Use after free error?

Question

int main(void) {
  int* p = (int*) malloc(sizeof(int));
  int* q = (int*) malloc(sizeof(int));
  *p = 10;
  *q = 20;
  p = q;
  printf(“%d %d”, *p, *q);
  free(p); 
  free(q);
}

Why does the above code contain use-after-free error? There's no more expression after free(p) and free(q). Obviously we are not using them anymore!

Answer 1

You have two problems here.

First, you are deleting the same heap variable twice:

  free(p); 
  free(q);

Second, you have a memory-leak, because the variable created by p is no longer accessible.

---

Notice that onebyone's comment is really important. If you change the line:

p = q;

into:

*p = *q;

There would be no problems at all in your code :) Hello Pointers!

Answer 2

You set p to q, so you are free()ing it twice.

Answer 3

Since q and p point to the same memory at the point you are freeing them, you're effectively freeing the memory twice.

Answer 4

Because here:

p = q;

...you're throwing away the old value of p. You now have two copies of the pointer that was returned by the second malloc, and none of the pointer that was returned by the first malloc.

So then here:

free(p); 
free(q);

...the same pointer value gets passed to free twice: use-after-free error. The other pointer value never gets passed to free at all: memory leak.

Answer 5

It's a fundamental memory manipulation error!

Never do so!

You allocate memory at pointer p and after that you just rewrite pointer at p=q.

Previous value of pointer you lost, p is a lost pointer!

You can never free the memory allocated above for pointer p! It's a lost memory block for p.

It's memory leak... Try to free it at line free(p) in real free memory allocated for pointer q, but not for p!.

Next line free(q) is another try to free the same memory that was freed in previous line. That will be unpredictable behavior depending on the system it may be nothing special, and may be an error at program finish.

You must replace line free(p) before line p=q.

And always before rewrite pointer with previously allocated memory free them! Consider it a strict rule!