On Tue, 5 Aug 2008 11:46:06 +0530, "Shyamal Shukla" <[EMAIL PROTECTED]> wrote: > Hi All, > > I am trying to validate my understanding of how malloc works by means > of the below C program which tries to corrupt essential information > maintained by malloc for free() operation. > > The program allocates 4, 12 byte blocks (internally 16 bytes are allocated > for each 12 byte block). Hence the total allocated space was 48 bytes. > > As malloc maintains the (length of allocated block + 1), 4 bytes before the > returned pointer (from malloc), I have manipulated this length for the first > block and set it to 49 with the goal that a single free shall release all > these 4 blocks and a subsequent malloc of 15 bytes shall be from the address > of first block. > > However, this does not happen. Can someone please correct my understanding > and provide me with a reference to the working of malloc() and free()?
That's because the original assumption is false. You wrote that "malloc maintains the (length of allocated block + 1), 4 bytes before the returned pointer (from malloc)". But that is not really true for all malloc() implementations, and it certainly isn't true for the `jemalloc' implementation that FreeBSD 7.X and 8.0-CURRENT use. _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
