realloc函数引发的惨案

#include <stdio.h>
#include <stdlib.h>

void inputdata( int * arr, int len);
void arrangeinorder( int * arr, int len);
void resultdata(int*, int);
void switch_choice(int * , int );
void finddata( int * arr, int len);
void deletedata(int * arr, int * len);
void adddata(int * arr, int * len);

int main (void)
{	
	int *arr;
	int len;
	
	printf ("enter the amount of data that you will input: ");
	scanf("%d", &len);

	arr = (int *) malloc( sizeof(int) * len);
	inputdata(arr, len);			 //单独测试可用（用来输入数组）
	arrangeinorder(arr, len);		 // 单独测试可用（把数组进行排序，从小到大）
	switch_choice (arr, len);
	free(arr);

	return 0;
}

void inputdata( int * arr, int len)
{
	int i;
	printf("please enter your data ;\n");
	for (i=0; i<len; ++i)
	{
		printf("%d-->  ", i+1);
		scanf("%d", &arr[i]);
	}
}

void arrangeinorder( int * arr, int len)
{
	int i,j,t;
	for (i=0; i<len; ++i)
	{
		for (j=i+1; j<len; ++j)
		{
			if (arr[i] > arr[j])
			{
				t = arr[i];
				arr[i] = arr[j];
				arr[j] = t;
			}
		}

	}
	resultdata(arr, len);
}

void finddata( int * arr, int len)
{
	int n,i;
	int t = 0;
	printf("please enter the number you want to find\n");
	scanf("%d", &n);

	for (i=0; i<len; ++i)
	{
		if (n == arr[i])
		{
			printf ("the number %d, is located in the %d th\n", n,i+1);
			t=1;
		}
	}

	if (t != 1 )
		printf("number %d is not in this array.\n", n);

}

void deletedata(int * arr, int * len)
{
	int n,i,j;
	int cnt =0;
	printf("please enter the number you want to delete from this array;\n");
	scanf ("%d", &n);

	for (i=0; i<*len; ++i)
	{
		while(n == arr[i])
		{
			for (j=i; j<*len; ++j)
				arr[j] = arr[j+1];
			cnt++;   //to count amount of number had been delete from array.
		}
	}
	*len = *len - cnt;
	arr = (int*)realloc(arr, sizeof(int)*(*len));
	if( arr == NULL )
	{
		printf("realloc memory failed\n");
		exit(1);
	}

	resultdata(arr, *len);
	switch_choice (arr, * len);
}

void adddata(int * arr, int * len)
{
	int n,i,j,k,t1;
	int *add,*tmp;
	int cnt =0;
	int t = 0;

	printf("please enter the amount of element you want to add;\n");
	scanf("%d", &n);

	add = (int *)malloc(sizeof(int) * n);

	inputdata(add, n); //把用户要添加的数据加入一个新的数组。
	t1 = *len; //下面循环有用，当用户输入的数都大于任何数的时候用的

	*len = *len + n ; //重新定义下数组长度，根据用户要扩充的大小。
	//realloc(arr, sizeof(int)*(*len));
	tmp = (int*)realloc(arr, sizeof(int)*(*len));

	if( tmp != NULL)
	{
		arr = tmp;
		tmp = NULL;
	}
	else
	{
		printf("realloc memory failed\n");
		exit(1);
	}

	for (i=0; i<n; ++i)								// i 循环是 循环要添加的数
	{
		for (j=0; j<t1+i; ++j)							// j循环 是循环原数组
		{
			if ( add[i] < arr[j])
			{
				for (k=j; k <= t1+i; ++k)
				{
						t = arr[k];
						arr[k] = add[i];
						add[i] = t;
				}
				cnt = 1;
				break;
				
			}
			cnt = 0;
		}
		if ( 0 == cnt)
			arr[t1+i]=add[i];

	}
	if (add != NULL)
	{
		free(add);
		add = NULL;
	}

	resultdata(arr, *len);
	switch_choice (arr, * len);
}

void resultdata( int * arr, int len)
{
	int i;
	printf("new array has been show below\n");
	for ( i=0 ; i <len ; ++i)
	{
		printf("%d-->  ", i+1);
		printf("%2d \n", arr[i]);
	}
}



void switch_choice(int * arr, int len)
{
	int n;

	printf("type number to choose the function you are going to use:\n");
	printf("1. activate number search.\n");
	printf("2. delete number from this array. \n");
	printf("3. add new numbers to this array. \n");
	printf("4. exit this program. \n");

	scanf("%d", &n);

	switch (n)
	{
	case 1:
		finddata (arr, len);
		break;
	case 2:
		deletedata (arr, &len);
		break;
	case 3:
		adddata ( arr, &len);
		break;
	case 4:
		return;
		break;
	}
}