Question

I started noticing that sometimes when deallocating memory in some of my programs, they would inexplicably crash. I began narrowing down the culprit and have come up with an example that illustrates a case that I am having difficulty understanding:

#include <iostream>
#include <stdlib.h>

using namespace std;

int main() {
char *tmp = (char*)malloc(16);
char *tmp2 = (char*)malloc(16);

long address = reinterpret_cast<long>(tmp);
long address2 = reinterpret_cast<long>(tmp2);
cout << "tmp = " << address << "\n";
cout << "tmp2 = " << address2 << "\n";

memset(tmp, 1, 16);
memset(tmp2, 1, 16);

char startBytes[4] = {0};
char endBytes[4] = {0};

memcpy(startBytes, tmp - 4, 4);
memcpy(endBytes, tmp + 16, 4);
cout << "Start: " << static_cast<int>(startBytes[0]) << " " << static_cast<int>(startBytes[1]) << " " << static_cast<int>(startBytes[2]) << " " << static_cast<int>(startBytes[3]) << "\n";
cout << "End: " << static_cast<int>(endBytes[0]) << " " << static_cast<int>(endBytes[1]) << " " << static_cast<int>(endBytes[2]) << " " << static_cast<int>(endBytes[3]) << "\n";
cout << "---------------\n";

free(tmp);

memcpy(startBytes, tmp - 4, 4);
memcpy(endBytes, tmp + 16, 4);
cout << "Start: " << static_cast<int>(startBytes[0]) << " " << static_cast<int>(startBytes[1]) << " " << static_cast<int>(startBytes[2]) << " " << static_cast<int>(startBytes[3]) << "\n";
cout << "End: " << static_cast<int>(endBytes[0]) << " " << static_cast<int>(endBytes[1]) << " " << static_cast<int>(endBytes[2]) << " " << static_cast<int>(endBytes[3]) << "\n";

free(tmp2);

return 0;
}

Here is the output that I am seeing:

tmp = 8795380
tmp2 = 8795400
Start: 16 0 0 0
End: 16 0 0 0
---------------
Start: 17 0 0 0
End: 18 0 0 0

I am using Borland’s free compiler. I am aware that the header bytes that I am looking at are implementation specific, and that things like “reinterpret_cast” are bad practice. The question I am merely looking to find an answer to is: why does the first byte of “End” change from 16 to 18?

The 4 bytes that are considered “end” are 16 bytes after tmp, which are 4 bytes before tmp2. They are tmp2’s header – why does a call to free() on tmp affect this place in memory?

I have tried the same example using new [] and delete [] to create/delete tmp and tmp2 and the same results occur.

Any information or help in understanding why this particular place in memory is being affected would be much appreciated.

Answer 1

You will have to ask your libc implementation why it changes. In any case, why does it matter? This is a memory area that libc has not allocated to you, and may be using to maintain its own data structures or consistency checks, or may not be using at all.