how does realloc know the size of original data?
void *realloc(void *ptr, size_t size);
So, if the implementation is like this:
realloc (and malloc and free) have full access to the entire datastructure that makes up the heap. In that datastructure is information about the sizes of blocks, which realloc needs to know, and so does free.