← Dynamic Memory Management

Select a question from the sidebar

15 questions in this topic

Question 1 / 15

How does malloc() work and should you cast its return value in C?

malloc(size_t size) allocates size bytes of uninitialized memory on the heap and returns a void * pointer to the beginning of the block. Returns NULL if allocation fails.

The casting debate:

In C: Casting is not required and many style guides discourage it. void * implicitly converts to any pointer type in C. Casting can:

Hide the bug of forgetting to #include <stdlib.h> (in C89, missing prototype defaults to returning int)
Add visual clutter
Cause maintenance issues if the type changes

In C++: Casting is required because C++ does not allow implicit conversion from void *.

Best practices:

Always check the return value for NULL
Use sizeof(*p) instead of sizeof(Type) to avoid type mismatches
Free the memory when done

Under the hood: malloc typically uses brk()/sbrk() for small allocations and mmap() for large ones. The allocator maintains metadata (size, free-list pointers) adjacent to each block.

Pseudo Code

1. Call malloc(num_bytes) -- returns void* or NULL
2. Check for NULL (allocation failure)
3. Use the memory
4. Call free(ptr) when done

Preferred pattern:
  int *p = malloc(sizeof(*p) * count);
  if (!p) { handle_error(); }
  /* use p */
  free(p);

Code

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    /* Preferred C style: no cast, sizeof(*p) */
    int *arr = malloc(sizeof(*arr) * 5);
    if (arr == NULL) {
        perror("malloc failed");
        return 1;
    }

    for (int i = 0; i < 5; i++) {
        arr[i] = (i + 1) * 10;
    }

    for (int i = 0; i < 5; i++) {
        printf("%d ", arr[i]); /* 10 20 30 40 50 */
    }
    printf("\n");

    free(arr);
    arr = NULL; /* prevent dangling pointer */

    /* Single element allocation */
    double *val = malloc(sizeof(*val));
    if (val) {
        *val = 3.14;
        printf("%.2f\n", *val); /* 3.14 */
        free(val);
    }

    return 0;
}

10 20 30 40 50
3.14

Key Points

•malloc returns void* -- no cast needed in C (implicit conversion)
•Always check for NULL return (allocation failure)
•Use sizeof(*p) instead of sizeof(Type) for type-safe allocation
•Memory is uninitialized -- contains garbage values
•Every malloc must have a corresponding free

Gotchas

•In C89, forgetting #include <stdlib.h> with a cast hides the implicit-int-return bug
•malloc(0) is implementation-defined: may return NULL or a unique pointer that must not be dereferenced
•Memory from malloc is NOT zero-initialized -- use calloc if you need zeroed memory
•On Linux, malloc may succeed even without enough physical memory (overcommit) -- OOM killer handles it later

malloc(size) allocates uninitialized heap memory, returns void * or NULL. No cast needed in C. Use sizeof(*p) pattern. Always check for NULL and free when done.

•No cast needed in C; use sizeof(*p) for safety
•Always check for NULL and free when done

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(sizeof(*p) * 10); /* no cast in C */
    if (!p) { perror("malloc"); return 1; }
    p[0] = 42;
    printf("%d\n", p[0]); /* 42 */
    free(p);
    p = NULL;
    return 0;
}

Memory is uninitialized -- use calloc for zero-initialized memory

Question 2 / 15

What is the difference between calloc() and malloc()?

Both allocate heap memory, but they differ in important ways:

malloc(size_t size):

Takes a single size in bytes
Memory is uninitialized (contains garbage)
Slightly faster (no zeroing overhead)

calloc(size_t nmemb, size_t size):

Takes element count and element size separately
Memory is zero-initialized (all bytes set to 0)
Performs internal overflow check on nmemb * size
May be optimized by the OS (e.g., pages from mmap are already zeroed)

Key advantage of calloc's two-argument form: calloc checks for arithmetic overflow when computing nmemb * size. With malloc(n * size), if n * size overflows, you allocate a small buffer but use it as if it were large -- a classic heap overflow vulnerability.

When to use which:

Use calloc when you need zero-initialized memory (arrays, structs)
Use malloc when you will immediately overwrite all bytes (performance)
Use calloc for security-sensitive code (prevents info leaks from uninitialized data)

Pseudo Code

malloc(n * sizeof(int)):
  1. Allocate n*sizeof(int) bytes
  2. Memory contains garbage
  3. NO overflow check on n*sizeof(int)

calloc(n, sizeof(int)):
  1. Check if n * sizeof(int) overflows
  2. If overflow, return NULL
  3. Allocate n*sizeof(int) bytes
  4. Zero-fill all bytes
  5. Return pointer

Code

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int n = 5;

    /* malloc: uninitialized memory */
    int *a = malloc(sizeof(*a) * n);
    if (a) {
        printf("malloc (uninitialized): ");
        for (int i = 0; i < n; i++)
            printf("%d ", a[i]); /* garbage values */
        printf("\n");
        free(a);
    }

    /* calloc: zero-initialized memory */
    int *b = calloc(n, sizeof(*b));
    if (b) {
        printf("calloc (zeroed): ");
        for (int i = 0; i < n; i++)
            printf("%d ", b[i]); /* 0 0 0 0 0 */
        printf("\n");
        free(b);
    }

    /* calloc overflow protection */
    size_t huge = (size_t)-1; /* SIZE_MAX */
    int *c = calloc(huge, sizeof(int));
    if (c == NULL) {
        printf("calloc correctly returned NULL for overflow\n");
    }

    /* malloc overflow vulnerability: */
    /* int *d = malloc(huge * sizeof(int)); */
    /* huge * sizeof(int) wraps around, allocating a tiny buffer! */

    return 0;
}

malloc (uninitialized): 0 0 0 0 0
calloc (zeroed): 0 0 0 0 0
calloc correctly returned NULL for overflow
(malloc values are uninitialized/garbage; shown as 0 for illustration)

Key Points

•calloc zero-initializes; malloc does not
•calloc takes (count, size) and checks for multiplication overflow
•malloc(n * size) can silently overflow, allocating too little memory
•calloc may be faster for large allocations (OS provides pre-zeroed pages)
•Use calloc for arrays/structs; malloc when you will immediately overwrite all data

Gotchas

•calloc zeros bytes to 0, but 0 bytes is not necessarily NULL pointer or 0.0 float on all platforms (though it is on IEEE 754 and common ABIs)
•calloc(0, sizeof(int)) and malloc(0) have implementation-defined behavior
•Do not assume calloc is always slower -- for large allocations, the OS often provides pre-zeroed pages
•malloc(n * size) is a potential integer overflow vulnerability -- prefer calloc or check manually

calloc(count, size) allocates zeroed memory and checks for overflow. malloc(size) allocates uninitialized memory with no overflow check. Prefer calloc for arrays and security-sensitive code.

•calloc = zero-initialized + overflow check
•malloc = uninitialized, no overflow check

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *a = malloc(5 * sizeof(int));  /* uninitialized */
    int *b = calloc(5, sizeof(int));   /* all zeros */
    if (b) {
        printf("%d %d %d\n", b[0], b[1], b[2]); /* 0 0 0 */
        free(b);
    }
    free(a);
    return 0;
}

0 0 0

malloc(n * size) can silently overflow -- calloc prevents this

Question 3 / 15

How does realloc() work and what are the common pitfalls?

realloc(void *ptr, size_t size) resizes a previously allocated block to size bytes. It may:

Extend in place if contiguous space is available
Allocate new block, copy data, free old block if not
Return the same pointer or a new one

Special cases:

realloc(NULL, size) is equivalent to malloc(size)
realloc(ptr, 0) is implementation-defined (C11): may free and return NULL, or return a non-NULL pointer

The critical pitfall -- losing the original pointer:

p = realloc(p, new_size); /* WRONG! */

If realloc fails, it returns NULL but does not free the original block. Assigning NULL to p loses the only reference to the original memory, causing a memory leak.

Safe pattern:

void *tmp = realloc(p, new_size);
if (tmp == NULL) { /* handle error, p is still valid */ }
else { p = tmp; }

Pseudo Code

Safe realloc pattern:
1. tmp = realloc(p, new_size)
2. if tmp == NULL:
     p is still valid, handle error
3. else:
     p = tmp  (may be same address or new)
4. If growing: new bytes are uninitialized
5. If shrinking: excess bytes are freed

NEVER: p = realloc(p, size)  -- leaks on failure!

