Question

Dear g++ hackers, I have the following question.

When some data of an object is overwritten by a faulty program, why does the program eventually fail on destruction of that object with a double free error? How does it know if the data is corrupted or not? And why does it cause double free?

Answer 1

It’s usually not that the object’s memory is overwritten, but some part of the memory outside of the object. If this hits malloc’s control structures, free will freak out once it accesses them and tries to do weird things based on the corrupted structure.

If you’d really only overwrite object memory with silly stuff, there’s no way malloc/free would know. Your program might crash, but for other reasons.

Take a look at valgrind. It’s a tool that emulates the CPU and watches every memory access for anomalies (like trying to overwrite malloc’s control structures). It’s really easy to use, most of the time you just start your program inside valgrind by prepending valgrind on the shell, and it saves you a lot of pain.

Regarding C++: always make sure that you use new in conjunction with delete and, respectively, new[] in conjunction with delete[]. Never mix them up. Bad things will happen, often similar to what you are describing (but valgrind would warn you).