Why does delete fail after memset - c++

Question

The following code will cause core dump when deletion. But if comment out "memset", it is good to run.
So, it looks like memset does something wrong. What is the problem of the following code?
#include <iostream>
#include <cstring>
using namespace std;
int main()
{
int n= 5;
int **p = new int* [n];
for (int i=0; i<n; i++) {
p[i] = new int [n];
}
// if comment out this line, it is good to run.
memset(&p[0][0], 0, n*n*sizeof(int));
// core dump here
for (int i=0; i<n; i++) {
delete [] p[i];
}
delete [] p;
return 0;
}

Answer 1

Allocated memories in p[i]s are not necessarily contiguous. So calling memset to clear the whole of the allocated memory in p[i]s will touch a part of memory which is not for you (the main reason for the segmentation fault). If you want to set them all to zero, you have to iterate through them:
for (int i=0; i<n; i++) {
memset(p[i], 0, n*sizeof(int));
}

Answer 2

What you had created is array of pointers to non-contiguous areas of memory
int **p = new int* [n];
for (int i=0; i<n; i++) {
p[i] = new int [n];
}
Here p[0] points at first area, p[1] at second, p[n] at last. They aren't same object, so from point of view for language lawyer such memset call is Undefined Behavior.
memset(&p[0][0], 0, n*n*sizeof(int)); // Out of bound
&p[0][0] points at first element of array object of n elements ( size n*sizeof(int)). Anything odd allowed to happen after you broke the rules, the broken delete[] call is a typical reaction to such "memory corruption".
Note, you don't need memset for zero-initialization with arrays in C++, all you need is initialize them on creation:
int **p = new int* [n];
for (int i=0; i<n; i++) {
p[i] = new int [n]();
}
IF you want your array to be a continuous two-dimensional array, where every sub-array is adjacent to next one (none of standard tools offer such), you may use the placement new approach.
int **p = new int* [n];
int *pool = new int [n*n]; // the whole array will be here
for (int i=0; i<n; i++) {
p[i] = new (pool + i*n) int [n]();
// Creating subobject arrays using placement parameter
// In this case parameter is a pointer to memory storage
// where new expression would create an object.
// No memory allocation is happening here.
}
....
delete [] p; // deleting array of pointers
delete [] pool; // deleting memory pool
Or even better, avoid naked pointers if possible or exposure of user to such code. Use encapsulation, either standard library types or your own types to hide that "code gore". The problem with such exposed code is that there is no procedure which would deallocate memory if something will interrupt execution, e.g. an exception.

Answer 3

memset
Converts the value ch to unsigned char and copies it into each of the first count characters of the object pointed to by dest. If the object is a potentially-overlapping subobject or is not TriviallyCopyable (e.g., scalar, C-compatible struct, or an array of trivially copyable type), the behavior is undefined. If count is greater than the size of the object pointed to by dest, the behavior is undefined.
Every time new is called, a new block of memory is returned. It does not have to be exactly behind the previous block.
So the memory does not have to be continious, as is required by memset, and memset is writting in memory not assigned to the program, so a crash occurs.
To correctly zero initialize memory, add paranthesis after new:
int **p = new int* [n] (); // With C++11 and later can also be {}
for (int i=0; i<n; i++)
{
p[i] = new int [n] (); // With C++11 and later can also be {}
}