内存释放（free）时的一个奇怪问题，求高手指导下！

写了个简单的counting sort程序，结果发现个奇怪现象，就是给定输入的排序的数组的大小是3，则出现free时的segment fault，其他大小暂时没有发现这个问题。

先给出几组输出，再给出关键程序源码。

~/MyPro/Algorithms/sort $ ./counting_sort 1024 1000000
start sorting ... 
sorting finished! 
====================================
counting sort                       
Sorting 1024 elements 
Time: 0s      19044us 
The result is right ! 
====================================


~/MyPro/Algorithms/sort $ ./counting_sort 1000000 100
start sorting ... 
sorting finished! 
====================================
counting sort                       
Sorting 1000000 elements 
Time: 0s      31986us 
The result is right ! 
====================================

 

~/MyPro/Algorithms/sort $ ./counting_sort 3 10
start sorting ... 
*** glibc detected *** ./counting_sort: free(): invalid next size (fast): 0x08ca8048 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(+0x6b591)[0xbdf591]
/lib/tls/i686/cmov/libc.so.6(+0x6cde8)[0xbe0de8]
/lib/tls/i686/cmov/libc.so.6(cfree+0x6d)[0xbe3ecd]
./counting_sort[0x8048a42]
./counting_sort[0x8048b6d]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb8abd6]
./counting_sort[0x80487f1]
======= Memory map: ========
00614000-00615000 r-xp 00000000 00:00 0          [vdso]
008cd000-008e8000 r-xp 00000000 08:08 2490382    /lib/ld-2.11.1.so
008e8000-008e9000 r--p 0001a000 08:08 2490382    /lib/ld-2.11.1.so
008e9000-008ea000 rw-p 0001b000 08:08 2490382    /lib/ld-2.11.1.so
00b74000-00cc7000 r-xp 00000000 08:08 2490421    /lib/tls/i686/cmov/libc-2.11.1.so
00cc7000-00cc8000 ---p 00153000 08:08 2490421    /lib/tls/i686/cmov/libc-2.11.1.so
00cc8000-00cca000 r--p 00153000 08:08 2490421    /lib/tls/i686/cmov/libc-2.11.1.so
00cca000-00ccb000 rw-p 00155000 08:08 2490421    /lib/tls/i686/cmov/libc-2.11.1.so
00ccb000-00cce000 rw-p 00000000 00:00 0 
00dba000-00dd7000 r-xp 00000000 08:08 2490452    /lib/libgcc_s.so.1
00dd7000-00dd8000 r--p 0001c000 08:08 2490452    /lib/libgcc_s.so.1
00dd8000-00dd9000 rw-p 0001d000 08:08 2490452    /lib/libgcc_s.so.1
08048000-0804a000 r-xp 00000000 08:08 2360303    /home/chenqi/MyPro/Algorithms/sort/counting_sort
0804a000-0804b000 r--p 00001000 08:08 2360303    /home/chenqi/MyPro/Algorithms/sort/counting_sort
0804b000-0804c000 rw-p 00002000 08:08 2360303    /home/chenqi/MyPro/Algorithms/sort/counting_sort
08ca8000-08cc9000 rw-p 00000000 00:00 0          [heap]
b7700000-b7721000 rw-p 00000000 00:00 0 
b7721000-b7800000 ---p 00000000 00:00 0 
b7896000-b7897000 rw-p 00000000 00:00 0 
b78a8000-b78ab000 rw-p 00000000 00:00 0 
bfab0000-bfac5000 rw-p 00000000 00:00 0          [stack]
已放弃

/**

• function: counting_sort -- sort a[begin:end) of range [0, range-1]
  *

**/
void counting_sort(int a[], int begin, int end, int range)
{

int aux_array_size = range; /* 0 -- range-1 */
int *aux = (int*)malloc_c(sizeof(int)*range);
int *b = (int*)malloc_c(sizeof(int)*(end-begin));
int i, j;
for (i=0; i<range; i++)
{
    aux[i] = 0;
}
for (j=begin; j<end; j++)
{
    aux[a[j]] += 1;
}
for (i=1; i<range; i++)
{
    aux[i] = aux[i-1] + aux[i];
}
for (j=end-1; j>=begin; j--)
{
    b[aux[a[j]]] = a[j];
    aux[a[j]] -= 1;
}
for (j=begin; j<end; j++)
{
    a[j] = b[j];
}
free(b);
free(aux);

}

./counting_sort 3 10相当于调用counting_sort(a, 0, 3, 10);