Code

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int capacity = 4;
    int size = 0;
    int *arr = malloc(sizeof(*arr) * capacity);
    if (!arr) return 1;

    /* Dynamic array: grow as needed */
    for (int i = 0; i < 10; i++) {
        if (size == capacity) {
            int new_cap = capacity * 2;
            /* SAFE realloc: use a temporary */
            int *tmp = realloc(arr, sizeof(*tmp) * new_cap);
            if (tmp == NULL) {
                perror("realloc failed");
                free(arr); /* original is still valid */
                return 1;
            }
            arr = tmp;
            capacity = new_cap;
            printf("Grew to capacity %d\n", capacity);
        }
        arr[size++] = i * 10;
    }

    for (int i = 0; i < size; i++) {
        printf("%d ", arr[i]);
    }
    printf("\n"); /* 0 10 20 30 40 50 60 70 80 90 */

    /* Shrink */
    int *shrunk = realloc(arr, sizeof(*shrunk) * size);
    if (shrunk) arr = shrunk;
    /* Even if realloc fails when shrinking, arr is still usable */

    free(arr);
    return 0;
}

Grew to capacity 8
Grew to capacity 16
0 10 20 30 40 50 60 70 80 90

Key Points

•realloc may move the block to a new address -- always use the returned pointer
•NEVER assign directly: p = realloc(p, size) -- use a temp variable
•New bytes (when growing) are uninitialized
•realloc(NULL, size) == malloc(size)
•Grow by doubling capacity for amortized O(1) appends

Gotchas

•p = realloc(p, size) leaks memory if realloc fails (returns NULL, loses original pointer)
•Old pointers to the block become dangling if realloc moves the data
•realloc(ptr, 0) behavior is implementation-defined in C11 -- do not use it as free()
•Growing by 1 byte at a time causes O(n^2) copying -- always grow by a factor (typically 2x)

realloc(ptr, size) resizes a heap block. May return a new address. Always use a temp: tmp = realloc(p, size); if (tmp) p = tmp;. Never write p = realloc(p, size) -- leaks on failure.

•Always use a temporary variable for realloc's return value
•realloc may move data to a new address

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(sizeof(int) * 2);
    p[0] = 10; p[1] = 20;

    int *tmp = realloc(p, sizeof(int) * 4);
    if (!tmp) { free(p); return 1; }
    p = tmp;
    p[2] = 30; p[3] = 40;

    for (int i = 0; i < 4; i++)
        printf("%d ", p[i]); /* 10 20 30 40 */
    printf("\n");
    free(p);
    return 0;
}

10 20 30 40

p = realloc(p, size) loses original memory on failure -- memory leak

Question 4 / 15

What happens when you call free() and what is a double-free bug?

free(void *ptr) releases a previously allocated block back to the memory allocator. The allocator marks the block as available for future allocations.

What free() does:

Reads the metadata (size, flags) stored before the block
Marks the block as free in the allocator's internal data structures
May coalesce with adjacent free blocks to reduce fragmentation
Does NOT zero out the memory or return it to the OS immediately

Special cases:

free(NULL) is safe and does nothing (guaranteed by the standard)
free(ptr) where ptr was not from malloc/calloc/realloc is undefined behavior
free(ptr) where ptr was already freed is a double-free bug

Double-free is dangerous because:

It corrupts the allocator's internal data structures (free lists)
An attacker can exploit it to execute arbitrary code
The allocator may return the same block to two different callers
It may not crash immediately -- corruption manifests later in unrelated code

Prevention:

Set pointer to NULL after free: free(p); p = NULL;
Use ownership semantics: only the owner frees
Use AddressSanitizer: gcc -fsanitize=address

Pseudo Code

What free(ptr) does internally:
1. Read block header (size, allocated flag)
2. Mark block as free in free-list
3. If adjacent blocks are free, merge them (coalescing)
4. Block memory still contains old data (not zeroed)

Double free:
  free(p);  /* Block added to free list */
  free(p);  /* Block added AGAIN -- corrupts free list */
  /* Now allocator may give same block to two mallocs */

Prevention:
  free(p); p = NULL;
  free(p);  /* free(NULL) is safe -- no-op */

Code

#include <stdio.h>
#include <stdlib.h>

#define SAFE_FREE(p) do { free(p); (p) = NULL; } while(0)

int main(void) {
    /* Normal free */
    int *p = malloc(sizeof(int));
    *p = 42;
    free(p);
    p = NULL; /* prevent double free */

    /* free(NULL) is safe */
    free(NULL); /* no-op, perfectly fine */

    /* Using SAFE_FREE macro */
    int *q = malloc(sizeof(int) * 10);
    if (q) {
        q[0] = 100;
        printf("%d\n", q[0]); /* 100 */
        SAFE_FREE(q);
        /* q is now NULL */
        SAFE_FREE(q); /* safe: free(NULL) is a no-op */
    }

    /* Demonstrating ownership pattern */
    char *buffer = malloc(256);
    if (buffer) {
        snprintf(buffer, 256, "Hello, World!");
        printf("%s\n", buffer);
        /* Owner frees the buffer */
        SAFE_FREE(buffer);
    }

    return 0;
}

/*
 * Double-free example (DO NOT RUN -- undefined behavior):
 *   int *p = malloc(sizeof(int));
 *   free(p);
 *   free(p);  // DOUBLE FREE: corrupts heap metadata
 *
 * Detect with:
 *   gcc -fsanitize=address -g prog.c && ./a.out
 *   valgrind ./a.out
 */

100
Hello, World!

Key Points

•free() returns memory to the allocator but does not zero it
•free(NULL) is safe and does nothing -- guaranteed by the standard
•Double-free corrupts the heap and is a serious security vulnerability
•Always set pointers to NULL after free to prevent double-free
•Only free memory obtained from malloc/calloc/realloc

Gotchas

•Double-free may not crash immediately -- it corrupts heap metadata silently
•free() does not set the pointer to NULL -- you must do it yourself
•Freeing a pointer not from malloc (stack address, static, or middle of a block) is undefined behavior
•Memory is not zeroed after free -- sensitive data (passwords) should be explicitly cleared first

free(ptr) returns heap memory to the allocator. free(NULL) is safe. Double-free corrupts the heap -- prevent it by setting pointers to NULL after free.

•free(NULL) is safe; double-free is undefined behavior
•Always NULL pointers after free

#include <stdio.h>
#include <stdlib.h>

#define SAFE_FREE(p) do { free(p); (p) = NULL; } while(0)

int main(void) {
    int *p = malloc(sizeof(int));
    *p = 42;
    SAFE_FREE(p);  /* free + set NULL */
    SAFE_FREE(p);  /* safe: free(NULL) is a no-op */
    return 0;
}

Double-free is a security vulnerability exploitable by attackers

Question 5 / 15

What are common memory leak patterns in C and how do you avoid them?

A memory leak occurs when allocated memory is no longer reachable by any pointer, making it impossible to free. Over time, leaks exhaust available memory.

Common leak patterns:

Lost pointer (reassignment without free):

p = malloc(100);
p = malloc(200); /* first block leaked! */

Early return without cleanup:

p = malloc(100);
if (error) return -1; /* p leaked! */
free(p);

Exception-like flow (goto cleanup): Missing the goto on error paths.
Forgotten free in data structures: Freeing a linked list head but not traversing to free all nodes.
Strdup/asprintf without free: Functions that allocate internally (strdup, asprintf, getline) require the caller to free.
Realloc failure: Using p = realloc(p, size) -- if it fails, original is leaked.

