Yes, every call to malloc() has to be matched with a call to free().
To answer your specific questions:
- You have to explicitly document your API telling the user whether the returned pointer has to be
free()'d
- The OS will free all memory allocated to the process.