/* Off-by-one error leading to double free of last pointer in array. */

#include <stdlib.h>

#define ARSZ 100

int main()
{
  int **array, *freed, i;
  array = calloc(sizeof(char *), ARSZ);
  freed = calloc(sizeof(int), ARSZ);
  for (i = 0; i <= ARSZ - 1; i++)
  {
    array[i] = calloc(sizeof(int), 10);
    free(array[i]);
  }
  for (i = 0; i < ARSZ - 1; i++)
    freed[i] = 1;
  for (i = 0; i < ARSZ; i++)
    if (freed[i] == 0)
      free(array[i]);
  free(array);
  free(freed);
  return 0;
}