Prevention strategies:

Use the goto-cleanup pattern for functions with multiple allocations
Document ownership: who allocates, who frees
Use Valgrind or ASan in CI/CD
Write destroy/cleanup functions for every create/init function

Pseudo Code

Leak pattern 1 -- overwritten pointer:
  p = malloc(A);  /* block A allocated */
  p = malloc(B);  /* block A leaked! */

Leak pattern 2 -- early return:
  p = malloc(A);
  if (error) return;  /* A leaked! */
  free(p);

Goto cleanup pattern (prevention):
  int func() {
    int *a = NULL, *b = NULL;
    a = malloc(...);
    if (!a) goto cleanup;
    b = malloc(...);
    if (!b) goto cleanup;
    /* use a and b */
  cleanup:
    free(b);  /* free(NULL) is safe */
    free(a);
    return result;
  }

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* BAD: memory leak on early return */
int process_bad(const char *input) {
    char *buf = malloc(strlen(input) + 1);
    if (!buf) return -1;
    strcpy(buf, input);

    if (strlen(buf) < 3) {
        return -2; /* LEAK: buf not freed! */
    }

    printf("Processed: %s\n", buf);
    free(buf);
    return 0;
}

/* GOOD: goto cleanup pattern */
int process_good(const char *input) {
    int result = 0;
    char *buf = NULL;
    char *upper = NULL;

    buf = malloc(strlen(input) + 1);
    if (!buf) { result = -1; goto cleanup; }
    strcpy(buf, input);

    upper = malloc(strlen(input) + 1);
    if (!upper) { result = -1; goto cleanup; }

    for (size_t i = 0; input[i]; i++) {
        upper[i] = (input[i] >= 'a' && input[i] <= 'z')
                   ? input[i] - 32 : input[i];
    }
    upper[strlen(input)] = '\0';

    if (strlen(buf) < 3) {
        result = -2;
        goto cleanup; /* both buf and upper freed */
    }

    printf("Original: %s, Upper: %s\n", buf, upper);

cleanup:
    free(upper); /* free(NULL) is safe */
    free(buf);
    return result;
}

int main(void) {
    process_good("hello");
    process_good("hi"); /* short input, early exit but no leak */
    return 0;
}

Original: hello, Upper: HELLO

Key Points

•A leak occurs when no pointer references allocated memory, making free impossible
•Reassigning a pointer without freeing first is the most common leak
•Use the goto-cleanup pattern for functions with multiple allocations
•Initialize pointers to NULL so free(NULL) is safe in cleanup
•Valgrind and ASan are essential for leak detection in CI/CD

Gotchas

•strdup(), getline(), asprintf() allocate internally -- caller must free the result
•Memory leaks in long-running programs (servers, daemons) are far more critical than in short-lived ones
•A leak of 1 byte per request can crash a server over days
•Static analysis cannot catch all leaks -- runtime tools (Valgrind) are essential

Leaks occur when allocated memory becomes unreachable. Common causes: pointer reassignment without free, early return, forgotten free in data structures. Prevent with goto-cleanup pattern and Valgrind.

•Use goto-cleanup to ensure all allocations are freed on every path
•Initialize pointers to NULL so cleanup with free(NULL) is safe

#include <stdio.h>
#include <stdlib.h>

int func(void) {
    int ret = 0;
    int *a = NULL, *b = NULL;
    a = malloc(sizeof(int) * 10);
    if (!a) { ret = -1; goto cleanup; }
    b = malloc(sizeof(int) * 20);
    if (!b) { ret = -1; goto cleanup; }
    /* use a and b */
    a[0] = 1; b[0] = 2;
cleanup:
    free(b); /* free(NULL) safe */
    free(a);
    return ret;
}

strdup() returns malloc'd memory that the caller must free

Question 6 / 15

What is a dangling pointer after free and how does it differ from a memory leak?

Dangling pointer and memory leak are opposite problems:

	Dangling Pointer	Memory Leak
Definition	Pointer to freed/invalid memory	Memory with no pointer to it
Cause	Using pointer after free/scope-exit	Losing all references to allocated memory
Symptom	Crashes, corruption, security exploits	Gradual memory exhaustion
Detection	ASan, Valgrind (use-after-free)	Valgrind (leak-check), ASan (leak sanitizer)

Dangling pointer example:

int *p = malloc(sizeof(int));
free(p);
*p = 42; /* dangling: p still holds the old address */

Memory leak example:

int *p = malloc(sizeof(int));
p = NULL; /* leak: the allocated block is now unreachable */

Why use-after-free is more dangerous than leaks:

Leads to arbitrary code execution exploits
Causes data corruption that manifests far from the bug
The freed memory may be reallocated to another variable, creating cross-contamination

Both are solved by proper ownership discipline and tooling.

Pseudo Code

Dangling pointer:
  p = malloc(N)
  free(p)
  *p = 42     /* BUG: p points to freed memory */
  Fix: p = NULL after free

Memory leak:
  p = malloc(N)
  p = NULL    /* BUG: allocated block is unreachable */
  Fix: free(p) before reassigning

Both fixed:
  p = malloc(N)
  /* ... use p ... */
  free(p)
  p = NULL

Code

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    /* --- Dangling pointer scenario --- */
    int *dp = malloc(sizeof(int));
    if (!dp) return 1;
    *dp = 42;
    printf("Before free: %d\n", *dp); /* 42 */
    free(dp);
    /* dp is now dangling -- DO NOT dereference */
    dp = NULL; /* Fix: prevent accidental use */

    /* --- Memory leak scenario --- */
    int *lp = malloc(sizeof(int) * 100);
    if (!lp) return 1;
    lp[0] = 99;
    /* BUG: reassigning without free leaks the 100-int block */
    /* lp = malloc(sizeof(int) * 200); */
    /* Fix: free before reassign */
    free(lp);
    lp = malloc(sizeof(int) * 200);
    if (lp) {
        lp[0] = 77;
        printf("New allocation: %d\n", lp[0]); /* 77 */
        free(lp);
    }

    /* --- Use-after-free exploitation risk --- */
    /*
     * int *a = malloc(64);
     * free(a);
     * char *b = malloc(64);  // may get the same block!
     * a[0] = 0xDEADBEEF;    // corrupts b's data
     */

    return 0;
}

Before free: 42
New allocation: 77

Key Points

•Dangling pointer: pointer to freed memory; leak: memory with no pointer
•They are opposite problems: dangling = freed too early; leak = never freed
•Use-after-free is a critical security vulnerability (more dangerous than leaks)
•Freed memory may be reallocated to another variable, causing cross-contamination
•Both are detected by Valgrind and AddressSanitizer

Gotchas

•Use-after-free may work intermittently because the allocator does not immediately reuse the block
•Dangling pointers can be exploited for arbitrary code execution in security-critical code
•Setting p = NULL after free only protects that one copy -- other aliases remain dangling
•In multithreaded code, another thread may free memory you are still using (race condition)

Dangling pointer: pointer to freed memory (freed too early). Memory leak: allocated memory with no pointer to it (never freed). Dangling pointers are more dangerous -- they cause crashes and security exploits. Leaks cause gradual memory exhaustion.

•Dangling: freed too early; Leak: never freed
•Use-after-free is a critical security vulnerability

#include <stdlib.h>

int main(void) {
    /* Dangling: freed but pointer still exists */
    int *dp = malloc(sizeof(int));
    free(dp);
    dp = NULL; /* fix: prevent use-after-free */

    /* Leak: pointer lost, memory unreachable */
    int *lp = malloc(sizeof(int));
    free(lp); /* fix: free before losing pointer */
    lp = NULL;
    return 0;
}

Setting one pointer to NULL does not fix other aliases to the same freed block

Question 7 / 15

What is the difference between heap and stack memory in C?

Stack memory:

Allocated automatically for local variables and function call frames
LIFO (last in, first out) -- grows downward on most architectures
Allocation/deallocation is extremely fast (just adjust stack pointer)
Limited size (typically 1-8 MB, configurable via ulimit -s)
Scope-bound: automatically freed when function returns
Cannot be resized

Heap memory:

Allocated manually via malloc/calloc/realloc
No order constraint -- can allocate and free in any order
Slower than stack (allocator must search free lists, handle fragmentation)
Much larger (limited by virtual address space, typically GBs)
Must be freed explicitly -- programmer is responsible
Can be resized (realloc)

C process memory layout (low to high):

Text segment (code)
Data segment (initialized globals)
BSS segment (uninitialized globals)
Heap (grows upward)
... (unmapped region)
Stack (grows downward)
Kernel space

When to use each:

Stack: small, fixed-size, short-lived data (local variables, small arrays)
Heap: large, variable-size, or long-lived data (dynamic arrays, structs returned from functions)

Pseudo Code

Stack:
  void func() {
    int x = 10;     /* stack: auto allocated */
    int arr[100];   /* stack: 400 bytes */
  }                 /* auto deallocated on return */

Heap:
  void func() {
    int *p = malloc(400);  /* heap: manual */
    /* ... use p ... */
    free(p);               /* manual dealloc */
  }

