Why exactly should I not call free() on variables not allocated by malloc()?

by

That’s undefined behavior – never try it.

Let’s see what happens when you try to free() an automatic variable. The heap manager will have to deduce how to take ownership of the memory block. To do so it will either have to use some separate structure that lists all allocated blocks and that is very slow an rarely used or hope that the necessary data is located near the beginning of the block.

The latter is used quite often and here’s how i is supposed to work. When you call malloc() the heap manager allocates a slightly bigger block, stores service data at the beginning and returns an offset pointer. Smth like:

void* malloc( size_t size )
{
      void* block = tryAlloc( size + sizeof( size_t) );
      if( block == 0 ) {
          return 0;
      }
      // the following is for illustration, more service data is usually written
      *((size_t*)block) = size;
      return (size_t*)block + 1;
 }

then free() will try to access that data by offsetting the passed pointer but if the pointer is to an automatic variable whatever data will be located where it expects to find service data. Hence undefined behavior. Many times service data is modified by free() for heap manager to take ownership of the block – so if the pointer passed is to an automatic variable some unrelated memory will be modified and read from.

Implementations may vary but you should never make any specific assumptions. Only call free() on addresses returned by malloc() family functions.

More Related Contents:

  1. How do free and malloc work in C?
  2. malloc implementation?
  3. If free() knows the length of my array, why can’t I ask for it in my own code?
  4. Why do I get different results when I dereference a pointer after freeing it?
  5. C: Correctly freeing memory of a multi-dimensional array
  6. Is freeing allocated memory needed when exiting a program in C
  7. How do malloc() and free() work?
  8. What REALLY happens when you don’t free after malloc before program termination?
  9. How can I get the size of an array from a pointer in C?
  10. Difference between static memory allocation and dynamic memory allocation
  11. Where in memory are my variables stored in C?
  12. Setting variable to NULL after free
  13. Why is malloc not “using up” the memory on my computer?
  14. Create a wrapper function for malloc and free in C
  15. Maximum memory which malloc can allocate
  16. How much memory would be freed if pointer is changed in C?
  17. free char*: invalid next size (fast) [duplicate]
  18. Explain this implementation of malloc from the K&R book
  19. malloc(sizeof(int)) vs malloc(sizeof(int *)) vs (int *)malloc(sizeof(int))
  20. Why would you ever want to allocate memory on the heap rather than the stack? [duplicate]
  21. Memory usage of current process in C
  22. Malloc vs custom allocator: Malloc has a lot of overhead. Why?
  23. Determining Stack Space with Visual Studio
  24. Why do you specify the size when using malloc in C?
  25. When should I use malloc in C and when don’t I?
  26. What happens if I try to access memory beyond a malloc()’d region?
  27. Is free() zeroing out memory?
  28. dynamic allocation/deallocation of 2D & 3D arrays
  29. Struct varies in memory size?
  30. new, delete ,malloc & free

Leave a Comment