C - Accessing data AFTER memory has been free()ed?

Question

I\'m reading a lot about malloc() and free() in Standard C. As I understand it, you malloc() for some memory exactly once and then you free() that

Answer 1

When you malloc memory, you're given a pointer to some space, and when you free it, you're giving it back to the system. Often, you can still access this memory, but using memory after you have freed it is VERY BAD.

The exact behavior is undefined, but on most systems you can either continue to access the memory, or you get a segfault.

One interesting experiment you can try is to try and malloc more memory after you free'd that pointer. On most systems I've tried, you get the same block back (which is a problem, if you were relying on the data being there in the freed block). Your program would end up using both pointers, but since they point to the same physical data, you'll be overwriting your own data!

The reason for this is that when you malloc data (depending on the malloc implementation of course), malloc first requests a block of data from the operating system (typically much larger than the malloc request), and malloc will give you a segment of that memory. You'll be able to access any part of the memory malloc originally got from the operating system though, since to the operating system, it's all memory your program is internally using. When you make a free, you're telling the malloc system that the memory is free, and can be given back to the program later on.

Writing outside of the malloc area is very dangerous because

1. It can segfault, depending on your c implementation
2. You can overwrite metadata structures malloc is relying on, which causes VERY BAD PROBLEMS when you free/malloc more data later on

If you are interested in learning more, I would recommend running your program through valgrind, a leak detector, to get a better picture of what's freed/not freed.

PS: On systems without an OS, you most likely wont get a segfault at all, and you'll be able to wite anywhere willy nilly. The OS is responsible for triggering a segfault (when you write/read to memory you don't have access to, like kernel or protected memory)

If you are interested in learning more, you should try to write your own malloc, and/or read/learn about the memory management operating systems do.

Answer 2

The crash in your code is due to double free. Appendix J.2 of C11 says that behaviour is undefined for example when:

The pointer argument to the free or realloc function does not match a pointer earlier returned by a memory management function, or the space has been deallocated by a call to free or realloc (7.22.3.3, 7.22.3.5).

However it is possible to write code that will crash on Linux just by reading a value from memory that was just freed.

In glibc + Linux there are two different mechanisms of memory allocations. One uses the brk/sbrk to resize the data segment, and the other uses the mmap system call to ask the operating system to give large chunks of memory. The former is used for small allocations, like your 10 characters above, and mmap for large chunks. So you might get a crash by even accessing the memory just after free:

#include <stdio.h>
#include <stdlib.h>

int main(){
    char* p = malloc(1024 * 1024);
    printf("%d\n", *p);
    free(p);
    printf("%d\n", *p);
}

And finally, the C11 standard says that the behaviour is undefined even when

The value of a pointer that refers to space deallocated by a call to the free or realloc function is used (7.22.3).

This means that after not only that dereferencing the pointer (*p) has undefined behaviour, but also that it is not safe to use the pointer in any other way, even doing p == NULL has UB. This follows from C11 6.2.4p2 that says:

The value of a pointer becomes indeterminate when the object it points to (or just past) reaches the end of its lifetime.