diff --git a/codes/c/chapter_hashing/hash_map_open_addressing.c b/codes/c/chapter_hashing/hash_map_open_addressing.c
index b0b29c30b..ffcb2d980 100644
--- a/codes/c/chapter_hashing/hash_map_open_addressing.c
+++ b/codes/c/chapter_hashing/hash_map_open_addressing.c
@@ -111,7 +111,7 @@ void put(HashMapOpenAddressing *hashMap, int key, char *val) {
     // 若找到键值对，则覆盖 val 并返回
     if (hashMap->buckets[index] != NULL && hashMap->buckets[index] != hashMap->TOMBSTONE) {
         free(hashMap->buckets[index]->val);
-        hashMap->buckets[index]->val = (char *)malloc(sizeof(strlen(val + 1)));
+        hashMap->buckets[index]->val = (char *)malloc(sizeof(strlen(val) + 1));
         strcpy(hashMap->buckets[index]->val, val);
         hashMap->buckets[index]->val[strlen(val)] = '\0';
         return;
@@ -119,7 +119,7 @@ void put(HashMapOpenAddressing *hashMap, int key, char *val) {
     // 若键值对不存在，则添加该键值对
     Pair *pair = (Pair *)malloc(sizeof(Pair));
     pair->key = key;
-    pair->val = (char *)malloc(sizeof(strlen(val + 1)));
+    pair->val = (char *)malloc(sizeof(strlen(val) + 1));
     strcpy(pair->val, val);
     pair->val[strlen(val)] = '\0';
 
diff --git a/codes/c/chapter_sorting/counting_sort.c b/codes/c/chapter_sorting/counting_sort.c
index 01e534eac..f5120fcaf 100644
--- a/codes/c/chapter_sorting/counting_sort.c
+++ b/codes/c/chapter_sorting/counting_sort.c
@@ -18,7 +18,7 @@ void countingSortNaive(int nums[], int size) {
     }
     // 2. 统计各数字的出现次数
     // counter[num] 代表 num 的出现次数
-    int *counter = calloc(m, sizeof(int));
+    int *counter = calloc(m + 1, sizeof(int));
     for (int i = 0; i < size; i++) {
         counter[nums[i]]++;
     }
diff --git a/codes/c/chapter_tree/binary_search_tree.c b/codes/c/chapter_tree/binary_search_tree.c
index e4e7c1021..b790d8010 100644
--- a/codes/c/chapter_tree/binary_search_tree.c
+++ b/codes/c/chapter_tree/binary_search_tree.c
@@ -117,6 +117,8 @@ void removeItem(BinarySearchTree *bst, int num) {
         } else {
             pre->right = child;
         }
+        // 释放内存
+        free(cur);
     } else {
         /* 子节点数量 = 2 */
         // 获取中序遍历中 cur 的下一个节点