MALLOC(3) | Library Functions Manual | MALLOC(3) |
malloc
, calloc
,
reallocarray
, recallocarray
,
realloc
, free
—
memory allocation and deallocation
#include
<stdlib.h>
void *
malloc
(size_t
size);
void *
calloc
(size_t
nmemb, size_t
size);
void *
reallocarray
(void
*ptr, size_t nmemb,
size_t size);
void *
recallocarray
(void
*ptr, size_t
oldnmemb, size_t
nmemb, size_t
size);
void *
realloc
(void
*ptr, size_t
size);
void
free
(void
*ptr);
char *malloc_options;
The
malloc
()
function allocates uninitialized space for an object of the specified
size. malloc
() maintains
multiple lists of free blocks according to size, allocating space from the
appropriate list. The allocated space is suitably aligned (after possible
pointer coercion) for storage of any type of object.
The
calloc
()
function allocates space for an array of nmemb
objects, each of the specified size. The space is
initialized to zero.
The
realloc
()
function changes the size of the object pointed to by
ptr to size bytes and returns a
pointer to the (possibly moved) object. The contents of the object are
unchanged up to the lesser of the new and old sizes. If the new size is
larger, the value of the newly allocated portion of the object is
indeterminate and uninitialized. If the space cannot be allocated, the
object pointed to by ptr is unchanged. If
ptr is NULL
,
realloc
() behaves like
malloc
() and allocates a new object.
The
reallocarray
()
function is similar to realloc
() except it operates
on nmemb members of size size
and checks for integer overflow in the calculation
nmemb * size.
The
recallocarray
()
function is similar to reallocarray
() except it
ensures newly allocated memory is cleared similar to
calloc(3). Memory that
becomes unallocated while shrinking or moving existing allocations is
explicitly discarded (meaning, pages of memory are disposed via
munmap(2), and smaller
allocations are cleared with
explicit_bzero(3)).
If ptr is a NULL
pointer,
oldnmemb is ignored and the call is equivalent to
calloc
(). If ptr is not a
NULL
pointer, oldnmemb must be
a value such that oldnmemb *
size is the size of the earlier allocation that
returned ptr, otherwise the behaviour is
undefined.
The
free
()
function causes the space pointed to by ptr to be
either placed on a list of free pages to make it available for future
allocation or, if required, to be returned to the kernel using
munmap(2). If
ptr is a NULL
pointer, no
action occurs. If ptr was previously freed by
free
() or a reallocation function, the behavior is
undefined and the double free is a security concern.
Upon successful completion, the allocation functions return a
pointer to the allocated space; otherwise, a NULL
pointer is returned and errno is set to
ENOMEM
.
If size or nmemb is
equal to 0, a unique pointer to an access protected, zero sized object is
returned. Access via this pointer will generate a
SIGSEGV
exception.
If multiplying nmemb and
size results in integer overflow,
calloc
(), reallocarray
() and
recallocarray
() return NULL
and set errno to ENOMEM
.
If ptr is not NULL and multiplying
oldnmemb and size results in
integer overflow recallocarray
() returns
NULL
and sets errno to
EINVAL
.
Consider
calloc
()
or the extensions reallocarray
() and
recallocarray
() when there is multiplication in the
size argument of malloc
() or
realloc
(). For example, avoid this common idiom as
it may lead to integer overflow:
if ((p = malloc(num * size)) == NULL) err(1, NULL);
A drop-in replacement is the
OpenBSD extension
reallocarray
():
if ((p = reallocarray(NULL, num, size)) == NULL) err(1, NULL);
Alternatively,
calloc
()
may be used at the cost of initialization overhead.
When using
realloc
(),
be careful to avoid the following idiom:
size += 50; if ((p = realloc(p, size)) == NULL) return (NULL);
Do not adjust the variable describing how much memory has been
allocated until the allocation has been successful. This can cause aberrant
program behavior if the incorrect size value is used. In most cases, the
above sample will also result in a leak of memory. As stated earlier, a
return value of NULL
indicates that the old object
still remains allocated. Better code looks like this:
newsize = size + 50; if ((newp = realloc(p, newsize)) == NULL) { free(p); p = NULL; size = 0; return (NULL); } p = newp; size = newsize;
As with
malloc
(),
it is important to ensure the new size value will not overflow; i.e. avoid
allocations like the following:
if ((newp = realloc(p, num * size)) == NULL) { ...
Instead, use
reallocarray
():
if ((newp = reallocarray(p, num, size)) == NULL) { ...