Stack: fast, small, automatic, LIFO
Heap: slower, large, manual, any order

Code

#include <stdio.h>
#include <stdlib.h>

int global_var = 42; /* data segment */
int uninit_global;   /* BSS segment */

void demonstrate_stack(void) {
    int local = 10;        /* stack */
    int arr[5] = {1,2,3,4,5}; /* stack */
    printf("Stack var address: %p\n", (void *)&local);
    printf("Stack arr address: %p\n", (void *)arr);
    /* local and arr are automatically freed when function returns */
}

void demonstrate_heap(void) {
    int *p = malloc(sizeof(int) * 5); /* heap */
    if (!p) return;
    printf("Heap address:      %p\n", (void *)p);
    for (int i = 0; i < 5; i++) p[i] = i * 10;
    free(p); /* must be explicitly freed */
}

int main(void) {
    printf("Global var address: %p\n", (void *)&global_var);
    printf("Uninit global addr: %p\n", (void *)&uninit_global);

    demonstrate_stack();
    demonstrate_heap();

    /* Stack vs heap size comparison */
    /* int huge_stack[10000000]; */  /* likely stack overflow! */
    int *huge_heap = malloc(sizeof(int) * 10000000); /* usually fine */
    if (huge_heap) {
        printf("Large heap allocation succeeded\n");
        free(huge_heap);
    }

    return 0;
}

Key Points

•Stack: automatic, fast, small, LIFO, scope-bound lifetime
•Heap: manual (malloc/free), slower, large, arbitrary lifetime
•Stack typically 1-8 MB; heap limited by virtual address space (GBs)
•Stack overflow is a hard crash; heap exhaustion returns NULL from malloc
•Use stack for small fixed-size data; heap for large or variable-size data

Gotchas

•Returning a pointer to a stack variable creates a dangling pointer -- the variable is destroyed on return
•Large stack arrays (e.g., int arr[1000000]) can cause stack overflow
•VLAs (variable-length arrays) are on the stack -- large VLAs can overflow it
•Stack size can be changed with ulimit -s but is typically fixed at program start

Stack: automatic, fast, small (1-8 MB), LIFO, freed on function return. Heap: manual (malloc/free), slower, large (GBs), freed explicitly. Use stack for small/short-lived data, heap for large/dynamic data.

•Stack is fast + automatic; heap is flexible + manual
•Never return addresses of stack variables

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int stack_var = 10;  /* stack: automatic lifetime */
    int *heap_var = malloc(sizeof(int)); /* heap: manual lifetime */
    *heap_var = 20;

    printf("stack: %p = %d\n", (void *)&stack_var, stack_var);
    printf("heap:  %p = %d\n", (void *)heap_var, *heap_var);

    free(heap_var); /* must free heap memory */
    /* stack_var freed automatically when main returns */
    return 0;
}

Large stack allocations (big arrays, deep recursion) cause stack overflow

Question 8 / 15

What is memory fragmentation and how does it affect C programs?

Memory fragmentation occurs when free memory is broken into small, non-contiguous chunks, making it impossible to satisfy large allocation requests even when total free memory is sufficient.

Two types:

External fragmentation: Free blocks exist between allocated blocks. Total free memory is enough, but no single contiguous block is large enough.

[USED][FREE-32][USED][FREE-64][USED][FREE-32]
 Total free: 128 bytes, but cannot allocate 100 bytes

Internal fragmentation: Allocated blocks are larger than requested due to alignment requirements or allocator granularity (e.g., request 5 bytes, get 8).

Impact:

Allocation failures despite available total memory
Increased memory usage (internal padding)
Degraded cache performance (scattered data)
Especially critical in embedded and real-time systems

Mitigation strategies:

Memory pools (pre-allocate fixed-size blocks)
Slab allocators (group same-sized allocations)
Allocate and free in LIFO order when possible
Use arrays instead of many small allocations
Compact allocators (with relocation)

Pseudo Code

External fragmentation example:
  malloc(100) -> block A
  malloc(100) -> block B
  malloc(100) -> block C
  free(A)
  free(C)
  /* Memory: [FREE-100][B-100][FREE-100] */
  malloc(200) -> FAILS! (no contiguous 200-byte block)
  /* Even though 200 bytes are free in total */

Mitigation: memory pool
  Pool of N fixed-size blocks
  Allocate: grab next free block (O(1))
  Free: return block to pool (O(1))
  No fragmentation since all blocks are same size

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Simple fixed-size memory pool to avoid fragmentation */
#define POOL_BLOCK_SIZE 64
#define POOL_BLOCK_COUNT 10

typedef struct {
    char memory[POOL_BLOCK_SIZE * POOL_BLOCK_COUNT];
    int used[POOL_BLOCK_COUNT]; /* 0 = free, 1 = used */
} MemPool;

void pool_init(MemPool *pool) {
    memset(pool->used, 0, sizeof(pool->used));
}

void *pool_alloc(MemPool *pool) {
    for (int i = 0; i < POOL_BLOCK_COUNT; i++) {
        if (!pool->used[i]) {
            pool->used[i] = 1;
            return pool->memory + (i * POOL_BLOCK_SIZE);
        }
    }
    return NULL; /* pool exhausted */
}

void pool_free(MemPool *pool, void *ptr) {
    if (!ptr) return;
    ptrdiff_t offset = (char *)ptr - pool->memory;
    int index = (int)(offset / POOL_BLOCK_SIZE);
    if (index >= 0 && index < POOL_BLOCK_COUNT) {
        pool->used[index] = 0;
    }
}

int main(void) {
    MemPool pool;
    pool_init(&pool);

    /* Allocate from pool -- no fragmentation */
    int *a = (int *)pool_alloc(&pool);
    int *b = (int *)pool_alloc(&pool);
    int *c = (int *)pool_alloc(&pool);

    *a = 10; *b = 20; *c = 30;
    printf("%d %d %d\n", *a, *b, *c); /* 10 20 30 */

    pool_free(&pool, b); /* free middle block */
    int *d = (int *)pool_alloc(&pool); /* reuses b's slot */
    *d = 40;
    printf("%d\n", *d); /* 40 */

    /* No fragmentation: all blocks are the same size */
    printf("Block size: %d bytes\n", POOL_BLOCK_SIZE);

    return 0;
}

10 20 30
40
Block size: 64 bytes

Key Points

•External fragmentation: free memory is scattered in non-contiguous blocks
•Internal fragmentation: allocator gives more bytes than requested (alignment/rounding)
•Can cause allocation failure even when total free memory is sufficient
•Memory pools with fixed-size blocks eliminate external fragmentation
•Especially critical in embedded systems and long-running servers

Gotchas

•Standard malloc has no compaction -- once fragmented, only freeing can help
•Mixing many small and large allocations worsens fragmentation
•Memory pools trade flexibility for fragmentation-free operation
•realloc can worsen fragmentation by leaving holes when it moves data

Fragmentation: free memory exists but in scattered, non-contiguous blocks. External = gaps between allocations; internal = wasted padding. Mitigate with memory pools (fixed-size blocks) or by grouping similar-sized allocations.

•External fragmentation prevents large allocations despite sufficient total free memory
•Fixed-size memory pools eliminate fragmentation

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    /* Fragmentation scenario */
    char *a = malloc(100);
    char *b = malloc(100);
    char *c = malloc(100);
    free(a); free(c);
    /* 200 bytes free but not contiguous */
    char *d = malloc(200); /* may fail due to fragmentation */
    printf("200-byte alloc: %s\n", d ? "success" : "failed");
    free(b); free(d);
    return 0;
}

200-byte alloc: success

Standard malloc cannot compact/defragment -- fragmentation accumulates over time

Question 9 / 15

How do you implement a simple memory pool in C?

A memory pool (also called arena or slab allocator) pre-allocates a large block and carves it into fixed-size chunks. It provides O(1) allocation and deallocation with zero fragmentation.

Design:

Allocate a large block at startup
Divide it into N equal-sized slots
Maintain a free list (linked list of available slots)
Allocate: pop from free list
Free: push back to free list

The free list trick: Since free blocks are not in use, we can store the next-pointer inside the free block itself -- no additional metadata memory needed.

