What does "double free" mean?
A double free in C, technically speaking, leads to undefined behavior. This means that the program can behave completely arbitrarily and all bets are off about what happens. That's certainly a bad thing to have happen! In practice, double-freeing a block of memory will corrupt the state of the memory manager, which might cause existing blocks of memory to get corrupted or for future allocations to fail in bizarre ways (for example, the same memory getting handed out on two different successive calls of malloc
).
Double frees can happen in all sorts of cases. A fairly common one is when multiple different objects all have pointers to one another and start getting cleaned up by calls to free
. When this happens, if you aren't careful, you might free
the same pointer multiple times when cleaning up the objects. There are lots of other cases as well, though.
Hope this helps!
Because free() will consolidate adjacent regions by managing the information stored in the tags before each region. It is something like managing the double linked list. So it would be dangerous if the buffer where ptr
is pointing has been overwritten by an attack string, in which fake tags can be injected.
This question has been well answered, but I add a late answer due to a "duplicate question" link, which asked "how to avoid it?"
One line is added to the example code posted.
char* ptr = malloc(sizeof(char));
*ptr = 'a';
free(ptr);
ptr = NULL; // add this
free(ptr);
Function free
does nothing with a NULL
pointer.
As per published C11 standard, calling free
on already free
memory location leads to undefined behaviour. It can lead to bizarre situations such as memory not getting allocated even when it's available, heap getting corrupt, same memory location getting allocated to different mallocs etc. Basically, it is undefined and can be anything.
ANSI C11 std can be found here. https://www.iso.org/obp/ui/#iso:std:iso-iec:9899:ed-3:v1:en
EDIT: changed NULL to already free
d, based on comments. also, link now points to ISO/IEC 9899:2011(en)