malloc(): memory corruption 一个socket日志文件程序，求大神帮忙看看，谢谢！！！

[FlashBaby518]

提示malloc(): memory corrupution 是内存溢出？分配错误吗？

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <resolv.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <sys/types.h>
#include <malloc.h>
#include <time.h>

#define MAXBUF 1024

typedef struct
{
	char name[20];
	int age;
	int num;
}Stu;

FILE *fp;
struct tm *T;
time_t now;

int main(int argc,char *argv[])
{
	int sockfd,len;
	struct sockaddr_in dest;
	if (argc != 3)
	{
		printf("Error format,it must be: \n\t\t%s IP port\n",argv[0]);
		exit(EXIT_FAILURE);
	}
	if ((sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)		//创建socket对象
	{
		perror("Socket");
		exit(errno);
	}
	printf("socket created\n");
	bzero(&dest,sizeof(dest));
	dest.sin_family = AF_INET;					//地址协议
	dest.sin_port = htons(atoi(argv[2]));				//端口先由字符型转成整型，然后由主机顺序转成网络顺序
	if (inet_aton(argv[1],(struct in_addr *) &dest.sin_addr.s_addr) == 0)	//目的端IP地址，转成32位地址
	{
		perror(argv[1]);
		exit(errno);
	}
	if (connect(sockfd,(struct sockaddr *) &dest,sizeof(dest)) == -1)
	{
		perror("Connect");
		exit(errno);
	}
	printf("Server connected\n");

	int needRecv = sizeof(Stu);
	char *buffer = (char *)malloc(needRecv);
	void *p;	
		while(1)
		{
			bzero(buffer,needRecv + 1);
			Stu *bStu = (Stu *)malloc(sizeof(Stu));
			int pos=0,length;
			while(pos < needRecv)
			{
				length = recv(sockfd,buffer+pos,MAXBUF,0);
				if (length < 0)
				{
					perror("recv");
					break;
				}
				pos+=length;
			}
			memcpy(bStu,buffer,needRecv);	//从buffer到bStu拷贝needRecv个字节
			fp = fopen("log.txt","a+");
			time(&now);
			T = localtime(&now);
			p = malloc(sizeof(asctime(T))+1);
			fwrite(p,sizeof(asctime(T)),1,fp);
			fprintf(fp,"\n");
			fprintf(fp,"Recv: name = %s, age = %d, num = %d\n",bStu->name,bStu->age,bStu->num);
			free(buffer);
			free(p);
			free(bStu);
			fflush(stdout);
			fclose(fp);
		}
	close(sockfd);
	return 0;
}

[FlashBaby518]

上面是客户端，这是服务器端

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/socket.h>
#include <resolv.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <sys/types.h>
#include <malloc.h>

#define MAXBUF 1024

typedef struct
{
	char name[20];
	int age;
	int num;
}Stu;

int main(int argc,char *argv[])
{
	int pid;
	int sockfd,new_fd;
	socklen_t len;
	struct sockaddr_in my_addr,their_addr;
	unsigned int myport,lisnum;
	if (argv[2])
		myport = atoi(argv[2]);
	else
		myport = 7575;
	if (argv[3])
		lisnum = atoi(argv[3]);
	else
		lisnum = 5;
	if ((sockfd = socket(AF_INET,SOCK_STREAM,0)) == -1)	//执行失败的话，返回-1
	{
		perror("socket");	//perror( ) 用来将上一个函数发生错误的原因输出到标准设备
		exit(EXIT_FAILURE);	//exit(1)进程正常退出；exit(0)进程非正常退出；EXIT_FAILURE常量1
	}
	
	bzero(&my_addr,sizeof(my_addr));
	my_addr.sin_family = AF_INET;
	my_addr.sin_port = htons(myport);
	if (argv[1])
		my_addr.sin_addr.s_addr = inet_addr(argv[1]); //将点分十进制地址转换成网络顺序32位地址
	else
		my_addr.sin_addr.s_addr = INADDR_ANY;  //否则设置本机任意地址
	if (bind(sockfd,(struct sockaddr *) &my_addr,sizeof(struct sockaddr)) == -1)
	{
		perror("bind");
		exit(EXIT_FAILURE);
	}                                                 //绑定地址信息
	if (listen(sockfd,lisnum) == -1)
	{
		perror("listen");
		exit(EXIT_FAILURE);
	}                                                //监听网络
	printf("Wait for Connect...\n");
	len = sizeof(struct sockaddr);
	if ((new_fd = accept(sockfd,(struct sockaddr *) &their_addr,&len)) == -1)
	{
		perror("accept");
		exit(EXIT_FAILURE);
	}
	else
		printf("Server: got connection from %s,port %d,socket %d\n",inet_ntoa(their_addr.sin_addr),ntohs(their_addr.sin_port),new_fd);
	
	/*if (-1 == (pid = fork()))
	{
		perror("fork");
		exit(EXIT_FAILURE);
	}
	else if (pid == 0)					//子进程用于发送消息
	{	*/
		while (1)					//直到输入quit或发送出错才退出循环
		{
			int needSend = sizeof(Stu);
			char *buf = (char *)malloc(needSend);
			bzero(buf,needSend + 1);
			Stu *aStu = (Stu *)malloc(sizeof(Stu));
			printf("Please input name/age/num:\n");
			scanf("%s %d %d",aStu->name,&aStu->age,&aStu->num);
			memcpy(buf,aStu,needSend);
			int pos=0,length;
			while(pos < needSend)
			{
				length = send(new_fd,buf+pos,MAXBUF,0);
				if (length <= 0)
				{
					perror("send");
					break;
				}
				pos+=length;
			}
			free(buf);
			free(aStu);
		}
	close(new_fd);
	close(sockfd);
	return 0;
}

[renwotao2009]

客户端代码，buffer指向的内存就只分配一个stu结构体大小，buffer+pos时，堆内存就越界了，可定就崩了