There are several malloc implementations - a malloc implementation also covers free() (or new and delete. Whichever applies.) malloc looks for the first memory chunk in the free list that is big enough to accomodate your request.
The +4 is there because malloc creates a memory descriptor that is two unsigned longs (each long is usually 4 bytes in 32 bit image files, check limits.h for your particular box - see LONG_MAX )Code:free(path); <- this frees up a chunk at least 12 (+4) bytes long ............. dirPtr=malloc(5); <- this needs only five (+4) bytes, so it re-uses the memory
The first long is the size, the second longword is the address that malloc returns. So, if you malloc(120), the algorithm looks for the first 124 byte-long free chunk.
(This is how Doug Lea's malloc works, for example)
It also explains your observation - malloc is re-using your memory. Which observation is a bad idea by the way. Don't free() the path variable.
Period.