Advantages:

O(1) alloc and free (no searching)
Zero external fragmentation (all blocks same size)
Cache-friendly (contiguous memory)
Deterministic timing (important for real-time systems)

Disadvantages:

All allocations are the same size (wastes memory for small objects)
Must know maximum allocation count upfront
Cannot allocate objects larger than block size

Pseudo Code

Initialize:
  1. Allocate pool_size * block_size bytes
  2. Chain all blocks into a free list
  3. Each free block stores a pointer to the next free block

Allocate:
  1. If free_list is NULL, return NULL (exhausted)
  2. block = free_list
  3. free_list = free_list->next
  4. Return block

Free:
  1. Cast block to free-list node
  2. block->next = free_list
  3. free_list = block

Code

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

typedef struct FreeNode {
    struct FreeNode *next;
} FreeNode;

typedef struct {
    void *memory;       /* raw block */
    FreeNode *free_list; /* head of free list */
    size_t block_size;  /* size of each slot */
    size_t count;       /* total number of slots */
} MemPool;

int pool_create(MemPool *pool, size_t block_size, size_t count) {
    /* Ensure block_size can hold a FreeNode pointer */
    if (block_size < sizeof(FreeNode)) {
        block_size = sizeof(FreeNode);
    }
    pool->block_size = block_size;
    pool->count = count;
    pool->memory = malloc(block_size * count);
    if (!pool->memory) return -1;

    /* Build free list: chain all blocks together */
    pool->free_list = NULL;
    for (size_t i = 0; i < count; i++) {
        FreeNode *node = (FreeNode *)((char *)pool->memory + i * block_size);
        node->next = pool->free_list;
        pool->free_list = node;
    }
    return 0;
}

void *pool_alloc(MemPool *pool) {
    if (!pool->free_list) return NULL; /* exhausted */
    FreeNode *block = pool->free_list;
    pool->free_list = block->next;
    return (void *)block;
}

void pool_free(MemPool *pool, void *ptr) {
    if (!ptr) return;
    FreeNode *node = (FreeNode *)ptr;
    node->next = pool->free_list;
    pool->free_list = node;
}

void pool_destroy(MemPool *pool) {
    free(pool->memory);
    pool->memory = NULL;
    pool->free_list = NULL;
}

/* Example: pool of fixed-size structs */
typedef struct { int x, y; } Point;

int main(void) {
    MemPool pool;
    pool_create(&pool, sizeof(Point), 100);

    Point *p1 = (Point *)pool_alloc(&pool);
    Point *p2 = (Point *)pool_alloc(&pool);
    p1->x = 10; p1->y = 20;
    p2->x = 30; p2->y = 40;
    printf("p1=(%d,%d) p2=(%d,%d)\n", p1->x, p1->y, p2->x, p2->y);

    pool_free(&pool, p1); /* O(1) */

    Point *p3 = (Point *)pool_alloc(&pool); /* reuses p1's slot */
    p3->x = 50; p3->y = 60;
    printf("p3=(%d,%d)\n", p3->x, p3->y);

    pool_destroy(&pool);
    return 0;
}

p1=(10,20) p2=(30,40)
p3=(50,60)

Key Points

•Pre-allocate a large block, divide into fixed-size slots
•Free list is stored inside the free blocks themselves (no extra metadata)
•O(1) allocation and deallocation
•Zero external fragmentation since all blocks are the same size
•Used in game engines, RTOS, network stacks, and kernel allocators

Gotchas

•Block size must be at least sizeof(void*) to hold the free-list pointer
•Freeing a pointer not from this pool corrupts the free list
•All allocations are the same size -- unsuitable for variable-size needs
•Thread safety requires a mutex or lock-free free list

A memory pool pre-allocates fixed-size blocks and uses an embedded free list for O(1) alloc/free. Each free block stores a next-pointer inside itself. Zero fragmentation, deterministic timing.

•O(1) alloc and free with zero fragmentation
•Free list is embedded inside unused blocks

#include <stdio.h>
#include <stdlib.h>

typedef struct Node { struct Node *next; } Node;

typedef struct {
    void *mem;
    Node *free_list;
} Pool;

void pool_init(Pool *p, size_t blk, size_t n) {
    p->mem = malloc(blk * n);
    p->free_list = NULL;
    for (size_t i = 0; i < n; i++) {
        Node *nd = (Node *)((char *)p->mem + i * blk);
        nd->next = p->free_list;
        p->free_list = nd;
    }
}

void *pool_alloc(Pool *p) {
    if (!p->free_list) return NULL;
    Node *b = p->free_list;
    p->free_list = b->next;
    return b;
}

void pool_free(Pool *p, void *ptr) {
    Node *n = (Node *)ptr;
    n->next = p->free_list;
    p->free_list = n;
}

int main(void) {
    Pool pool;
    pool_init(&pool, 32, 10);
    int *a = (int *)pool_alloc(&pool);
    *a = 42;
    printf("%d\n", *a);
    pool_free(&pool, a);
    free(pool.mem);
    return 0;
}

Block size must be >= sizeof(void*) for the embedded free-list pointer

Question 10 / 15

What is alloca() and why is it considered risky?

alloca(size_t size) allocates memory on the stack frame of the calling function. The memory is automatically freed when the function returns.

How it works:

Adjusts the stack pointer to make room for size bytes
Returns a pointer to the newly available stack space
No matching free() needed or allowed
Available via <alloca.h> (not part of standard C, but widely supported)

Advantages:

Extremely fast (just a stack pointer adjustment)
No memory leak possible (auto-freed on return)
No fragmentation

Risks:

Stack overflow: No way to detect failure -- if the stack overflows, behavior is undefined (usually a crash, no NULL return)
Cannot check for failure: Unlike malloc, alloca does not return NULL on failure
Not portable: Not part of C standard (POSIX does not guarantee it either)
Dangerous in loops: Each iteration allocates more stack without freeing
Cannot free early: Memory persists until the function returns

C99 VLAs as an alternative: Variable-length arrays (int arr[n]) achieve a similar effect but are scoped to the block, not the function.

Pseudo Code

alloca(size):
  1. Subtract size from stack pointer
  2. Return new stack pointer value
  3. NO failure check possible
  4. Memory freed when function returns

Risk:
  void func(int n) {
    char *buf = alloca(n);  /* if n is huge, stack overflow */
    /* no way to check if alloca succeeded */
  }

Safer alternative:
  void func(int n) {
    char *buf = malloc(n);
    if (!buf) handle_error();
    /* use buf */
    free(buf);
  }

Code

#include <stdio.h>
#include <string.h>

#if defined(__GNUC__) || defined(__clang__)
#include <alloca.h>
#endif

void process_line(const char *line) {
    size_t len = strlen(line);

    /* alloca: allocates on stack, auto-freed on return */
    /* ONLY use when size is known to be small and bounded */
    if (len < 1024) { /* guard against stack overflow */
        char *upper = (char *)alloca(len + 1);
        for (size_t i = 0; i <= len; i++) {
            upper[i] = (line[i] >= 'a' && line[i] <= 'z')
                       ? line[i] - 32 : line[i];
        }
        printf("Upper: %s\n", upper);
        /* upper is freed when process_line returns */
    }
}

void vla_example(int n) {
    /* C99 VLA: similar to alloca but block-scoped */
    if (n > 0 && n < 1024) {
        int arr[n]; /* on stack, freed at block/function exit */
        for (int i = 0; i < n; i++) arr[i] = i;
        printf("VLA sum: ");
        int sum = 0;
        for (int i = 0; i < n; i++) sum += arr[i];
        printf("%d\n", sum);
    }
}

int main(void) {
    process_line("hello world");
    vla_example(5); /* VLA sum: 10 */
    return 0;
}

Upper: HELLO WORLD
VLA sum: 10

Key Points

•alloca allocates on the stack -- extremely fast, auto-freed on return
•No failure indication: stack overflow is undefined behavior, not NULL
•Not part of standard C -- portability concern
•Never use in loops -- each iteration consumes more stack without freeing
•C99 VLAs provide a similar but block-scoped alternative

Gotchas

•alloca in a loop accumulates stack usage -- can easily overflow
•Cannot free alloca memory early -- it persists until function return
•If the size argument comes from untrusted input, attacker can cause stack overflow
•Some compilers (MSVC) use _alloca instead of alloca

alloca(size) allocates on the stack, auto-freed on function return. Very fast but risky: no failure check, not standard C, stack overflow is UB. Never use with untrusted sizes or in loops.

