请教各位一个问题 为什么我malloc 228个字节的时候释放就会出错啊

#include <stdio.h>
#include <stdlib.h>
int main(int argc,char *argv[]){
   if(argc!=2){
      printf("error\n";
      exit(0);
   }
   char *p;
   int size=strlen("test"*sizeof(char)+sizeof(char)*strlen(argv[1]);
   printf("size=%d\n",size);
   p=(char *)malloc(size);
   if(p==NULL){
      printf("malloc error";
      exit(1);
   }
   memset(p,0,size );
   sprintf(p,"test%s",argv[1]);
   printf("%s\n",p);
   free(p);
   return 0;
}
这个是我的代码

./test =sdfsdfsdfkjahdfaksyhdkanckjzhsciuqydfaskhdaksdkasjdhasklfhsdkajhfiusadfhsjkadfhkasjdfnkdjlhafksfhjksadfhwaeuifhskdafhkjaslfashfklshafklsjhfuwiahdsakjdfhkjldfafhksdfsdfsdfsdfsdfssdfsdfsdfsdfsdfssdfsdfsdfsdddsfsdfdfsdfssdfghj
我这样就会出错
*** glibc detected *** ./test: double free or corruption (!prev): 0x096ab008 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(+0x6b591)[0x6ef591]
/lib/tls/i686/cmov/libc.so.6(+0x6cde[0x6f0de8]
/lib/tls/i686/cmov/libc.so.6(cfree+0x6d)[0x6f3ecd]
./test[0x804862c]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0x69abd6]
./test[0x80484c1]
======= Memory map: ========
00110000-00111000 r-xp 00000000 00:00 0          [vdso]
001f1000-0020e000 r-xp 00000000 08:01 1050709    /lib/libgcc_s.so.1
0020e000-0020f000 r--p 0001c000 08:01 1050709    /lib/libgcc_s.so.1
0020f000-00210000 rw-p 0001d000 08:01 1050709    /lib/libgcc_s.so.1
0034d000-00368000 r-xp 00000000 08:01 1050651    /lib/ld-2.11.1.so
00368000-00369000 r--p 0001a000 08:01 1050651    /lib/ld-2.11.1.so
00369000-0036a000 rw-p 0001b000 08:01 1050651    /lib/ld-2.11.1.so
00684000-007d7000 r-xp 00000000 08:01 1055047    /lib/tls/i686/cmov/libc-2.11.1.so
007d7000-007d8000 ---p 00153000 08:01 1055047    /lib/tls/i686/cmov/libc-2.11.1.so
007d8000-007da000 r--p 00153000 08:01 1055047    /lib/tls/i686/cmov/libc-2.11.1.so
007da000-007db000 rw-p 00155000 08:01 1055047    /lib/tls/i686/cmov/libc-2.11.1.so
007db000-007de000 rw-p 00000000 00:00 0
08048000-08049000 r-xp 00000000 08:01 262726     /home/mmxcq/c/test
08049000-0804a000 r--p 00000000 08:01 262726     /home/mmxcq/c/test
0804a000-0804b000 rw-p 00001000 08:01 262726     /home/mmxcq/c/test
096ab000-096cc000 rw-p 00000000 00:00 0          [heap]
b7700000-b7721000 rw-p 00000000 00:00 0
b7721000-b7800000 ---p 00000000 00:00 0
b785f000-b7860000 rw-p 00000000 00:00 0
b786e000-b7871000 rw-p 00000000 00:00 0
bf919000-bf92e000 rw-p 00000000 00:00 0          [stack]
Aborted

好像字母上的意思是说两次释放 但是我只释放了一次
./test =sdfsdfsdfkjahdfaksyhdkanckjzhsciuqydfaskhdaksdkasjdhasklfhsdkajhfiusadfhsjkadfhkasjdfnkdjlhafksfhjksadfhwaeuifhskdafhkjaslfashfklshafklsjhfuwiahdsakjdfhkjldfafhksdfsdfsdfsdfsdfssdfsdfsdfsdfsdfssdfsdfsdfsdddsfsdfdfsdfssdfghjsdfsdfsd这样就不会出错  不知道具体原因 请教各位朋友 谢谢了

#include <stdio.h>
#include <stdlib.h>
int main(int argc,char *argv[]){
   if(argc!=2){
      printf("error\n");
      exit(0);
   }
   char *p;
   int size=strlen("test")*sizeof(char)+sizeof(char)*strlen(argv[1]);
   printf("size=%d\n",size);
   p=(char *)malloc(size);
   if(p==NULL){
      printf("malloc error");
      exit(1);
   }
   memset(p,0,size );
   sprintf(p,"test%s",argv[1]);
   printf("%s\n",p);
   free(p);
   return 0;
}