Calling
realloc
()
with a NULL
ptr is equivalent
to calling malloc
(). Instead of this idiom:
if (p == NULL) newp = malloc(newsize); else newp = realloc(p, newsize);
Use the following:
newp = realloc(p, newsize);
The
recallocarray
()
function should be used for resizing objects containing sensitive data like
keys. To avoid leaking information, it guarantees memory is cleared before
placing it on the internal free list. A free
() call
for such an object should still be preceded by a call to
explicit_bzero(3).
MALLOC_OPTIONS
If malloc
() must be used with
multiplication, be sure to test for overflow:
size_t num, size; ... /* Check for size_t overflow */ if (size && num > SIZE_MAX / size) errc(1, EOVERFLOW, "overflow"); if ((p = malloc(size * num)) == NULL) err(1, NULL);
The above test is not sufficient in all cases. For example, multiplying ints requires a different set of checks:
int num, size; ... /* Avoid invalid requests */ if (size < 0 || num < 0) errc(1, EOVERFLOW, "overflow"); /* Check for signed int overflow */ if (size && num > INT_MAX / size) errc(1, EOVERFLOW, "overflow"); if ((p = malloc(size * num)) == NULL) err(1, NULL);
Assuming the implementation checks for integer overflow as
OpenBSD does, it is much easier to use
calloc
(), reallocarray
(), or
recallocarray
().
The above examples could be simplified to:
if ((p = reallocarray(NULL, num, size)) == NULL) err(1, NULL);
or at the cost of initialization:
if ((p = calloc(num, size)) == NULL) err(1, NULL);
If any of the functions detect an error condition, a message will be printed to file descriptor 2 (not using stdio). Errors will result in the process being aborted.
Here is a brief description of the error messages and what they mean:
X
option is specified it is an error for
the allocation functions to return NULL
.free
() or reallocate an unallocated
pointer was made.free
() or a reallocation
function has been modified.recallocarray
() has detected that the given old
size does not equal the recorded size in its meta data. Enabling option
C
allows recallocarray
()
to catch more of these cases.malloc
() functions nor utilize any
other functions which may call malloc
() (e.g.,
stdio(3) routines).malloc
() detected an internal error; consult
sources and/or wizards.brk(2), mmap(2), munmap(2), alloca(3), getpagesize(3), posix_memalign(3), sysconf(3), malloc.conf(5)
The malloc
(),
calloc
(), realloc
(), and
free
() functions conform to ANSI
X3.159-1989 (“ANSI C89”).
If size or nmemb are
0, the return value is implementation defined; other conforming
implementations may return NULL
in this case.
The MALLOC_OPTIONS
environment variable,
the file /etc/malloc.conf, and the
DIAGNOSTICS output are extensions to
the standard.
A free
() internal kernel function and a
predecessor to malloc
(),
alloc
(), first appeared in
Version 1 AT&T UNIX. C library functions
alloc
() and free
() appeared
in Version 6 AT&T UNIX. The functions
malloc
(), calloc
(), and
realloc
() first appeared in
Version 7 AT&T UNIX.
A new implementation by Chris Kingsley was introduced in
4.2BSD, followed by a complete rewrite by
Poul-Henning Kamp which appeared in FreeBSD 2.2 and
was included in OpenBSD 2.0. These implementations
were all sbrk(2) based. In
OpenBSD 3.8, Thierry Deval rewrote
malloc
to use the
mmap(2) system call, making the
page addresses returned by malloc
random. A rewrite
by Otto Moerbeek introducing a new central data structure and more
randomization appeared in OpenBSD 4.4.
The reallocarray
() function appeared in
OpenBSD 5.6. The
recallocarray
() function appeared in
OpenBSD 6.1.
When using malloc
(), be wary of signed
integer and size_t overflow especially when there is
multiplication in the size argument.
Signed integer overflow will cause undefined behavior which compilers typically handle by wrapping back around to negative numbers. Depending on the input, this can result in allocating more or less memory than intended.
An unsigned overflow has defined behavior which will wrap back around and return less memory than intended.
A signed or unsigned integer overflow is a security risk if less memory is returned than intended. Subsequent code may corrupt the heap by writing beyond the memory that was allocated. An attacker may be able to leverage this heap corruption to execute arbitrary code.
Consider using calloc
(),
reallocarray
() or
recallocarray
() instead of using multiplication in
malloc
() and realloc
() to
avoid these problems on OpenBSD.
March 29, 2017 | OpenBSD-6.1 |