在C中循环重复超过127次时的内存泄漏

我的代码有一个奇怪的问题，其中仅当对无符号字符的for循环超过127的值时，才会发生内存泄漏。以下是一些相关的函数：

int main()
{
  size_t len = strlen("1b37373331363f78151b7f2b783431333d78397828372d363c78373e783a393b3736") / 2;
  char *bytes = hex_to_bytes("1b37373331363f78151b7f2b783431333d78397828372d363c78373e783a393b3736"), *xor_output;

  xor_output = xor_against_key(find_single_xor_key(bytes, len), bytes, len);

  free(bytes);

  puts(xor_output);

  free(xor_output);

  return 0;
}

char hex_to_dec(char hex)
{
  if (hex >= 'a')
    return hex - 'a' + 10;

  return hex - '0';
}

char *hex_to_bytes(char *hex)
{
  char *bytes, *p;

  bytes = malloc(strlen(hex) / 2);
  p = bytes;

  while (*hex) {
    *p   = hex_to_dec(*hex++) * 16;
    *p++ += hex_to_dec(*hex++);
  }

  return bytes;
}

char *xor_against_key (unsigned char key, const char *str, size_t size)
{
  int i = 0;
  char *xored = malloc(size + 1);

  for (; i < size; i++)
    xored[i] = str[i] ^ key;

  xored[i] = 0;

  return xored;
}

double calculate_frequency_score(size_t *frequencies, size_t size)
{
  double score = 0;
  double expected_fractions[] = {0.08167, 0.01492, 0.02782, 0.04253, 0.12702, 0.02228, 0.02015,
                 0.06094, 0.06966, 0.00153, 0.00772, 0.04025, 0.02406, 0.06749,   
                 0.07507, 0.01929, 0.00095, 0.05987, 0.06327, 0.09056, 0.02758,
                 0.00978, 0.02360, 0.00150, 0.01974, 0.00074};

  for (int i = 0; i < 26; i++)
    score += sqrt(expected_fractions[i] * frequencies[i] * size);

  return score;
}

size_t *letter_frequencies(char *str)
{
  size_t *frequencies = malloc(sizeof(size_t) * 26); // 26 letters

  for (int i = 0; i < 26; i++)
    frequencies[i] = 0;

  while (*str) {
    if (!isascii((unsigned char)*str))
      return NULL;
    if (isalpha(*str))
      frequencies[tolower(*str) - 'a']++;
    str++;
  }

  return frequencies;
}

char find_single_xor_key(char *str, size_t size)
{
  double best_score = DBL_MIN;
  unsigned char best_char;

  for (unsigned char c = 0; c < 255; c++) {
    char *xored;
    size_t *frequencies;
    double score = 0;

    //leaks for some reason when c >= 128
    xored = xor_against_key(c, str, size);

    frequencies = letter_frequencies(xored);

    if (frequencies != NULL && strlen(xored) == size && (score = calculate_frequency_score(frequencies, size)) > best_score) {
      best_score = score;
      best_char = c;
    }

    free(frequencies);
    free(xored);
  }

  return best_char;
}

这段代码确实按预期工作，但是当我在上面运行valgrind时（我使用-g和-lm标志在clang上编译了它），它表明在find_single_xor_key函数中发生了内存泄漏。这是--leak-check = full的valgrind结果：

==1769== Memcheck, a memory error detector
==1769== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1769== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==1769== Command: ./a.out
==1769== 
Cooking MC's like a pound of bacon
==1769== 
==1769== HEAP SUMMARY:
==1769==     in use at exit: 26,416 bytes in 127 blocks
==1769==   total heap usage: 513 allocs, 386 frees, 63,058 bytes allocated
==1769== 
==1769== 26,416 bytes in 127 blocks are definitely lost in loss record 1 of 1
==1769==    at 0x4C2CEDF: malloc (vg_replace_malloc.c:299)
==1769==    by 0x1090AA: letter_frequencies (set1.c:163)
==1769==    by 0x108B37: find_single_xor_key (set1.c:220)
==1769==    by 0x108963: main (set1.c:37)
==1769== 
==1769== LEAK SUMMARY:
==1769==    definitely lost: 26,416 bytes in 127 blocks
==1769==    indirectly lost: 0 bytes in 0 blocks
==1769==      possibly lost: 0 bytes in 0 blocks
==1769==    still reachable: 0 bytes in 0 blocks
==1769==         suppressed: 0 bytes in 0 blocks
==1769== 
==1769== For counts of detected and suppressed errors, rerun with: -v
==1769== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

经过一些调试后，我发现当我将for循环中的c的最大值（find_single_xor_key函数中的一个）减小到128时，没有内存泄漏。对于每一次重复循环，当c大于或等于128时，根据valgrind，将发生1个内存泄漏块。

我还试图查看当循环仅运行55次（任意选择，要点是当循环运行少于128次重复时会发生什么情况），而c的起始值为200（[200， 254]），并且根据valgrind在55个块中存在内存泄漏。

我不知道为什么会这样，有人知道吗？

谢谢。