OpenBSD manual page server

Manual Page Search Parameters
MALLOC(3) Library Functions Manual MALLOC(3)

malloc, calloc, reallocarray, realloc, free — memory allocation and deallocation

#include <stdlib.h>

void *
malloc(size_t size);

void *
calloc(size_t nmemb, size_t size);

void *
reallocarray(void *ptr, size_t nmemb, size_t size);

void *
realloc(void *ptr, size_t size);

void
free(void *ptr);

char *malloc_options;

The () function allocates uninitialized space for an object of the specified size. malloc() maintains multiple lists of free blocks according to size, allocating space from the appropriate list. The allocated space is suitably aligned (after possible pointer coercion) for storage of any type of object. If the space is of or larger, the memory returned will be page-aligned.

The () function allocates space for an array of nmemb objects, each of the specified size. The space is initialized to zero.

The () function changes the size of the object pointed to by ptr to size bytes and returns a pointer to the (possibly moved) object. The contents of the object are unchanged up to the lesser of the new and old sizes. If the new size is larger, the value of the newly allocated portion of the object is indeterminate and uninitialized. If the space cannot be allocated, the object pointed to by ptr is unchanged. If ptr is NULL, realloc() behaves like malloc() and allocates a new object.

The () function is similar to realloc() except it operates on nmemb members of size size and checks for integer overflow in the calculation nmemb * size.

The () function causes the space pointed to by ptr to be either placed on a list of free pages to make it available for future allocation or, if required, to be returned to the kernel using munmap(2). If ptr is a NULL pointer, no action occurs. If ptr was previously freed by free(), realloc(), or reallocarray(), the behavior is undefined and the double free is a security concern.

Upon successful completion, the functions malloc(), calloc(), realloc(), and reallocarray() return a pointer to the allocated space; otherwise, a NULL pointer is returned and errno is set to ENOMEM.

If size or nmemb is equal to 0, a unique pointer to an access protected, zero sized object is returned. Access via this pointer will generate a SIGSEGV exception.

If multiplying nmemb and size results in integer overflow, calloc() and reallocarray() return NULL and set errno to ENOMEM.

The free() function returns no value.

Consider () or the extension reallocarray() when there is multiplication in the size argument of malloc() or realloc(). For example, avoid this common idiom as it may lead to integer overflow:

if ((p = malloc(num * size)) == NULL)
	err(1, NULL);

A drop-in replacement is the OpenBSD extension ():

if ((p = reallocarray(NULL, num, size)) == NULL)
	err(1, NULL);

Alternatively, () may be used at the cost of initialization overhead.

When using (), be careful to avoid the following idiom:

size += 50;
if ((p = realloc(p, size)) == NULL)
	return (NULL);

Do not adjust the variable describing how much memory has been allocated until the allocation has been successful. This can cause aberrant program behavior if the incorrect size value is used. In most cases, the above sample will also result in a leak of memory. As stated earlier, a return value of NULL indicates that the old object still remains allocated. Better code looks like this:

newsize = size + 50;
if ((newp = realloc(p, newsize)) == NULL) {
	free(p);
	p = NULL;
	size = 0;
	return (NULL);
}
p = newp;
size = newsize;

As with (), it is important to ensure the new size value will not overflow; i.e. avoid allocations like the following:

if ((newp = realloc(p, num * size)) == NULL) {
	...

Instead, use ():

if ((newp = reallocarray(p, num, size)) == NULL) {
	...

Calling () with a NULL ptr is equivalent to calling malloc(). Instead of this idiom:

if (p == NULL)
	newp = malloc(newsize);
else
	newp = realloc(p, newsize);

Use the following:

newp = realloc(p, newsize);

String of flags documented in malloc.conf(5).

/etc/malloc.conf
Symbolic link to filename containing option flags.

If malloc() must be used with multiplication, be sure to test for overflow:

size_t num, size;
...

/* Check for size_t overflow */
if (size && num > SIZE_MAX / size)
	errc(1, EOVERFLOW, "overflow");

if ((p = malloc(size * num)) == NULL)
	err(1, NULL);

The above test is not sufficient in all cases. For example, multiplying ints requires a different set of checks:

int num, size;
...

