关于c语言中的free()函数的问题，高手们请进！！

leelqrose

请问，为什么会有这样的问题出现，

    char *pstr = (char *)malloc(20);
    memset(pstr,0,20);
    sprintf(pstr,"%s","this is test!";
    free(pstr);  //在这儿释指针放空间不会出错
    pstr =  pstr + 4;
    free(pstr) ;  //在这里释放指针空间会出错。
    pstr = pstr - 4;
    free(pstr);  //在这儿释放指针空间也会出错，

请问各位高手，这是什么原因！

蓝色键盘

man malloc
里面详细说明了free一段被修改了的malloc系列函数返回指针时出现的错误。

leelqrose

哦，我有时间去查一下，谢谢，能具体讲一下吗！

蓝色键盘

If free() or realloc() is passed a pointer that was not the result of
      a call to malloc(), realloc(), calloc(), or valloc(), or if space
      assigned by an allocation function is overrun, loss of data, a memory
      fault, bus error, or an infinite loop may occur at that time or during
      any subsequent call to malloc(), realloc(), calloc(), valloc(), or
      free().

      The following actions are not supported and cause undesirable effects:

           +  Attempting to free() or realloc() a pointer not generated as
              the result of a call to malloc(), realloc(), calloc(), or
              valloc().

      The following actions are strongly discouraged and may be unsupported
      in a future implementation of malloc():

           +  attempting to free() the same block twice,
Standard input
+  depending on unmodified contents of a block after it has been
              freed.

      Undocumented features of earlier memory allocators have not been
      duplicated.