how does realloc know the size of original data?
void *realloc(void *ptr, size_t size);
So, if the implementation is like this:
When you malloc some memory, the block you get is usually a fixed offset into a larger data structure that also holds extra information, notably the size of the block. You can verify that this is true on some systems by just noting that every address returned by malloc ends in 8 when printed in hex (e.g., with the %p substitution to printf). Of course, realloc can reverse this offset and get back to the memory management structure, and so get the size; from there, being able to know how much to copy (when necessary) is trivial…