What happens to the data in memory deallocated by free()?

问题

What happens to the data that is present in a memory location that has just been freed by a free() ? Is that data also deleted and the memory will now have a garbage value ? Or that data still persists there untill a new data is stored in that memory location (in future) ?

I mean, for code below:

int *ptr;
ptr = malloc(sizeof(int));
*ptr = 1;
 // Suppose ptr = 2000
 //Free now
free(ptr);
// My question is what is the value stored in memory address 2000 now ?
// Is it still '1' or some garbage value ?

回答1:

The result is unpredictable. There are several options that can happen. The point is that you cannot rely on any behavior of the memory released by free()

Some examples:

the memory can be untouched (remain the same as it is with the same data).
It can be given to another memory allocation, in which case it can be written over at any point.
It can be zeroed.
The page containing the memory can be returned to the OS, removing it from the memory map of your process, making your program crash if you try to access it.

回答2:

Whether or not the value is overwritten is undefined. Once free is called it is allowed to leave the memory as-is or it can overwrite it, but if you are interested in security you should overwrite it yourself before deallocating it. Speaking of deallocation, free doesn't have to give the memory back to the operating system, and in fact in many cases it won't, instead it will keep the memory allocated to your program so that the next time you call malloc it can simply give you back the same memory and avoid having to make more system calls, since the time it takes for memory allocation from the operating system is generally considered a less efficient use of resources than the program keeping a bit more memory allocated than it needs.

回答3:

I know that using the C free() function the memory used is released, but neither the pointer, nor the value contained in the memory is modified! free() only tells that the memory may be used for other purposes. (It may be some libraries implementations clean the freed memory or the pointer value, but this should not be the standard!)

I tried the code below with gcc (Ubuntu 4.8.2-19ubuntu1) 4.8.2

int main(void)
{
    int *i,j;

    i=malloc(100*sizeof(int));

    for(j=0;j<100;j++)
        i[j]=j+1;

    printf("%p %d\n",i,i[0]);

    free(i);

    printf("%p %d\n",i,i[0]);

    return 0;
}

The output results (as I expected) is:

0x1de2010 1
0x1de2010 1

回答4:

Malloc() is a library function. The answer depends upon how the library is implemented.

Most (if not all) mallocs prefix a header to the memory block returned. This is usually modified.

Some mallocs append a trailer to the memory block and write something to it. This is used to detect buffer overruns.

Some frees() will overwrite the write the returned memory with some bit pattern to detect subsequent writes.

There are a lot of mallocs out there that you can download and link with your application so you can get nearly any behavior you want by linking the malloc you want with your application.

回答5:

It depends on the compiler. If you are using gcc then after free value of that memory is become 0.

Here is a sample code:

#include<stdio.h>
#include<stdlib.h>

int main ( void )
{
        int *ptr = NULL;
        ptr = malloc (sizeof(int));
        *ptr = 5;
        printf ( "\n value of *ptr = %d", *ptr );
        free ( ptr );
        printf ( "\n value of *ptr = %d", *ptr );

        return ( 0 );
}

o/p:

./a.out

 value of *ptr = 5
 value of *ptr = 0

 ./a.out

 value of *ptr = 5
 value of *ptr = 0

./a.out

 value of *ptr = 5
 value of *ptr = 0

回答6:

Dereferencing a freed pointer leads to undefined behavior, which means anything is allowed to happen.

Most likely, you'll get some garbage value, but you might also trigger a segmentation fault, which will crash your program. Even so, neither of those behaviors are guaranteed, and you shouldn't rely on them.

来源：https://stackoverflow.com/questions/29586074/what-happens-to-the-data-in-memory-deallocated-by-free

标签

memory

free