->iMax = nmax * 2; - setStrIndexPtr(buf, malloc(buf->iMax * sizeof(long))); - memcpy(buf->indexPtr, idx, nmax * sizeof(long)); + setStrIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr))); + memcpy(buf->indexPtr, idx, nmax * sizeof(*buf->indexPtr)); } else { buf->iMax = nmax * 2; - setStrIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(long))); + setStrIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(*buf->indexPtr))); } } else { buf->iMax = 16; - setStrIndexPtr(buf, malloc(buf->iMax * sizeof(long))); + setStrIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr))); } hdr->flags |= HDR_Rebuild; } @@ -289,7 +289,7 @@ static long addClArray(ClObjectHdr * hdr buf->bMax = nmax; buf->bUsed = buf->iUsed = 0; buf->iMax = 16; - setArrayIndexPtr(buf, malloc(sizeof(long) * 16)); + setArrayIndexPtr(buf, malloc(sizeof(*buf->indexPtr) * 16)); hdr->flags |= HDR_Rebuild; } @@ -303,17 +303,17 @@ static long addClArray(ClObjectHdr * hdr if (!isMallocedArrayIndex(buf)) { void *idx = buf->indexPtr; buf->iMax = nmax * 2; - setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(long))); - memcpy(buf->indexPtr, idx, nmax * sizeof(long)); + setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr))); + memcpy(buf->indexPtr, idx, nmax * sizeof(*buf->indexPtr)); } else { buf->iMax = nmax * 2; - setArrayIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(long))); + setArrayIndexPtr(buf, realloc(buf->indexPtr, buf->iMax * sizeof(*buf->indexPtr))); } } else { buf->iMax = 16; - setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(long))); + setArrayIndexPtr(buf, malloc(buf->iMax * sizeof(*buf->indexPtr))); } hdr->flags |= HDR_Rebuild; }