Freeing pointer after pointer arithmetic

Question

My question is very simple one. Say we have:

char* ptr = (char*) malloc(sizeof(char)*SIZE);
ptr+= SIZE/2;
free(ptr);

What happens when we free the pointer? Is it undefined operation? Does it free all of SIZE buffer or only the remaining SIZE/2? Thanks in advance for disambiguating this for me.

Answer 1

Your program will probably crash: the free() operation is actually quite simple in C, but works only on the original allocated address.

The typical memory allocator works like this pseudo code:

• ask to alloc 64 bytes
• allocator allocs 70 bytes (6 bytes more)
• the first 2 bytes is set to a "signature", a pattern recognized by the allocator to identify the memory allocated by him
• the next 4 bytes denote the allocated size
• return a pointer to the start of the 7th byte

So when you call free(ptr), the allocator goes 6 bytes before your pointer to check for the signature. If it doesn't find the signature, it crashes :)

Answer 2

If the argument to free() does not match a pointer previously allocated by means of malloc() and friends, the behaviour is undefined. You will most likely encounter a segmentation fault or a failed assertion in your version of libc.

Offtopic: it's better you didn't cast the result of malloc() in C.