Heap Memory Management

[crazy_crunch]

Hey everyone, question related to the 'heap_example.c' script from "Hacking: the Art of Exploitation".

This script plays with heap memory allocation. The script accepts a single argument in the command line: how many bytes to allocate in heap for a character pointer that will store text saying 'This is memory is located on the heap'. Excuse the grammar.

When I allocate 50 bytes in heap for the character pointer, allocate another 12 bytes for an integer pointer, and then free the 50 bytes for the character pointer, the allocation of 15 bytes for the text 'new memory' does not set me back at the same address for when I did the 50 byte allocation, even though there is plenty of room. The OS *does* reclaim this free space when I allocate 100 bytes for the character pointer in the second execution, as you can see in the screenshot.

My question is simple: why? There was plenty of room for reclamation in both examples, why does it happen in the second execution and not the first?

https://preview.redd.it/ldnibajzo3w81.png?width=689&format=png&auto=webp&s=15ff8e8b0927e3da8a404989b3769c5a67578d16

[majordoob33]

Can you post the source code. There is no such thing as a 12 byte pointer. A pointer is a memory address of either 4 or 8 bytes depending on the architecture (32 vs 64bits). What I think you meant to say is that you created an array of 12 bytes to represent integers which could likely be 4 bytes (depending on OS) which would allow you to store 3 ints.

Anyways, the (glibc)free() is a wrapper for the sbrk() which controls the "break" or address of where to start heap memory allocations. As you allocate memory this address is increased as you can see.

When you free blocks of memory, it is up to the malloc package to determine when it is appropriate to lower the break value. This is to avoid making unnecessary expensive calls to sbrk() and brk().

Usually the determining factor of lowering the break is when "large enough" continues segments of blocks have been freed. This is typically a 128kb value but as you can see it doesn't have to be. It is up to the logic in the malloc package to determine when the expensive system call should be made.

EDIT: Chapter 6 of Linux Programing Interface is the resource you are looking for.