EEPW论坛

显示malloc一个数组，有cmd指向，后调用

free(cmd);

编译没错，运行处如下错误：

*** glibc detected *** ./a.out: free(): invalid next size (fast): 0x095ef488 *** ======= Backtrace: ========= /lib/i686/nosegneg/libc.so.6[0x670716] /lib/i686/nosegneg/libc.so.6(cfree+0x90)[0x673c80] ./a.out[0x8048940] ./a.out[0x8048d91] /lib/i686/nosegneg/libc.so.6(__libc_start_main+0xdc)[0x61cdec] ./a.out[0x80485a1] ======= Memory map: ======== 00572000-00573000 r-xp 00572000 00:00 0          [vdso] 005e9000-00603000 r-xp 00000000 fd:00 4228679    /lib/ld-2.5.so 00603000-00604000 r--p 00019000 fd:00 4228679    /lib/ld-2.5.so 00604000-00605000 rw-p 0001a000 fd:00 4228679    /lib/ld-2.5.so 00607000-00747000 r-xp 00000000 fd:00 4228694    /lib/i686/nosegneg/libc-2.5.so 00747000-00749000 r--p 00140000 fd:00 4228694    /lib/i686/nosegneg/libc-2.5.so 00749000-0074a000 rw-p 00142000 fd:00 4228694    /lib/i686/nosegneg/libc-2.5.so 0074a000-0074d000 rw-p 0074a000 00:00 0  008d0000-008db000 r-xp 00000000 fd:00 4227283    /lib/libgcc_s-4.1.2-20080102.so.1 008db000-008dc000 rw-p 0000a000 fd:00 4227283    /lib/libgcc_s-4.1.2-20080102.so.1 08048000-0804a000 r-xp 00000000 00:14 5938       /mnt/hgfs/zq/zq/linux_tcp/a.out 0804a000-0804b000 rw-p 00001000 00:14 5938       /mnt/hgfs/zq/zq/linux_tcp/a.out 095cf000-09600000 rw-p 095cf000 00:00 0  b7e00000-b7e21000 rw-p b7e00000 00:00 0  b7e21000-b7f00000 ---p b7e21000 00:00 0  b7f66000-b7f67000 rw-p b7f66000 00:00 0  b7f7b000-b7f7d000 rw-p b7f7b000 00:00 0  bfbe2000-bfbf8000 rw-p bfbe2000 00:00 0          [stack] 已放弃