Where do malloc() and free() store allocated sizes and addresses?

c memory free heap
Elmar Weber picture Elmar Weber · May 12, 2009 · Viewed 7.8k times · Source

Where do malloc() and free() store the allocated addresses and their sizes (Linux GCC)? I've read that some implementations store them somewhere before the actual allocated memory, but I could not confirm that in my tests.

The background, maybe someone has another tip for this:

I'm experimenting a little bit with analyzing the heap memory of a process in order to determine the current value of a string in the other process. Accessing the process heap memory and strolling through it is no problem. However, because the value of the string changes and the process allocates a new part of the memory each time, the string's address changes. Because the string has a fixed format it's still easy to find, but after a few changes the old versions of the string are still in the heap memory (probably freed, but still not reused / overwritten) and thus I'm not able to tell which string is the current one.

So, in order to still find the current one I want to check if a string I find in the memory is still used by comparing its address against the addresses malloc() and free() know about.

ciao, Elmar

Answer

user25148 picture user25148 · May 12, 2009

There are lots of ways in which malloc/free can store the size of the memory area. For example, it might be stored just before the area returned by malloc. Or it might be stored in a lookup table elsewhere. Or it might be stored implicitly: some areas might be reserved for specific sizes of allocations.

To find out how the C library in Linux (glibc) does this, get the source code from http://ftp.gnu.org/gnu/glibc/ and look at the malloc/malloc.c file. There is some documentation at the top, and it refers to A Memory Allocator by Doug Lea.

Related questions

How do free and malloc work in C?

I'm trying to figure out what would happened if I try to free a pointer "from the middle" for example, look at the following code: char *ptr = (char*)malloc(10*sizeof(char)); for (char i=0 ; i<10 ; ++i) { ptr[i] = i+10; } ++…

Read More
strtok and memory leaks

I wrote a simple url parser using strtok(). here's the code #include <stdio.h> #include <stdlib.h> typedef struct { char *protocol; char *host; int port; char *path; } aUrl; void parse_url(char *url, aUrl *ret) { printf("…

Read More
Proper Way to Free Memory of a Returned Variable

I created a function designed to get user input. It requires that memory be allocated to the variable holding the user input; however, that variable is returned at the end of the function. What is the proper method to free …

Read More