/* Avoid invalid requests */
if (size < 0 || num < 0)
	errc(1, EOVERFLOW, "overflow");

/* Check for signed int overflow */
if (size && num > INT_MAX / size)
	errc(1, EOVERFLOW, "overflow");

if ((p = malloc(size * num)) == NULL)
	err(1, NULL);

Assuming the implementation checks for integer overflow as OpenBSD does, it is much easier to use calloc() or reallocarray().

The above examples could be simplified to:

if ((p = reallocarray(NULL, num, size)) == NULL)
	err(1, NULL);

or at the cost of initialization:

if ((p = calloc(num, size)) == NULL)
	err(1, NULL);

If malloc(), calloc(), realloc(), reallocarray(), or free() detect an error condition, a message will be printed to file descriptor 2 (not using stdio). Errors will result in the process being aborted.

Here is a brief description of the error messages and what they mean:

“out of memory”
If the X option is specified it is an error for malloc(), calloc(), realloc(), or reallocarray() to return NULL.
“malloc init mmap failed”
This is a rather weird condition that is most likely to indicate a seriously overloaded system or a ulimit restriction.
“bogus pointer (double free?)”
An attempt to free(), realloc(), or reallocarray() an unallocated pointer was made.
“chunk is already free”
There was an attempt to free a chunk that had already been freed.
“modified chunk-pointer”
The pointer passed to free(), realloc(), or reallocarray() has been modified.
“recursive call”
An attempt was made to call recursively into these functions, i.e., from a signal handler. This behavior is not supported. In particular, signal handlers should use any of the malloc() functions nor utilize any other functions which may call malloc() (e.g., stdio(3) routines).
“unknown char in MALLOC_OPTIONS”
We found something we didn't understand.
“malloc cache overflow/underflow”
The internal malloc page cache has been corrupted.
“malloc free slot lost”
The internal malloc page cache has been corrupted.
“guard size”
An inconsistent guard size was detected.
any other error
malloc() detected an internal error; consult sources and/or wizards.

brk(2), mmap(2), munmap(2), alloca(3), getpagesize(3), posix_memalign(3), sysconf(3), malloc.conf(5)

The malloc(), calloc(), realloc(), and free() functions conform to ANSI X3.159-1989 (“ANSI C89”).

If size or nmemb are 0, the return value is implementation defined; other conforming implementations may return NULL in this case.

The MALLOC_OPTIONS environment variable, the file /etc/malloc.conf, and the DIAGNOSTICS output are extensions to the standard.

A free() internal kernel function and a predecessor to malloc(), alloc(), first appeared in Version 1 AT&T UNIX. C library functions alloc() and free() appeared in Version 6 AT&T UNIX. The functions malloc(), calloc(), and realloc() first appeared in Version 7 AT&T UNIX.

A new implementation by Chris Kingsley was introduced in 4.2BSD, followed by a complete rewrite by Poul-Henning Kamp which appeared in FreeBSD 2.2 and was included in OpenBSD 2.0. These implementations were all sbrk(2) based. In OpenBSD 3.8, Thierry Deval rewrote malloc to use the mmap(2) system call, making the page addresses returned by malloc random. A rewrite by Otto Moerbeek introducing a new central data structure and more randomization appeared in OpenBSD 4.4.

The reallocarray() function appeared in OpenBSD 5.6.

When using malloc(), be wary of signed integer and size_t overflow especially when there is multiplication in the size argument.

Signed integer overflow will cause undefined behavior which compilers typically handle by wrapping back around to negative numbers. Depending on the input, this can result in allocating more or less memory than intended.

An unsigned overflow has defined behavior which will wrap back around and return less memory than intended.

A signed or unsigned integer overflow is a risk if less memory is returned than intended. Subsequent code may corrupt the heap by writing beyond the memory that was allocated. An attacker may be able to leverage this heap corruption to execute arbitrary code.

Consider using calloc() or reallocarray() instead of using multiplication in malloc() and realloc() to avoid these problems on OpenBSD.

February 5, 2016 OpenBSD-5.9