Crash when using delete [] to delete a pointer - c++

Question

The code I'm using to make output of pTemp:
if (m_pTImgFrame != NULL)
{
for (int i = 0; i < m_nFrameNumber; i++)
{
TImage* pTemp = (TImage*)m_pTImgFrame[i];
if (pTemp != NULL)
{
TCHAR buffer[256] = { 0 };
_stprintf_s(buffer, 256, _T("%d,%d,%d,%d,%d,%d,%d,%d\n"),
pTemp->attrib,
pTemp->h,
pTemp->pitch,
pTemp->w,
pTemp->data[0],
pTemp->data[1],
pTemp->data[2],
pTemp->data[3]);
OutputDebugString(buffer);
delete[] pTemp;
m_pTImgFrame[i] = NULL;
}
}
delete []m_pTImgFrame;
m_pTImgFrame = NULL;
}
The origin code which still crashes
if (m_pTImgFrame != NULL)
{
for (int i = 0; i < m_nFrameNumber; i++)
{
BYTE* pTemp = (BYTE*)m_pTImgFrame[i];
if (pTemp != NULL)
{
delete[] pTemp;
m_pTImgFrame[i] = NULL;
}
}
delete []m_pTImgFrame;
m_pTImgFrame = NULL;
}
declaration of variables:
typedef unsigned int UINT;
typedef struct _TImage
{
int w;
int h;
int pitch;
int attrib;
unsigned char data[4];
} TImage;
UINT m_nFrameNumber;
UINT* m_pnFrameDelay;
TImage** m_pTImgFrame;
PBITMAPINFOHEADER pbih;
typedef struct tagBITMAPINFOHEADER{
DWORD biSize;
LONG biWidth;
LONG biHeight;
WORD biPlanes;
WORD biBitCount;
DWORD biCompression;
DWORD biSizeImage;
LONG biXPelsPerMeter;
LONG biYPelsPerMeter;
DWORD biClrUsed;
DWORD biClrImportant;
} BITMAPINFOHEADER, FAR *LPBITMAPINFOHEADER, *PBITMAPINFOHEADER;
Allocation:
m_pTImgFrame = new TImage*[1];
m_pTImgFrame[0] = (TImage*)new BYTE[sizeof(TImage) - 4 + 4 * width * pbih->biHeight];
m_pTImgFrame[0]->attrib = imageAttrib8888;
m_pTImgFrame[0]->w = width;
m_pTImgFrame[0]->h = pbih->biHeight;
m_pTImgFrame[0]->pitch = 4 * width;
LOG(_T("32width=%d, height=%d"), width, pbih->biHeight);
for(j=pbih->biHeight-1; j>=0; j--)
{
int indexDst = (pbih->biHeight-j-1) * width * 4;
//int indexSrc = j * pbih->biWidth * 4;
int indexSrc = j * ((pbmi->bmiHeader.biWidth * cClrBits +31) & ~31) /8/*bmpInfo.bmWidthBytes*/;
for(i=0; i< width; i++)
{
m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
m_pTImgFrame[0]->data[indexDst++] = lpBits[indexSrc++];
m_pTImgFrame[0]->data[indexDst++] = 255;
indexSrc++;
}
}
The code will crash when run the line
delete [] pTemp if the m_nFrameNumber is 1 (I only saw the crash happened when it is 1 but I'm not sure);The output of each value of the pTemp is correct, so why it crashes ?

Answer 1

The code will crash when run the line delete [] pTemp if the m_nFrameNumber is 1
Given what you just said and that the allocation is as follows:
m_pTImgFrame = new TImage*[1];
The only valid index of m_pTImgFrame is 0 because you only allocate the array to be of size 1. Trying to access m_pTImgFrame[1] is undefined behavior.
Second, your new operator needs to match your delete operator for both type and scalar.
You allocated as a byte array:
m_pTImgFrame[0] = (TImage*)new BYTE[sizeof(TImage) - 4 + 4 * width * pbih->biHeight];
Therefor the correct way to deallocate the element is like this:
BYTE* allocation = (BYTE*)m_pTImgFrame[0];
delete [] allocaiton;
This is wrong:
TImage* pTemp = (TImage*)m_pTImgFrame[i];
if (pTemp != NULL)
{
...
delete[] pTemp; // deleting as an array of TImage, when it should be deleted as an array of bytes
}
Unrelated tangent based on yoru code - It's not necessary to check for NULL before calling delete. Always has been safe to say delete NULL. Always will be.