Re: Joy of this, Joy of that

Louis Krupp <lkrupp@invalid.pssw.com.invalid> wrote:

On 11/26/2024 2:22 PM, Lawrence D'Oliveiro wrote:

On Tue, 26 Nov 2024 08:32:32 +0000, Richard Kettlewell wrote:
>

The examples show that freeing the same pointer twice can be
detected reliably.

They do no such thing.

free(p);
printf("%s(): returned from first free() call\n", __func__);
>
free(p);
printf("%s(): returned from second free() call\n", __func__);
>
Is that or is that not freeing the same pointer twice?

 
In the example in the man page, if the two free() calls are back to
back with no intervening malloc() calls, the double free() is
detected.  I tried adding a malloc(1000) call in the middle:
 
    free(p);
    printf("%s(): returned from first free() call\n", __func__);
 
    malloc(1000);
    printf("%s(): returned from second malloc(1000) call\n", __func__);
 
    free(p);
    printf("%s(): returned from second free() call\n", __func__);
 
and the program ran to completion with no apparent problem.
 
The compiler does what it can and glibc does what it can, but C is C
and the heap is what it is, and no, I don't know how this would work
in Rust.

Which was exactly Richard K's point to Lawrence.  It shows that one
simple pattern is detected, but does not support that *all* possible
usage patterns are detected.

In fact, for at least the free() manpage on my Slackware system, it
states this:

   The free() function frees the memory space pointed to by ptr, which
   must have been returned by a previous call to malloc(), calloc(), or
   realloc().  Otherwise, or if free(ptr) has already been called
   before, undefined behavior occurs.  If ptr is NULL, no operation is
   performed.

The paragraph above explicitly states that a second free(ptr) to a ptr
that was already freed, is undefined.  And with "undefined" we enter
that wonderful world of "almost anything at all can occur now".

The only two guarantees given in that paragraph are:

1) if ptr was returned by one of the malloc's, the space referenced by
   ptr is deallocated (albeit only for the first call of free(ptr), per
   the second sentence);
and
2) if ptr is NULL, nothing occurs.