c - Why is this free statement causing a heap corruption error? -

i wrote code not sure how free memory dynamically allocated inside of function.

what proper way free memory without causing heap corruption, or better yet, causing corruption when trying free `returnedary``

  #include <stdio.h> #include <stdlib.h> #define max_num_digits 10  void displaymainmenu(void); int* extractuncommondigit(int*, int);  int main() {     displaymainmenu();      return 0; }  void displaymainmenu() {     int* userary = null;     int* returnedary = null;     int menuoption;     int numofints;     int i;      {         printf("\n\n*********************************************\n"             "*                     menu                  *\n"             "* 1. calling extractuncommondigit()         *\n"             "* 2. quit                                   *\n"             "*********************************************\n"             "select option (1 or 2): ");         scanf_s("%d", &menuoption);          switch (menuoption) {         case 1:             printf("\n  how many integers? ");             scanf_s("%d", &numofints);             userary = (int*)malloc(numofints * sizeof(int));              (i = 0; < numofints; i++) {                 printf("    enter integer #%d: ", + 1);                 scanf_s("%d", &userary[i]);             }              printf("\n  original array: \n");             (i = 0; < numofints; i++) {                 printf("    %d\n", userary[i]);             }              printf("\n  calling extractuncommondigit() -\n");             returnedary = extractuncommondigit(userary, numofints);             printf("\n  displaying after returning array"                 " -- uncommon digits: ");              if (returnedary[0] != 0) {                 printf("\n    there is/are %d uncommon digit(s)", returnedary[0]);                 (int = 1; < returnedary[0] + 1; i++) {                     printf("\n      %d", *(returnedary + i));                 }             } else {                 printf("\n   there is/are no uncommon digit(s)");             }             break;         case 2:             free(userary);             /* line causes heap corruption error             -----------------------------------------             free(returnedary);             -----------------------------------------             */             printf("\n  fun excercise ...");             break;         default:             printf("\n  wrong option!");             break;         }     } while (menuoption != 2);      free(userary);      return; }  int* extractuncommondigit(int* ary, int size) {     int* assembledary = 0;     int tmp;     int** digitinfoary = (int**)malloc(size * sizeof(int*));     int i, j;     int digitary[10] = { 0 };     int uncommoncount = 0;      (i = 0; < size; i++) {         *(digitinfoary + i) = (int*)calloc(max_num_digits, sizeof(int));     }      (i = 0; < size; i++) {         tmp = *(ary + i) < 0 ? -(*(ary + i)) : *(ary + i);          {             *(*(digitinfoary + i) + tmp % 10) = 1;             tmp /= 10;         } while (tmp != 0);     }      (i = 0; < max_num_digits; i++) {         (j = 0; j < size; j++) {             digitary[i] += *(*(digitinfoary + j) + i);         }     }      (i = 0; < max_num_digits; i++) {         if (digitary[i] == 1) {             uncommoncount++;         }     }      assembledary = (int*)malloc(uncommoncount * sizeof(int) + 1);     *assembledary = uncommoncount;      if (uncommoncount != 0) {         (i = 0, j = 1; < max_num_digits; i+=2) {             if (digitary[i] == 1) {                 assembledary[j] = i;                 j++;             }         }         (i = 1; < max_num_digits; i+=2) {             if (digitary[i] == 1) {                 assembledary[j] = i;                 j++;             }         }     }      free(digitinfoary);      return assembledary; } 

the commented text displays program crashes after running debugger. doing wrong?

i expect problem here, don't allocate enough memory , later write off end of block, invoking undefined behaviour:

assembledary = (int*)malloc(uncommoncount * sizeof(int) + 1); 

you want (uncommoncount + 1) * sizeof(int) bytes.

unrelated, have leak when freeing digitinfoary (because don't free allocated pointers contains), , double-freeing userary before leaving main.