HEAP CORRUPTION

[skt90]

为什么在执行delTree（）最后释放tree时会出现heap corruption？
源程序：
tree.h

#ifndef TREE_H_
#define TREE_H_

/* Definition of ITEM */
typedef int ITEM;

/* Definition of node */
struct node {
	node *left;
	node *right;
	ITEM item;
};

/* Definition of TREE */
typedef struct {
	node *root;
	unsigned int numberOfNode;
}*TREE;

/* Miscellaneous Method */
TREE initTree();
bool addElement(TREE tree,ITEM item);
void delElement(TREE tree,ITEM item);
void delTree(TREE tree);
static void delNode(node *node);
static void copyToNode(node *ptr,ITEM item);
static node * findPosition(TREE tree,									//At here,the value 0 of direction presents left
						   ITEM item,									//and the value 1 of direction presents right
						   node **prev,									//prev is designed for further use.
						   bool &direction,
						   int (*compare)(ITEM item1,ITEM item2));		//Compare function is designed by user.

static int compare(ITEM item1,ITEM item2);
#endif

tree.cpp

#include <iostream>
#include "tree.h"
using namespace std;

TREE initTree()
{
	TREE tree;
	if(!(tree=(TREE)malloc(sizeof(TREE))))
		return NULL;
	tree->root=NULL;
	tree->numberOfNode=0;
	return tree;
}

bool addElement(TREE tree,ITEM item)
{
	node *ptr;
	if(!(ptr=(node *)malloc(sizeof(node))))
		return false;
	copyToNode(ptr,item);
	ptr->left=ptr->right=NULL;
	if(!tree->root)
		tree->root=ptr;
	else
	{
		bool direction=0;
		node *prev=NULL;
		if(findPosition(tree,item,&prev,direction,compare))
			return false;
		if(direction)
			prev->right=ptr;
		else
			prev->left=ptr;
	}
	tree->numberOfNode++;
	return true;
}

void delElement(TREE tree,ITEM item)
{
	node *ptr=NULL,*prev=NULL;
	bool direction=false;
	if(ptr=findPosition(tree,item,&prev,direction,compare))
	{
		if(!ptr->left&&!ptr->right)
		{
			free(ptr);
			if(direction)
				prev->right=NULL;
			else
				prev->left=NULL;
		}
		else if(ptr->left&&!ptr->right)
		{
			if(direction)
				prev->right=ptr->left;
			else
				prev->left=ptr->left;
			free(ptr);
		}
		else if(!ptr->left&&ptr->right)
		{
			if(direction)
				prev->right=ptr->right;
			else
				prev->left=ptr->left;
		}
		else
		{
			if(direction)
			{
				prev->right=ptr->left;
				node *cur=ptr->left;
				while(cur->right)
					cur=cur->right;
				cur->right=ptr->right;
				free(ptr);
			}
			else
			{
				prev->left=ptr->left;
				node *cur=ptr->left;
				while(cur->right)
					cur=cur->right;
				cur->right=ptr->right;
				free(ptr);
			}
		}
		tree->numberOfNode--;
	}
}

void delTree(TREE tree)
{
	if(tree->root)
		delNode(tree->root);
	free(tree);
}

static void delNode(node *root)
{
	if(root->left)
	{
		delNode(root->left);
		root->left=NULL;
	}
	if(root->right)
	{
		delNode(root->right);
		root->right=NULL;
	}
	free(root);
}

static void copyToNode(node *ptr,ITEM item)
{
	ptr->item=item;
}

static node * findPosition(TREE tree,ITEM item,node **prev,bool &direction,int (*compare)(ITEM item1,ITEM item2))
{
	node *cur=tree->root;
	*prev=tree->root;
	while(cur)
	{
		if(item==cur->item)
			return cur;
		else if(compare(item,cur->item)<0)
		{
			direction=false;
			*prev=cur;
			cur=cur->left;
		}
		else
		{
			direction=true;
			*prev=cur;
			cur=cur->right;
		}
	}
	return NULL;
}

static int compare(ITEM item1,ITEM item2)
{
	return item1-item2;
}

[arong1234]

TREE initTree()
{
    TREE tree;
tree你定义得是一个指针，分配时，你需要的尺寸是这个指针指向的结构的大小，而不是指针类型自己的大小，sizeof(TREE)永远是4，而你需要的是 *tree。
    if(!(tree=(TREE)malloc(sizeof(TREE))))
        return NULL;

改成tree = (TREE)malloc(sizeof(*tree)); //最好不要只定义指针类型，把结构类型也定义才是比较好的选择
    tree->root=NULL;
    tree->numberOfNode=0;
    return tree;
}

[arong1234]

我想，还是不要用这种面向过程的语言来做这种数据结构的事情，C++比它好多了

[skt90]

果然如一楼所说，那要是按我原来的那样，是不是我的TREE结构里的成员已经溢出了？

[skt90]

我是刚刚学完C，现在正在“升级”为C++，所以。。。。。