c - Wrong values stored and other -

i made program:

llist:

typedef struct linked_list     {         int val;         int n;         struct linked_list *next;     }llist; 

addelem function:

void addelem(llist *list,int val) {     llist *tmp=(llist *)malloc(sizeof(llist)); //create new element     tmp->val=val; //assign value tmp     tmp->next=null; //set next null   //  printf("addelem entered\n");     if(list->next!=null) //if not last element     {         addelem(list->next,val); //recursion     }     else     {     tmp->n=list->n + 1;     list->next=(llist *)malloc(sizeof(llist)); //allocate memory     list->next=tmp; //add list     }  //   printf("addelem exited\n");     free(tmp); } 

remelem function:

void remelem(llist *list) {     int f=0;     if(list->n==0 && list->next==null)         goto dontremove;     if(1)     {     if(list->next!=null)     {         if(list->next->next==null)         {             f=1;         }         remelem(list->next);     }     else     {         free(list);     }     if(f==1)     {         list->next=null;     }     }     else     { dontremove:     printf("cant removed if next message 'element removed.'\n");     }     //end } 

show function:

void show(llist *list) {     printf("element number: %d\nelement value: %d\n",list->n,list->val);     if(list->next!=null)     {         show(list->next);     }     else     {         printf("\ntotal number of elems: %d\n",list->n);;     } } 

main function:

int main() {     int i,n,ch;     llist *list=(llist *)malloc(sizeof(llist));     list->next=null;     list->n=0;     list->val=0; menu: //menu label     printf("1.add element.\n");     printf("2.remove element.\n3.show elements\n0.exit.\n");     scanf("%d",&ch);     switch(ch)     {         case 1:             printf("\nenter value.\n");             scanf("%d",&n);             addelem(list,n);             printf("element added\n");             break;         case 2:             remelem(list);             printf("\nelement removed.\n");             break;         case 3:             show(list);             break;         case 0:             goto end; //end             break;     }     goto menu; //show menu again end: //end label     return 0; } 

output:

1.add element. 2.remove element. 3.show elements 0.exit. 1  enter value. 22 element added 1.add element. 2.remove element. 3.show elements 0.exit. 1  enter value. 4 element added 1.add element. 2.remove element. 3.show elements 0.exit. 2  element removed. 1.add element. 2.remove element. 3.show elements 0.exit. 3 element number: 0 element value: 0 element number: 1 element value: 161701936  total number of elems: 1 

the values different ones typed,. first question why happen?(probably silly mistake) , how can fix print correct value.

, here output:

1.add element. 2.remove element. 3.show elements 0.exit. 1  enter value. 22 element added 1.add element. 2.remove element. 3.show elements 0.exit. 1  enter value. 23 element added 1.add element. 2.remove element. 3.show elements 0.exit. 2  element removed. 1.add element. 2.remove element. 3.show elements 0.exit. 1  enter value. 22 segmentation fault (core dumped) 

in this, first add element, remove it,but if add element again segmentation fault, can explain why happen , how fix it?.

and if @ first add element , remove it, get:

*** glibc detected *** ./llist: double free or corruption (fasttop): 0x0855b018 ***  ======= backtrace: ========= memory addresses ======= memory map: ======== 08048000-08049000 r-xp 00000000 08:01 1969473    /path/to/this/prog 08049000-0804a000 r--p 00000000 08:01 1969473    /path/to/this/prog 0804a000-0804b000 rw-p 00001000 08:01 1969473    /path/to/this/prog 0855b000-0857c000 rw-p 00000000 00:00 0          [heap] b758e000-b75aa000 r-xp 00000000 08:01 3802036    /lib/i386-linux-gnu/libgcc_s.so.1 b75aa000-b75ab000 r--p 0001b000 08:01 3802036    /lib/i386-linux-gnu/libgcc_s.so.1 b75ab000-b75ac000 rw-p 0001c000 08:01 3802036    /lib/i386-linux-gnu/libgcc_s.so.1 b75c3000-b75c4000 rw-p 00000000 00:00 0  b75c4000-b7767000 r-xp 00000000 08:01 3805265    /lib/i386-linux-gnu/libc-2.15.so b7767000-b7768000 ---p 001a3000 08:01 3805265    /lib/i386-linux-gnu/libc-2.15.so b7768000-b776a000 r--p 001a3000 08:01 3805265    /lib/i386-linux-gnu/libc-2.15.so b776a000-b776b000 rw-p 001a5000 08:01 3805265    /lib/i386-linux-gnu/libc-2.15.so b776b000-b776e000 rw-p 00000000 00:00 0  b7782000-b7787000 rw-p 00000000 00:00 0  b7787000-b7788000 r-xp 00000000 00:00 0          [vdso] b7788000-b77a8000 r-xp 00000000 08:01 3805277    /lib/i386-linux-gnu/ld-2.15.so b77a8000-b77a9000 r--p 0001f000 08:01 3805277    /lib/i386-linux-gnu/ld-2.15.so b77a9000-b77aa000 rw-p 00020000 08:01 3805277    /lib/i386-linux-gnu/ld-2.15.so bf969000-bf98a000 rw-p 00000000 00:00 0          [stack] aborted (core dumped) 

can please tell why these errors have occured?

i use ubuntu 12.04

thank you

your function addelem contains lot of errors. check code

void addelem(llist *list,int val) {     llist *tmp=malloc(sizeof(llist)); //create new element     tmp->val=val; //assign value tmp     tmp->next=null; //set next null   //  printf("addelem entered\n");     if(list->next!=null) //if not last element     {         addelem(list->next,val); //recursion         free(tmp); //not using tmp in function     }     else     {         tmp->n = list->n + 1;         list->next=tmp;     } } 

in ypir code below statements contains lot of error

else { tmp->n=list->n + 1; list->next=malloc(sizeof(llist)); //allocate memory list->next=tmp; //add list } //   printf("addelem exited\n"); free(tmp); 

you assinging new object next of list. overwriting tmp object. deleting tmp object. list->next dangling pointer