Heap corruption in a multimap??

[Gladdok]

Any ideas why I would be getting this debug error? :
HEAP: Free Heap block a59700 modified at a59714 after it was freed

When I step through the function, the iterator shows to match a valid member in the multimap.

The function executes fine the first time through( when there are 2 members in the map ).

The second time through when it gets to the line ainput.mFunKeyStack.top().erase( fkit );, this error comes up and the code breaks in a void deallocate( pointer, size_type ) call in xmemory.

It does not point to end() (or else my assertion would catch it) and in the debug window I can see the key value/function pointer pair in the multimap, only when it goes to be erased the error happens.

Here is the code where it is happening but I don't think from here there would be much of a clue why:

FunKeyMmap::iterator fkit = ainput.mFunKeyStack.top().find( afunkey.first );
assert( fkit!=ainput.mFunKeyStack.top().end() );
ainput.mFunKeyStack.top().erase( fkit );

KeyFunMmap::iterator kfit = ainput.mKeyFunStack.top().find( afunkey.second );
assert( kfit!=ainput.mKeyFunStack.top().end() );
ainput.mKeyFunStack.top().erase( kfit );

The thing is, this code is called from within a loop so there really isn't any other code I could see that would invalidate any of these maps. For reference the types I use above are defined here

typedef int(*InputFun)(Context*);
typedef std::pair<InputFun,SDLKey> FunKeyPair;
typedef std::pair<SDLKey,InputFun> KeyFunPair;
typedef std::multimap<InputFun,SDLKey> FunKeyMmap;
typedef std::multimap<SDLKey,InputFun> KeyFunMmap;

[Gladdok]

So I followed a suggestion in this thread http://social.msdn.microsoft.com/Forums/hu-HU/vclanguage/thread/01bae812-0a5f-4b17-9745-b1c8293a25b1 and made a list of each allocation 'new' pointer I made since i figured it was probably my fault where i was using dynamic arrays of my own.

This led me to a call of list::clear() . Strange thing is, when I follow the code into <xmemory> the last thing I see is that the pointer is to valid data (a string of Characters [a struct with a char and some color info])

You can see here http://imgur.com/pxkqG that the object being destroyed has a valid member mLines, which is an array, and the first value has a valid member called mChars. This itself is an array of Characters and you can see the first mChar is 'D'.

Now when I proceed and execute the line _DESTRUCTOR(_Ty, _Ptr); I get a debug error and I get sent straight to the destructor for the first mLine, but the member mChars no longer has valid values! it appears to have been freed.

If I follow the destructor for the appropriate object, we have only one line: delete[] mLines;
Now this I would expect is going to call the destructor for all the lines in mLines, but here is where we find that we suddenly have a line with an invalidated pointer!

Any suggestions of where to go from here are greatly appreciated.