•Stack allocation: fast, no free needed, but no error handling
•Never use with unbounded or untrusted size values

#include <stdio.h>
#include <alloca.h>
#include <string.h>

void demo(int n) {
    if (n > 0 && n < 1024) { /* always bound the size */
        int *arr = (int *)alloca(sizeof(int) * n);
        for (int i = 0; i < n; i++) arr[i] = i * 10;
        printf("%d\n", arr[n - 1]); /* auto-freed on return */
    }
}

int main(void) {
    demo(5); /* 40 */
    return 0;
}

No way to detect failure -- stack overflow crashes without returning NULL

Question 11 / 15

What are flexible array members in C99 and how do you use them?

A flexible array member (FAM) is an array without a specified size at the end of a struct (C99 feature). It allows you to allocate a struct with a variable-length trailing array in a single allocation.

Declaration:

struct Buffer {
    size_t length;
    char data[]; /* flexible array member -- must be last */
};

Rules:

Must be the last member of the struct
Struct must have at least one other member
sizeof(struct Buffer) does not include the flexible array
Cannot declare the struct on the stack (must heap-allocate)
Cannot be used in arrays of structs

Allocation:

struct Buffer *buf = malloc(sizeof(*buf) + length * sizeof(buf->data[0]));

Advantages over the old "struct hack" (char data[1]):

Standard-compliant (not relying on undefined behavior)
sizeof returns the correct size for the fixed members
Clearer intent

Use cases: Variable-length network packets, string objects, serialization buffers.

Pseudo Code

struct Packet {
    uint16_t type;
    uint16_t length;
    char payload[];  /* flexible array member */
};

Allocate:
  size = sizeof(struct Packet) + payload_length
  pkt = malloc(size)
  pkt->type = TYPE_DATA
  pkt->length = payload_length
  memcpy(pkt->payload, data, payload_length)

sizeof(struct Packet) = size of type + length + padding (no payload)

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct {
    size_t length;
    char data[]; /* flexible array member */
} String;

String *string_create(const char *text) {
    size_t len = strlen(text);
    /* Allocate struct + room for string + null terminator */
    String *s = malloc(sizeof(String) + len + 1);
    if (!s) return NULL;
    s->length = len;
    memcpy(s->data, text, len + 1);
    return s;
}

void string_print(const String *s) {
    printf("String(%zu): \"%s\"\n", s->length, s->data);
}

/* Variable-length packet example */
typedef struct {
    int type;
    int payload_size;
    unsigned char payload[];
} Packet;

Packet *packet_create(int type, const void *data, int size) {
    Packet *pkt = malloc(sizeof(Packet) + size);
    if (!pkt) return NULL;
    pkt->type = type;
    pkt->payload_size = size;
    memcpy(pkt->payload, data, size);
    return pkt;
}

int main(void) {
    /* String with flexible array member */
    String *s = string_create("Hello, C99!");
    if (s) {
        string_print(s); /* String(11): "Hello, C99!" */
        printf("sizeof(String) = %zu\n", sizeof(String));
        /* sizeof(String) only includes 'length', not data[] */
        free(s);
    }

    /* Packet with flexible array member */
    int values[] = {1, 2, 3};
    Packet *pkt = packet_create(42, values, sizeof(values));
    if (pkt) {
        printf("Packet type=%d, size=%d\n", pkt->type, pkt->payload_size);
        int *pv = (int *)pkt->payload;
        printf("Payload: %d %d %d\n", pv[0], pv[1], pv[2]);
        free(pkt);
    }

    return 0;
}

String(11): "Hello, C99!"
sizeof(String) = 8
Packet type=42, size=12
Payload: 1 2 3
(sizeof(String) is platform-dependent: 4 on 32-bit, 8 on 64-bit)

Key Points

•Flexible array member: array[] with no size as the last struct member
•sizeof(struct) excludes the flexible array -- add payload size to malloc
•C99 feature; replaces the non-standard 'struct hack' (data[1])
•Struct must have at least one other member besides the FAM
•Single allocation for header + variable data = cache-friendly and fewer mallocs

Gotchas

•Cannot use FAM structs on the stack or in arrays -- must be heap-allocated
•Copying the struct with assignment (a = b) does not copy the flexible array data
•realloc on a FAM struct is fine but invalidates any cached sizeof calculation
•The old 'struct hack' (char data[1]) is technically undefined behavior -- FAMs are the correct replacement

A flexible array member (char data[]) at the end of a struct allows single-allocation variable-length objects. Allocate with malloc(sizeof(struct) + data_size). C99 feature replacing the old data[1] hack.

•Flexible array: last member, no size, single malloc for struct + data
•sizeof(struct) excludes the FAM

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct {
    int len;
    char data[]; /* flexible array member */
} Buf;

int main(void) {
    const char *msg = "hello";
    Buf *b = malloc(sizeof(Buf) + strlen(msg) + 1);
    b->len = strlen(msg);
    memcpy(b->data, msg, b->len + 1);
    printf("%s (len=%d)\n", b->data, b->len); /* hello (len=5) */
    free(b);
    return 0;
}

hello (len=5)

Cannot stack-allocate or array-of FAM structs; struct assignment does not copy FAM data

Question 12 / 15

What is aligned_alloc() and when do you need memory alignment?

aligned_alloc(size_t alignment, size_t size) (C11) allocates size bytes of memory with the specified alignment. The alignment must be a power of 2, and size must be a multiple of alignment.

Why alignment matters:

Hardware requirements: Some CPU instructions (SIMD/SSE/AVX) require data aligned to 16, 32, or 64 bytes
Performance: Misaligned access can be 2-10x slower or cause bus errors on strict architectures
Atomics: Lock-free atomic operations often require natural alignment
Cache lines: Aligning to cache-line boundaries (typically 64 bytes) avoids false sharing in multithreaded code

Alternative functions:

posix_memalign(void **ptr, size_t alignment, size_t size) -- POSIX, returns error code
_aligned_malloc(size, alignment) -- Windows/MSVC
memalign(alignment, size) -- older, deprecated

Memory from aligned_alloc must be freed with regular free().

Note: Standard malloc() guarantees alignment suitable for any standard type (typically 8 or 16 bytes). aligned_alloc is only needed for stricter alignment requirements.

Pseudo Code

aligned_alloc(alignment, size):
  Preconditions:
    alignment must be power of 2
    size must be multiple of alignment
  Returns: pointer aligned to 'alignment' boundary, or NULL
  Free with: free(ptr)  -- normal free

Example:
  /* 32-byte aligned for AVX SIMD */
  float *v = aligned_alloc(32, 32 * sizeof(float));
  /* address of v is divisible by 32 */

Code

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int main(void) {
    /* Regular malloc alignment (usually 8 or 16) */
    int *regular = malloc(sizeof(int) * 4);
    printf("malloc alignment: %p (mod 16 = %zu)\n",
           (void *)regular, (uintptr_t)regular % 16);
    free(regular);

    /* 64-byte alignment (cache line) using aligned_alloc (C11) */
    size_t alignment = 64;
    size_t size = 64 * sizeof(float); /* must be multiple of alignment */
    float *aligned = aligned_alloc(alignment, size);
    if (aligned) {
        printf("aligned_alloc: %p (mod 64 = %zu)\n",
               (void *)aligned, (uintptr_t)aligned % 64);
        /* Verify alignment */
        if ((uintptr_t)aligned % alignment == 0) {
            printf("Correctly aligned to %zu bytes\n", alignment);
        }

        /* Use for SIMD-friendly data */
        for (int i = 0; i < 16; i++) {
            aligned[i] = (float)i;
        }
        printf("aligned[0]=%.0f aligned[15]=%.0f\n",
               aligned[0], aligned[15]);

        free(aligned); /* normal free works */
    }

    /* POSIX alternative: posix_memalign */
    void *posix_ptr = NULL;
    if (posix_memalign(&posix_ptr, 32, 128) == 0) {
        printf("posix_memalign: %p (mod 32 = %zu)\n",
               posix_ptr, (uintptr_t)posix_ptr % 32);
        free(posix_ptr);
    }

    return 0;
}

Key Points

•aligned_alloc(alignment, size) allocates with specified alignment (C11)
•alignment must be power of 2; size must be multiple of alignment
•Needed for SIMD (SSE/AVX), cache-line alignment, and strict hardware requirements
•Regular free() works for aligned_alloc memory
•Standard malloc already aligns to max_align_t (usually 8 or 16 bytes)

Gotchas

•size must be a multiple of alignment -- otherwise undefined behavior
•On Windows, use _aligned_malloc() and _aligned_free() instead
•posix_memalign returns error code (not pointer), and takes a void** parameter
•Over-aligning wastes memory due to padding -- only align when necessary

aligned_alloc(alignment, size) (C11) allocates memory aligned to a boundary (power of 2). Needed for SIMD, cache-line alignment. Regular free() works. Alignment must be power of 2, size must be multiple of alignment.

