Heap corruption in deconstructor - c++

Question

I'm creating a program for decompiling some game script files. The latest part I've added is giving me some errors when dealing with dynamic arrays. This is the offending code:
typedef struct _COD9_ANIMREF_1
{
DWORD name;
DWORD reference;
};
typedef struct _COD9_USEANIM_1
{
WORD name; // offset of name
WORD numOfReferences; // reference count
WORD numOfAnimReferences; // reference count
WORD null1; // always null
DWORD* references = NULL; // dynamic array of references, amount = numOfReferences
_COD9_ANIMREF_1* animReferences = NULL; // dynamic array of references, amount = numOfAnimReferences
~_COD9_USEANIM_1()
{
if (references)
delete[] references;
if (animReferences) // program officially breaks here, if continued causes heap corruption
delete[] animReferences;
}
};
typedef struct _COD9_WORK_1
{
_COD9_GSC_1 Hdr;
char* data = NULL;
int* includes = NULL; //done
_COD9_USEANIM_1* usingAnim = NULL; //not done, heap corruption
_COD9_STRING_1* strings = NULL; //done
_COD9_FUNC_1* functions = NULL; //done
_COD9_EXTFUNC_1* extFunctions = NULL; //done
_COD9_RELOC_1* relocations = NULL; //done
~_COD9_WORK_1()
{
if (data)
delete[] data;
if (includes)
delete[] includes;
if (usingAnim)
delete[] usingAnim;
if (strings)
delete[] strings;
if (functions)
delete[] functions;
if (extFunctions)
delete[] extFunctions;
if (relocations)
delete[] relocations;
}
};
if (tstg.Hdr.numOfUsinganimtree)
{
tstg.usingAnim = new _COD9_USEANIM_1[tstg.Hdr.numOfUsinganimtree];
igsc.seekg(tstg.Hdr.usinganimtreeStructs);
for (int i = 0; i < tstg.Hdr.numOfUsinganimtree; i++)
{
_COD9_USEANIM_1 anim;
igsc.read(reinterpret_cast<char*>(&anim.name), sizeof(anim.name));
igsc.read(reinterpret_cast<char*>(&anim.numOfReferences), sizeof(anim.numOfReferences)); // this is 0 in this instance
igsc.read(reinterpret_cast<char*>(&anim.numOfAnimReferences), sizeof(anim.numOfAnimReferences));
igsc.read(reinterpret_cast<char*>(&anim.null1), sizeof(anim.null1));
anim.references = new DWORD[anim.numOfReferences]; // allocate 0 size array so theres something to delete
if(anim.numOfReferences) // should not be entered
{
igsc.read(reinterpret_cast<char*>(&anim.references), (anim.numOfReferences*sizeof(DWORD))); // if numOfReference = 0, function should return
}
anim.animReferences = new _COD9_ANIMREF_1[anim.numOfAnimReferences];
for (int ii = 0; ii < anim.numOfAnimReferences; ii++)
{
_COD9_ANIMREF_1 animref;
igsc.read(reinterpret_cast<char*>(&animref.name), sizeof(animref.name));
igsc.read(reinterpret_cast<char*>(&animref.reference), sizeof(animref.reference));
anim.animReferences[i] = animref;
}
tstg.usingAnim[i] = anim;
printf("anim: %d\n", i); // program reaches this
}
printf("Anims Done\n"); // program doesn't reach this
ReorderUsingAnim(&tstg);
}
Here is what is being read into the fields:
anim.name = 0x06BB
anim.numOfReferences = 0x0000
anim.numOfAnimReferences = 0x0001
anim.null1 = 0x0000
Where I think the error occurs is with the references array, since technically the size is 0 in this instance. But I'm not sure what to do about it, and I'm pretty lost in general about heap corruptions too.

Answer 1

_COD9_USEANIM_1 (why oh why newbies use such horrible names?? Is it enjoyable for them to call variables something like _Z_ASHD532___8AHQ_ ??) has two arrays (why not vectors??), references and anim_references. It has a destructor which frees the arrays if the pointers are not zero. But no constructor. This is DANGEROUS. You should, as a very least, provide a constructor which initializes them references and anim_references to zero. You also need the copy constructor. Remember the rule: if you provide one of the three (default constructor, destructor, copy constructor), you almost certainly need all three.
Ok, now you start your loop
for (int i = 0; i < tstg.Hdr.numOfUsinganimtree; i++)
In the loop you declare the variable anim
_COD9_USEANIM_1 anim;
You allocate its references and animReferences
anim.references = new DWORD[anim.numOfReferences];
...
anim.animReferences = new _COD9_ANIMREF_1[anim.numOfAnimReferences];
Finally you copy it to tstg.usingAnim
tstg.usingAnim[i] = anim;
You know what happens when you copy it? All fields are just copied. So now references and animReferences of tstg.usingAnim[i] point to the same address as references and animReferences of anim.
And then, the block ends. The evil computer calls the destructor for anim. The destructor calls delete[] for anim.references and anim.animReferences. But, references and animReferences of tstg.usingAnim[i] point to the same adresses. In other words, they now point to the array which were deleted.
Now the behaviour of your heap is unpredictable.
The best suggestion: forget arrays, and use vectors. You know, std::vector from the standard library.
Second best suggestion: provide default constructor and copy constructor. (PS: and assignment operator!)
(Note that you program may have other bugs too.)