how 'free' works when pointer is incremented

Question

When malloc is called, the size is stored adjacent to the allocated block so that free will know how much to free etc ( http://c-faq.com/malloc/freesize.html ).

My question is, Say we have dynamically allocated memory and later in the code we increment the pointer

 pointer++

And then later, if i call a

free(pointer) 

what memory does actually get freed up.

Is it number of allocated bytes starting from the current address pointed by 'pointer' or from the base address to which it has been allocated.

Answer 1

It will cause undefined behavior. Most likely it will crash your program either instantly or later.

Answer 2

That's undefined behavior. And it will most probably results in problem later on.

Answer 3

This is what we call a memory leak/segmentation fault.

You HAVE to pass the same pointervalue to free() as the one you got from malloc() or your application will misbehave/crash.

Answer 4

If you increment the pointer without saving the original malloced location you can't call free on it. You have to save the original location somewhere and use a temporary point when you increment.

Answer 5

doing pointer++ to original pointer is terribly wrong. result of freeing it may be different on different implementations, but you definitely shouldn't do it.

Answer 6

You need to free() the same pointer as you received from malloc(). Incrementing, altering or changing it is undefined behaviour, that is usually a segmentation fault.

Think of the pointer you receive as a book from the library. You go home and read it. Then you remove the front page and the book's back and hand it back .. will the librarian accept it, will he know what the book is about? Or are you in serious trouble then?

Answer 7

You can only call free() on a value that you previously obtained from malloc(), calloc(), or realloc() (or NULL). Everything else is undefined.

For example, an implementation might store the size of the allocated block in 4 bytes before the return address from malloc(). Then, free() goes back 4 bytes and finds out the size. This wouldn't work if you don't pass the original pointer back to free().

Answer 8

The pointer returned by malloc() points directly to the memory on the heap that will be used by your program.

However, this isn't the only memory that's allocated. A few bytes are allocated in the memory locations immediately preceding the pointer returned that indicate the size of the chunk on the heap. This isn't used by your program, but it will definitely be needed by free.

When free(p) is called, the information about its chunk on the heap is contained in, say, the locations from p-4 through p-1. This depends on implementation of course, but the details need not concern the programmer. The only thing that the programmer needs to know is that free uses that area of memory to free the chunk of memory from the heap, and that area is derived from the original pointer p.

In other words, if you call free on p, it will only make sense if malloc once returned exactly p.

If you pass in a pointer that wasn't created with malloc, who knows what will lie at p-1, p-2, etc.? It will probably result in a catastrophic failure.

Answer 9

The code managing the free storage just assumes that you wouldn't hand it the wrong pointer. It takes whatever you give, doesn't check its plausibility, and interprets it the same way it would interpret the right pointer. It will act according to whatever values it reads from whatever memory locations it looks at assuming the pointer was rightfully obtained. If you handed it a stray pointer, it will find nonsensical values and thus act nonsensical.

This is called undefined behavior and it's a mean thing. It might format your hard drive, toast your CPU, or make your program seemingly work the way it is expected to until you retire. You never know.