Free/ double free in a process // Use of BoundsChecker and Coverity

If you have never given importance to free chances are you never worked in real life project. If i try to define free in one line, its the way to transfer ownership of "memory allocated" back to the heap manager.

Free should only be used with something you malloced or NULL.

int x=20;
int ptr= &x;
free(ptr); 
this will result in an error, as memory pointed by ptr is in  stack part of the process.

Wondered why NULL?

For NULL free only checks the value of ptr and does not release any block, process is not harmed at all. This can be used as boon if used properly. Will explain you how at correct time.

When we allocated memory by malloc or calloc, it is supplied by heap manager from the heap of the process which i limited. Once the maximum heap memory allocated is exhausted the process dies  crying for more space.

example:-

int main()
{
            int *ptr;
            while(1)
            {
                   ptr=malloc(10);
            }

}
this process dies/(phat jaiyega, mar jayega - :) ) because of lack of heap memory.

For a large application like in a small software if there is a memory leak, lets say small as 2 or 3 bytes in a piece of code, but if the application runs for 2 to 3 days (for those who don't  shut down there system - i am one of them though) chances are this piece of code  gets executed many times resulting in large memory leak.


Let me list few of the leaks/errors due to not using  free properly;

1>

char* Copy(int *str)
{
     char* sptr= malloc(30);
     memset(sptr,'\0',30);
     strcpy(sptr,str);
}

A programmer after some times write  a function PlayBasketBall(int number,char* player1,char* player2)

and call it as PlayBasketBall(1,Copy(user1),Copy(online_user)). The programmer missed that function call to Copy allocates memory which need to be freed , hence every time PlayBasketBall is called it leaks memory. Believe me its very common, i have found such errors in very reputed application. The thumb rule is, the function allocating memory should take the responsibility to free it.

2> Deallocating a memory area with free does not make the contents of the pointer NULL.

After free the pointer remains pointing to the memory, its just that its made available to heap manager, hence can,t be access during execution.

What will happen if you double free the pointer.

case 1:

int *ptr= malloc(20);
if(xyz>20)
{
    PlayWithPtr(ptr);
    free(ptr);
}
..........
.........\
if(abc<10)
{
    free(ptr);
}

case 2:

typedef struct link
{
  int val;
   struct link *common;
   struct link * next;
}LL;

void delete(LL* list)
{
    if(list==NULL)
         return;
    delete(list->next);
    delete(list->common);
    free(list);
     
}
int main()
{
  LL list1,list2;
  list1.val=2;
  list1.next=NULL;
  list1.commom= malloc(sizeof(LL));
  list1.common->next=NULL;
  list1.common->common->next=NULL;
  
  list2.val=3;
  list2.next=NULL;
  list2.common=list1.common;

  /*...... manipulate list1 and list 2 ............... */

delete(&list1);
delete(&list2);
}


if both the condition if true ptr is freed twice.?? you are trying to return double the memory what you borrowed :) you are making heap manager rich. 

in case 2: the common area is deleted twice while deleting link list1 and list2. this will result in memory corruption.


It will result in unpredictable behavior and most probably a crash.
Its best to set the pointer to NULL after free to be on safer side. Now i think you got the boon of free(NULL); 

3> Memory used after free.

int *ptr= malloc(20)
if(i am happy)
{
    free(ptr);
}
............
..................
.........

if(my dad increased my pocket money this month)
{
     ptr[7]=ptr[6]+amount increased;
}

now think what will happen if the guy is happy because his dad increased his pocket money. this might lead to unpredictable behavior and you might be roaming in GBs of code to find the reason of the bug. but if the code would have been


int *ptr= malloc(20)
if(i am happy)
{
    free(ptr);
    ptr=NULL;
}
............
..................
.........

if(my dad increased my pocket money this month)
{
     ptr[7]=ptr[6]+amount increased;
}



Program will crash at the exact point where there is issue and its easy to fix.

From second and third reason its clear free(ptr) should also be accompanied by ptr=NULL;