no double free for win XP?

MK27 · 02-20-2009, 03:34 PM

t014y says in the concurrent "link list math" thread that this compiles and executes without error on win XP:

Code:

#include <stdio.h>
#include <stdlib.h>

int main() {
	void *ptr = malloc(666);
	free(ptr);
	puts("okay!");
	free(ptr);
	puts("okay!");
	return 0;
}

What's the deal? I thought that kind of mistake would be Universally Impermissible?

Elysia · 02-20-2009, 03:38 PM

It's undefined behavior. It may or may not crash or error or destroy your computer.

cpjust · 02-20-2009, 03:38 PM

Maybe in debug mode free() checks a list of allocated pointers and only tries to free it if it's on that list?

t014y · 02-20-2009, 06:02 PM

i was told that if the pointer was pointing to 'NULL' then free() did nothing... not make the program crash. but i don't know that much.

but if that is true then you could free the same thing any amount of times without crashing the program... right?

MK27 · 02-20-2009, 06:11 PM

Quote:

Originally Posted by t014y

i was told that if the pointer was pointing to 'NULL' then free()

Does ptr==NULL in that program? Never! I think my point is it's not your fault, t014y, that this twist has slipped by you if the compiler/OS, etc. let it.

What will happen is that the memory pointed to by ptr is freed, returned back to a pool used by the compiler. But the actual value of ptr, which is that memory address, has not changed (it would if you set it to NULL). You, yourself, and I are free to use that address (since we have it in a variable, ptr) however we like. The problem will arise if you are freeing and allocating in a loop like this, because the compiler will probably stick the next instance of x into that (same size) block, then you "double free" it because you have TWO pointer variables containing the same address. Or -- if you try to realloc one of them when the other just freed -- you will have some similar complication.

Basically, double-freeing occurs when you've lost control of the memory and that is guaranteed to cause a problem sometime soon. In the example I gave, it's easy to get away with, because no more memory is ever allocated so the space is safe. But it shows you're not getting told what you should have been.

matsp · 02-20-2009, 06:11 PM

Quote:

Originally Posted by t014y

i was told that if the pointer was pointing to 'NULL' then free() did nothing... not make the program crash. but i don't know that much.

but if that is true then you could free the same thing any amount of times without crashing the program... right?

The only way ptr would be NULL in the above code is if malloc failed (or one of the standard functions in the code has been replaced by a macro or something is REALLY b0rkened somewhere in the C runtime library).

It is most likely that whatever C runtime this is, it happens to work. Double free, after all, is undefined behaviour, not a "defined to crash".

Setting the pointer to NULL after free is definitely a good thing to do.

Double free can also cause problems later. For example, it may be that free is inserting into a linked list, and if the object has already been freed, it gets inserted twice. Guess what happens when you next ALLOCATE two blocks of that size? You get two pointers to the same bit of memory. Now try to debug why when you update ptr1, the values referenced by ptr2 that you allocated in a completely different place, is changing.... Nasty to figure that one out.

--
Mats

MK27 · 02-20-2009, 06:15 PM

Quote:

Originally Posted by matsp

It is most likely that whatever C runtime this is, it happens to work. Double free, after all, is undefined behaviour, not a "defined to crash".

I actually spit an edit about this:

Quote:

In the example I gave, it's easy to get away with, because no more memory is ever allocated so the space is safe. But it shows you're not getting told what you should have been.

quick like a bunny!

Quote:

Setting the pointer to NULL after free is definitely a good thing to do.

brewbuck · 02-21-2009, 02:43 PM

Quote:

Originally Posted by cpjust

Maybe in debug mode free() checks a list of allocated pointers and only tries to free it if it's on that list?

That's the opposite of what should happen in debug mode. In debug mode, such things should be checked for, and the program should crash if it happens.

cpjust · 02-21-2009, 10:10 PM

Quote:

Originally Posted by brewbuck

That's the opposite of what should happen in debug mode. In debug mode, such things should be checked for, and the program should crash if it happens.

You should also crash if you write past the end of an array, but since VC++ (and maybe other compilers) add extra padding before and after stack variables in debug mode, you don't crash unless you write past the end of the array and the padding.

02-20-2009, 03:34 PM	#1
MK27 critical genius Join Date: Jul 2008 Location: SE Queens Posts: 5,183	no double free for win XP? t014y says in the concurrent "link list math" thread that this compiles and executes without error on win XP: Code: #include <stdio.h> #include <stdlib.h> int main() { void ptr = malloc(666); free(ptr); puts("okay!"); free(ptr); puts("okay!"); return 0; } What's the deal? I thought that kind of mistake would be Universally Impermissible? __________________ "A man can't just sit around." --* Larry Walters
MK27 is online now

02-20-2009, 03:38 PM	#3
cpjust and the hat of sweating Join Date: Aug 2007 Location: Toronto, ON Posts: 3,280	Maybe in debug mode free() checks a list of allocated pointers and only tries to free it if it's on that list? __________________ "I am probably the laziest programmer on the planet, a fact with which anyone who has ever seen my code will agree." - esbo, 11/15/2008 "the internet is a scary place to be thats why i dont use it much." - billet, 03/17/2010
cpjust is offline

02-20-2009, 06:02 PM	#4
t014y Registered User Join Date: Sep 2008 Posts: 33	i was told that if the pointer was pointing to 'NULL' then free() did nothing... not make the program crash. but i don't know that much. but if that is true then you could free the same thing any amount of times without crashing the program... right?
t014y is offline

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
double free or corruption (out)	Mouser58907	C Programming	5	02-25-2009 12:20 AM
double free or corruption (fasttop)	yougene	C Programming	6	01-17-2009 06:44 PM
[Inheritance Hierarchy] User Input on program with constructors. How ?	chandreu	C++ Programming	8	04-25-2008 02:45 PM
Copying 2-d arrays	Holtzy	C++ Programming	11	03-14-2008 03:44 PM
double free or corruption???	hwttdz	C++ Programming	2	07-22-2006 03:02 PM