C :: Invalid Next Size Error

After looking online for a string replace function in C and finding so many examples that go through the entire string twice. First round to find how number of occurances of substitute in string, using that to malloc for a new string to include additional space for replace, then going through the search string again to get all but what's to be substituted out. I feel it's kind of silly to go through the string twice. Therefore, I'm trying to implement my own string replace, that only searches through the string for what's to be substituted, once.

Here is my code:

Code:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
char *strreplace(char * string, char * sub, char * replace);
}

[code]....

Here is the same code, but with execution + some syntax highlighting: Ideone.com | Online C Compiler & Debugging Tool..It works great, until it gets to grabbing whatever remains in the search string after the last found sub. The realloc throws a runtime error:

Code:

*** glibc detected *** ./a.out: realloc(): invalid next size: 0x00011008 ***

Aborted From my understanding, this is from me going outside of the bounds of the heap and using memory I haven't allocated, or using a free'd pointer. I'm not seeing where either of these are happening in my code, and was wondering what the best way to go about figuring out where the error exactly occurs.