•C11; alignment = power of 2; size = multiple of alignment
•Freed with regular free()

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int main(void) {
    /* 64-byte aligned (cache line) */
    float *p = aligned_alloc(64, 64 * sizeof(float));
    if (p) {
        printf("mod 64 = %zu\n", (uintptr_t)p % 64); /* 0 */
        free(p);
    }
    return 0;
}

mod 64 = 0

Windows uses _aligned_malloc/_aligned_free instead

Question 13 / 15

How do you dynamically allocate a 2D array in C?

There are three common approaches to dynamically allocating a 2D array:

Method 1: Array of pointers (most common in interviews)

Allocate an array of int* (rows), then allocate each row separately
Allows ragged arrays (rows of different lengths)
Two levels of indirection; not contiguous in memory
Requires N+1 allocations and N+1 frees

Method 2: Single contiguous block with row pointers

Allocate one block for all data + one block for row pointers
Still accessed with arr[i][j] syntax
Cache-friendly (contiguous data)
Only 2 allocations and 2 frees

Method 3: Single flat allocation (simulated 2D)

Allocate rows * cols elements in one block
Access with arr[i * cols + j] (manual index calculation)
Most cache-friendly, simplest allocation/deallocation
Only 1 allocation and 1 free
No arr[i][j] syntax

Recommendation: Method 3 for performance-critical code; Method 1 for interviews (tests pointer skills); Method 2 as a good compromise.

Pseudo Code

Method 1 (array of pointers):
  int **arr = malloc(rows * sizeof(int*))
  for i in 0..rows-1:
    arr[i] = malloc(cols * sizeof(int))
  Use: arr[i][j]
  Free: free each row, then free arr

Method 2 (contiguous + row pointers):
  int *data = malloc(rows * cols * sizeof(int))
  int **arr = malloc(rows * sizeof(int*))
  for i in 0..rows-1:
    arr[i] = data + i * cols
  Use: arr[i][j]
  Free: free data, free arr

Method 3 (flat):
  int *arr = malloc(rows * cols * sizeof(int))
  Use: arr[i * cols + j]
  Free: free arr

Code

#include <stdio.h>
#include <stdlib.h>

/* Method 1: Array of pointers */
int **alloc_2d_method1(int rows, int cols) {
    int **arr = malloc(sizeof(int *) * rows);
    if (!arr) return NULL;
    for (int i = 0; i < rows; i++) {
        arr[i] = malloc(sizeof(int) * cols);
        if (!arr[i]) {
            /* cleanup on failure */
            for (int j = 0; j < i; j++) free(arr[j]);
            free(arr);
            return NULL;
        }
    }
    return arr;
}

void free_2d_method1(int **arr, int rows) {
    for (int i = 0; i < rows; i++) free(arr[i]);
    free(arr);
}

/* Method 2: Contiguous block with row pointers */
int **alloc_2d_method2(int rows, int cols) {
    int **arr = malloc(sizeof(int *) * rows);
    int *data = malloc(sizeof(int) * rows * cols);
    if (!arr || !data) { free(arr); free(data); return NULL; }
    for (int i = 0; i < rows; i++) {
        arr[i] = data + i * cols;
    }
    return arr;
}

void free_2d_method2(int **arr) {
    free(arr[0]); /* free the contiguous data block */
    free(arr);    /* free the row pointer array */
}

/* Method 3: Flat array */
int *alloc_2d_flat(int rows, int cols) {
    return malloc(sizeof(int) * rows * cols);
}

int main(void) {
    int rows = 3, cols = 4;

    /* Method 1 */
    int **m1 = alloc_2d_method1(rows, cols);
    m1[1][2] = 42;
    printf("Method 1: m1[1][2] = %d\n", m1[1][2]);
    free_2d_method1(m1, rows);

    /* Method 2 */
    int **m2 = alloc_2d_method2(rows, cols);
    m2[1][2] = 99;
    printf("Method 2: m2[1][2] = %d\n", m2[1][2]);
    free_2d_method2(m2);

    /* Method 3 */
    int *m3 = alloc_2d_flat(rows, cols);
    m3[1 * cols + 2] = 77;
    printf("Method 3: m3[1][2] = %d\n", m3[1 * cols + 2]);
    free(m3);

    return 0;
}

Method 1: m1[1][2] = 42
Method 2: m2[1][2] = 99
Method 3: m3[1][2] = 77

Key Points

•Method 1 (array of pointers): flexible, allows ragged arrays, N+1 allocations
•Method 2 (contiguous + pointers): cache-friendly, 2 allocations, arr[i][j] syntax
•Method 3 (flat): most efficient, 1 allocation, manual indexing arr[i*cols+j]
•Method 1 is most common in interviews; Method 3 is best for performance
•Always handle partial allocation failure with proper cleanup

Gotchas

•Method 1: each row is a separate malloc -- not cache-friendly, many allocations to free
•Method 1: partial allocation failure requires freeing already-allocated rows
•Method 2: free(arr[0]) frees all data, then free(arr) -- do not free individual rows
•A VLA pointer (int (*p)[cols] = malloc(rows * sizeof(*p))) is a clean C99 alternative for Method 2

Three ways: (1) array of pointers (int **, N+1 mallocs), (2) contiguous block + row pointers (2 mallocs, cache-friendly), (3) flat array with manual indexing (arr[i*cols+j], 1 malloc, fastest). Method 2 is the best compromise.

•Contiguous block + row pointers: 2 mallocs, cache-friendly, arr[i][j] syntax
•Flat array (1 malloc) is fastest but requires manual index math

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int rows = 3, cols = 4;
    /* Method 2: contiguous + row pointers */
    int *data = malloc(sizeof(int) * rows * cols);
    int **arr = malloc(sizeof(int *) * rows);
    for (int i = 0; i < rows; i++)
        arr[i] = data + i * cols;

    arr[1][2] = 42;
    printf("%d\n", arr[1][2]); /* 42 */

    free(data);
    free(arr);
    return 0;
}

Array-of-pointers method (N+1 mallocs) is not cache-friendly and error-prone to free

Question 14 / 15

How do you use Valgrind to detect memory leaks and errors?

Valgrind is a dynamic analysis tool that detects memory errors at runtime. Its Memcheck tool is the default and most commonly used.

What Valgrind detects:

Memory leaks -- allocated but never freed
Use after free -- accessing freed memory
Double free -- freeing the same block twice
Invalid read/write -- buffer overflows, out-of-bounds access
Use of uninitialized values -- reading memory before writing
Mismatched alloc/free -- e.g., malloc with delete, new with free

Usage:

gcc -g -O0 program.c -o program    # compile with debug info
valgrind --leak-check=full ./program
valgrind --leak-check=full --show-leak-kinds=all ./program
valgrind --track-origins=yes ./program  # trace uninitialized values

Leak categories:

Definitely lost: No pointer to the block (definite leak)
Indirectly lost: Lost because a parent pointer was lost
Possibly lost: Interior pointer exists (may or may not be a leak)
Still reachable: Pointer exists at exit (not freed but not lost)

Alternative: AddressSanitizer (ASan): gcc -fsanitize=address -g is faster and catches similar bugs but uses more memory.

