WHY THE DANGLING POINTER SHOWS THE VALUE AND ADDRESS EVEN AFTER FREEING IT USING FREE FUNCTION?

Question

WHY THE DANGLING POINTER SHOWS THE VALUE AND ADDRESS EVEN AFTER FREEING IT USING FREE FUNCTION?

Debojit Acharjee 455

In the following program a pointer has been freed using the free() function but still it prints the address and value of the initialized variable.

#include <stdio.h>

#include <stdlib.h>

int main()

{

  int a = 1;

  int *a_ptr = &a;

  printf("The value of 'a' is %d\n", *a_ptr);

  free(a_ptr);

  printf("The value of 'a' is %d", *a_ptr);

  return 0;

}

Ourput:

User's image

Minxin Yu 13,506 Reputation points Microsoft External Staff

2023-07-28T02:20:52.56+00:00

Did the answers solve your previous problems? Or this is a follow-up question?
Why the dereference operator is used with the void keyword while declaring a void pointer?

Why the user-defined function needs to be before the main function for a function pointer to work

2 answers

Your answer

Minxin Yu 13,506 Reputation points Microsoft External Staff

2023-07-28T02:20:52.56+00:00

Did the answers solve your previous problems? Or this is a follow-up question?
Why the dereference operator is used with the void keyword while declaring a void pointer?

Why the user-defined function needs to be before the main function for a function pointer to work

Answer 1

P a u l 10,761

Just referencing this article:

https://www.tutorialspoint.com/c_standard_library/c_function_free.htm

"The C library function void free(void *ptr) deallocates the memory previously allocated by a call to calloc, malloc, or realloc."

So because a is a stack allocated variable rather than a block of memory allocated by one of the *alloc functions the free function may not affect it at all (i.e. it's undefined behaviour).

Debojit Acharjee 455

Even after using the malloc function the pointer still points to the value of 'a'.

#include <stdio.h>
#include <stdlib.h>

int main()
{
  int a = 1;

  int *a_ptr = (int*)malloc((sizeof(int)));

  a_ptr = &a;

  printf("The address of 'a' is %p\n", a_ptr);

  free(a_ptr); // A dangling pointer

  printf("The address of 'a' is %p\n", a_ptr);

  printf("The value of 'a' is %d", *a_ptr);

  return 0;
}

Output:

User's image

P a u l 10,761 Reputation points

2023-07-29T14:22:54.5666667+00:00
I'm fairly new myself to C++ but I believe this causes a memory leak because the memory that's allocated on this line isn't freed before a_ptr is re-pointed to the memory address of a:

int *a_ptr = (int*)malloc((sizeof(int)));

Once a_ptr is re-pointed the free call will potentially not do anything, although as it's undefined behaviour there may be compilers where this does deallocate the memory.

If you're using Visual Studio I would definitely recommend opening the Memory panel, if you add a breakpoint to your program, run it and then go to "Debug > Windows > Memory > Memory 1", then type &a in the Address bar at the top & as you step through the lines of your code you can see what's happening to the value at that address:

e.g. here you can see the value at the memory address of a is 01 00 00 00 which is the hexadecimal representation of a 32-bit signed integer holding the value of 1

Even more useful you can see what happens when you call free on a variable:

Here you can see that after the free call on a_ptr the value at the address pointed at becomes dd dd dd dd, which according to this article means the value that Microsoft C/C++ debugger uses as a "magic value" to indicate a value that's freed up and ready to be reused:

https://en.wikipedia.org/wiki/Magic_number_(programming)#Debug_values

DDDDDDDD Used by MicroQuill's SmartHeap and Microsoft's C/C++ debug free() function to mark freed heap memory

Answer 2

Barry Schwarz 3,746

Nowhere in your code do you print any addresses.

The first printf statement does not print the address of a despite its claim to do so. It prints the contents of a which happens to be 1. If you really want to print the address of a, you would remove the dereference operator from the argument and adjust the format specification.

Your free statement causes undefined behavior because you are attempting to free memory that what was not allocated by malloc. When your code is run on a Windows system using Visual Studio, it fails on the free statement. So why don't you tell us how you got it to execute the second printf statement.

Debojit Acharjee 455 Reputation points

2023-07-28T12:06:16.4366667+00:00

I updated the post and it surely running on VS code (see the screenshot).
RLWA32 49,636 Reputation points

2023-07-28T12:44:18.11+00:00

@Debojit Acharjee The compiler that you are using and the way that you build your code examples does not result in executable code that include the security, debugging and run-time checking that would be included if you were using the Visual Studio product instead of VS Code with some other compiler.

For example, running a debug build of your code that passes an address on the stack and not the heap to the free function causes a heap-checking assertion from the debug CRT indicated that free has been passed an invalid pointer.

Debojit Acharjee 455

Even after using the malloc function the pointer still points to the value of 'a'.

#include <stdio.h>
#include <stdlib.h>

int main()
{
  int a = 1;

  int *a_ptr = (int*)malloc((sizeof(int)));

  a_ptr = &a;

  printf("The address of 'a' is %p\n", a_ptr);

  free(a_ptr); // A dangling pointer

  printf("The address of 'a' is %p\n", a_ptr);

  printf("The value of 'a' is %d", *a_ptr);

  return 0;
}

Output:

User's image

RLWA32 49,636 Reputation points

2023-07-28T15:12:34.4066667+00:00
int *a_ptr = (int*)malloc((sizeof(int))); a_ptr = &a;

The pointer to the heap memory that was allocated by the malloc function is leaked when the address of the a variable is assigned to a_ptr. Calling free on a stack address remains incorrect and the only difference between this code example and its predecessor is the useless allocation of memory from the heap that is subsequently leaked.

Share via

WHY THE DANGLING POINTER SHOWS THE VALUE AND ADDRESS EVEN AFTER FREEING IT USING FREE FUNCTION?

2 answers

Your answer