Функция удаляет массив

int main()
{
	const char *str = "45AF1267345FF001256AD34DA23666B00B512309";
	uint8_t *b = malloc(20);
	int len = osmo_hexparse(str, b, 20);

	while (len--) printf("%02X", *b++);
	putchar('\n');
	return 0;
}

int gsm340_append_tpdu(struct msgb *msg){
	uint8_t *smsp;
	smsp = msgb_put(msg, 21);
	//char tpdu[] = {0x01,0x00,0x0B,0x91,0x97,0x51,0x30,0x38,0x23,0xF7,0x00,0x00,0x07,0xF4,0xF2,0x9C,0x9E,0x76,0x9F,0x01};
	char *tpdu;
	size_t tpdu_length;
	sock_server(&tpdu,&tpdu_length);
	uint8_t *b = malloc(20);
	
	int ret = osmo_hexparse(tpdu,b,20);
	printf("ret %d\n",ret);
	//FILE * logfile;
	//logfile=fopen("~/pdulog","w+");
	int i;
	printf("Before cycle\n");
	while (ret--) printf("%02X, ", *b++);
	printf("\n");
	memcpy(smsp,b,20 );
	free(tpdu);
	free(b);
	return tpdu_length;
} 

ret 20
Before cycle
01, 00, 0B, 91, 97, 51, 30, 38, 23, F7, 00, 00, 07, F4, F2, 9C, 9E, 76, 9F, 01, 
*** Error in `./mobile': free(): invalid next size (fast): 0x00000000022abe10 ***
======= Backtrace: =========
/usr/lib/libc.so.6(+0x73f8e)[0x7f3266f9af8e]
/usr/lib/libc.so.6(+0x7988e)[0x7f3266fa088e]
/usr/lib/libc.so.6(+0x7a04b)[0x7f3266fa104b]
./mobile[0x412f4b]
./mobile[0x413156]
./mobile[0x4347c4]
/usr/local/lib/libosmovty.so.0(+0x68a5)[0x7f326770b8a5]
/usr/local/lib/libosmovty.so.0(cmd_execute_command+0xce)[0x7f326770e3fe]
/usr/local/lib/libosmovty.so.0(vty_read+0x719)[0x7f3267710459]
/usr/local/lib/libosmovty.so.0(+0xcc71)[0x7f3267711c71]
/usr/local/lib/libosmocore.so.4(osmo_select_main+0x1d1)[0x7f3267921871]
./mobile[0x40477f]
/usr/lib/libc.so.6(__libc_start_main+0xf0)[0x7f3266f47000]
./mobile[0x4048ec]

nt  sock_server(char **tpdu, size_t *data_length){
  struct sockaddr_un srvr_name, rcvr_name;
  unlink(SOCK_NAME);
  int sock = socket(AF_UNIX, SOCK_DGRAM, 0);
  if (sock < 0) 
  {
    perror("socket failed");
    return -1;
  }

  srvr_name.sun_family = AF_UNIX;
  strcpy(srvr_name.sun_path, SOCK_NAME);
  printf("binding %d\n",sock);
  
  if (bind(sock,(struct sockaddr *) &srvr_name, strlen(srvr_name.sun_path) +
        sizeof(srvr_name.sun_family)) < 0) 
  {
    perror("bind failed");
    return -1;
  }
  //Receiving tpdu
  *tpdu=Receiving_data(sock,rcvr_name,data_length);
  if(*tpdu == NULL){
    perror("Can't reseive pdu\n");
    return -1;
  }
  //sms_text[bytes]=0;
  close(sock);
  unlink(SOCK_NAME);
  return 0; 
}

char * Receiving_data(int sock, struct sockaddr_un rcvr_name, size_t *data_length ){
  socklen_t namelen;
  int bytes;
  //size_t data_length[1];
  bytes = recvfrom(sock, data_length, sizeof(size_t), 0, (struct sockaddr *)&rcvr_name, &namelen);
  printf("pdu_length=%d\n",*data_length);
  char *data=malloc(*data_length);
  bytes = recvfrom(sock, data, *data_length,  0,(struct sockaddr * ) &rcvr_name, &namelen);
  if (bytes < 0) 
  {
    perror("recvfrom failed");
    return NULL;
  }
  data[bytes]=0;
  printf("PDU %s\n", data);
  return data; 
}

	uint8_t *b = malloc(20);
	int ret = osmo_hexparse(tpdu,b,20);
	while (ret--) printf("%02X, ", *b++); // теряешь указатель на веделенную память
	memcpy(smsp,b,20 ); // читаешь через не актуальный указатель
	free(b); // освобождаешь неизвестно что

int main()
{
	const char *str = "45AF1267345FF001256AD34DA23666B00B512309";
	uint8_t *b = malloc(20);
	int i, len = osmo_hexparse(str, b, 20);

	for (i = 0; i < len; i++) printf("%02X", b[i]);
	return putchar('\n'), free(b), 0;
}

char * Receiving_data(int sock, struct sockaddr_un rcvr_name, size_t *data_length ){
...
  bytes = recvfrom(sock, data_length, sizeof(size_t), 0, (struct sockaddr *)&rcvr_name, &namelen);
  char *data=malloc(*data_length);
  bytes = recvfrom(sock, data, *data_length,  0,(struct sockaddr * ) &rcvr_name, &namelen);

  data[bytes]=0; // переполнение буфера