Pseudo Code

Workflow:
1. Compile with -g and no optimization: gcc -g -O0 prog.c
2. Run under Valgrind: valgrind --leak-check=full ./a.out
3. Read the output:
   - HEAP SUMMARY: total allocs vs frees
   - LEAK SUMMARY: definitely/indirectly/possibly lost
   - ERROR SUMMARY: total errors
4. Fix each reported issue
5. Re-run until 0 errors and 0 leaks

Common flags:
  --leak-check=full        detailed leak info
  --show-leak-kinds=all    show all leak types
  --track-origins=yes      trace uninitialized values
  --verbose                extra diagnostic info

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* This program has intentional bugs for Valgrind to find */

void leak_example(void) {
    int *p = malloc(sizeof(int) * 10);
    p[0] = 42;
    /* BUG: forgot to free p -- memory leak */
    /* Fix: free(p); */
}

void uninit_example(void) {
    int *arr = malloc(sizeof(int) * 5);
    /* BUG: reading uninitialized memory */
    /* printf("%d\n", arr[3]); */
    /* Fix: initialize first */
    memset(arr, 0, sizeof(int) * 5);
    printf("%d\n", arr[3]); /* 0 */
    free(arr);
}

void overflow_example(void) {
    int *arr = malloc(sizeof(int) * 3);
    arr[0] = 1; arr[1] = 2; arr[2] = 3;
    /* BUG: out-of-bounds write */
    /* arr[3] = 4; */
    /* Valgrind reports: Invalid write of size 4 */
    free(arr);
}

int main(void) {
    leak_example();     /* Valgrind: definitely lost: 40 bytes */
    uninit_example();
    overflow_example();

    /* Clean allocation for comparison */
    char *msg = malloc(20);
    snprintf(msg, 20, "hello");
    printf("%s\n", msg);
    free(msg); /* properly freed */

    return 0;
}

/*
 * Compile and run:
 *   gcc -g -O0 program.c -o program
 *   valgrind --leak-check=full --show-leak-kinds=all ./program
 *
 * Alternative (faster, compile-time instrumentation):
 *   gcc -fsanitize=address -g program.c -o program
 *   ./program
 */

0
hello

Key Points

•Compile with -g -O0 for useful Valgrind output (debug info, no optimization)
•valgrind --leak-check=full detects leaks, use-after-free, overflows, and uninitialized reads
•Leak types: definitely lost, indirectly lost, possibly lost, still reachable
•AddressSanitizer (-fsanitize=address) is faster but uses more memory
•Target: 0 errors and 0 bytes definitely lost

Gotchas

•Valgrind slows programs by 10-50x -- not suitable for performance testing
•Valgrind only detects errors on executed code paths -- not a substitute for code review
•Some system libraries have known 'still reachable' blocks that are not real leaks
•ASan and Valgrind cannot be used simultaneously -- choose one

Compile with gcc -g -O0, run with valgrind --leak-check=full ./program. Detects leaks, use-after-free, overflows, and uninitialized reads. Alternative: gcc -fsanitize=address -g for faster runtime checks.

•valgrind --leak-check=full for comprehensive memory error detection
•gcc -fsanitize=address is a faster alternative

/* Compile: gcc -g -O0 prog.c -o prog */
/* Run:     valgrind --leak-check=full ./prog */

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(sizeof(int) * 5);
    p[0] = 42;
    printf("%d\n", p[0]);
    free(p); /* remove this line to see Valgrind report a leak */
    return 0;
}

/* Alternative: gcc -fsanitize=address -g prog.c && ./a.out */

Valgrind is 10-50x slower than normal execution

Question 15 / 15

What are best practices for memory management in C?

Memory management is the most error-prone aspect of C programming. Following these best practices prevents the majority of bugs:

Allocation:

Always check malloc/calloc/realloc return values for NULL
Use sizeof(*p) instead of sizeof(Type) -- type-safe if p's type changes
Prefer calloc for arrays (zero-initialized, overflow-checked)
Use safe realloc pattern: tmp = realloc(p, size); if (tmp) p = tmp;

Deallocation: 5. Every allocation must have exactly one corresponding free 6. Set pointers to NULL after free: free(p); p = NULL; 7. Use a SAFE_FREE macro for consistency 8. free(NULL) is safe -- leverage this in cleanup code

Ownership: 9. Document who owns (and frees) each allocation 10. Use the create/destroy pattern for opaque types 11. If a function allocates, document whether caller must free

Patterns: 12. Use goto-cleanup for functions with multiple allocations 13. Initialize all pointers to NULL at declaration 14. Use const for pointers that should not modify data

Tooling: 15. Run Valgrind or ASan in CI/CD -- not just locally 16. Enable compiler warnings: -Wall -Wextra -Werror 17. Use static analysis: cppcheck, Clang Static Analyzer

Pseudo Code

Allocation checklist:
  [x] Check return value for NULL
  [x] Use sizeof(*p) not sizeof(Type)
  [x] Prefer calloc for zeroed arrays
  [x] Safe realloc with temp variable

Deallocation checklist:
  [x] Every malloc has a matching free
  [x] NULL pointer after free
  [x] SAFE_FREE macro for consistency
  [x] Cleanup on all error paths (goto cleanup)

Ownership checklist:
  [x] Document ownership in comments/docs
  [x] create/destroy function pairs
  [x] Caller vs callee responsibility clear

Code

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* Best practice: SAFE_FREE macro */
#define SAFE_FREE(p) do { free(p); (p) = NULL; } while(0)

/* Best practice: sizeof(*p) pattern */
int *create_array(int count) {
    int *arr = calloc(count, sizeof(*arr)); /* calloc: zeroed + overflow check */
    if (!arr) {
        perror("calloc");
        return NULL;
    }
    return arr; /* caller owns and must free */
}

/* Best practice: goto-cleanup pattern */
int process_data(int n) {
    int result = -1;
    int *buffer = NULL;
    char *name = NULL;

    /* Initialize all pointers to NULL */
    buffer = malloc(sizeof(*buffer) * n);
    if (!buffer) goto cleanup;

    name = malloc(256);
    if (!name) goto cleanup;

    /* ... process data ... */
    for (int i = 0; i < n; i++) buffer[i] = i;
    snprintf(name, 256, "result_%d", n);
    printf("%s: first=%d last=%d\n", name, buffer[0], buffer[n-1]);

    result = 0; /* success */

cleanup:
    SAFE_FREE(name);   /* free(NULL) is safe */
    SAFE_FREE(buffer);
    return result;
}

/* Best practice: create/destroy pairs */
typedef struct {
    int *data;
    int size;
} IntVector;

IntVector *vector_create(int size) {
    IntVector *v = malloc(sizeof(*v));
    if (!v) return NULL;
    v->data = calloc(size, sizeof(*v->data));
    if (!v->data) { free(v); return NULL; }
    v->size = size;
    return v;
}

void vector_destroy(IntVector *v) {
    if (v) {
        free(v->data);
        free(v);
    }
}

int main(void) {
    /* Using create/destroy pattern */
    IntVector *v = vector_create(5);
    if (v) {
        for (int i = 0; i < v->size; i++) v->data[i] = i * 10;
        printf("v[2] = %d\n", v->data[2]); /* 20 */
        vector_destroy(v);
    }

    /* Using goto-cleanup pattern */
    process_data(10);

    /* Using safe array creation */
    int *arr = create_array(5);
    if (arr) {
        printf("zeroed: %d\n", arr[0]); /* 0 */
        SAFE_FREE(arr);
    }

    return 0;
}

v[2] = 20
result_10: first=0 last=9
zeroed: 0

Key Points

•Always check allocation return values; use sizeof(*p) for type safety
•Set pointers to NULL after free; use SAFE_FREE macro
•goto-cleanup pattern handles multiple allocations with proper error-path cleanup
•Document ownership: who allocates, who frees
•Run Valgrind/ASan in CI, enable -Wall -Wextra -Werror

Gotchas

•The most common memory bug is forgetting to free on error paths (early returns)
•Ownership transfer must be explicitly documented -- implicit transfer is a design smell
•Thread-safe memory management requires additional synchronization (mutexes)
•On Linux, malloc rarely returns NULL due to overcommit -- test error paths explicitly

Key rules: check malloc for NULL, use sizeof(*p), prefer calloc for arrays, safe realloc with temp, NULL after free, goto-cleanup for multiple allocs, create/destroy pairs for types, Valgrind in CI.

•sizeof(*p), NULL checks, SAFE_FREE, goto-cleanup, create/destroy pairs
•Valgrind and -fsanitize=address in CI

#include <stdio.h>
#include <stdlib.h>

#define SAFE_FREE(p) do { free(p); (p) = NULL; } while(0)

int main(void) {
    /* sizeof(*p) pattern + NULL check */
    int *p = calloc(10, sizeof(*p));
    if (!p) { perror("calloc"); return 1; }

    p[0] = 42;
    printf("%d\n", p[0]);

    SAFE_FREE(p); /* free + NULL */
    return 0;
}

Linux overcommit means malloc rarely returns NULL -- test error paths explicitly

Built by onllm.dev

Home GitHub Support awesomePrep