malloc in C: Dynamic Memory Allocation, free, and sizeof

Every array you have written so far had its size baked in at compile time: int scores[10]; reserves ten slots whether you need three or three hundred. That works until the size is only known while the program runs - how many lines a file has, how many records the user enters. Dynamic memory solves that: you ask for the bytes you need, when you need them, and hand them back when you are done.

The tools are in <stdlib.h>:

#include <stdlib.h>

Why the Heap Exists

C gives your program two main regions of memory. Local variables live in automatic storage (the stack): the compiler decides their size, and they vanish the moment their function returns. Dynamic allocations live in the heap: you decide the size at runtime, and the block stays alive until you explicitly free it.

That second property is the real reason to use malloc. A function can allocate a block, return the pointer, and the memory is still valid in the caller - something a local array can never do. The two regions are compared in detail in stack vs heap.

malloc: Asking for Bytes

malloc takes a byte count and returns a void * pointing at that many bytes of uninitialized memory, or NULL if the request fails.

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int n = 5;

    int *scores = malloc(n * sizeof *scores);
    if (scores == NULL) {
        fprintf(stderr, "out of memory\n");
        return 1;
    }

    for (int i = 0; i < n; i++) {
        scores[i] = (i + 1) * 10;
    }

    for (int i = 0; i < n; i++) {
        printf("scores[%d] = %d\n", i, scores[i]);
    }

    free(scores);
    scores = NULL;
    return 0;
}

Four things in that short program are the whole discipline:

1. The size expression is n * sizeof *scores. Read it as "n of whatever scores points at".
2. The result is checked against NULL before any use.
3. The block is used exactly like an array - scores[i] works because indexing is pointer arithmetic.
4. It is freed once, and the pointer is then set to NULL.

Note there is no cast on the return value. In C, void * converts to any object pointer automatically, and writing (int *)malloc(...) adds noise while hiding a missing <stdlib.h> include. (C++ requires the cast; C does not.)

The sizeof Idiom

Why sizeof *scores rather than sizeof(int)? Because it cannot go stale.

int  *a = malloc(n * sizeof *a);     /* n ints, whatever int is here */
long *b = malloc(n * sizeof *b);     /* same line shape, right size */

/* the fragile form */
long *c = malloc(n * sizeof(int));   /* compiles, allocates too little */

The last line is a real bug that no compiler warns about: c is a long *, the allocation is sized for int, and every write past the first half runs off the end. With sizeof *c the size follows the declaration automatically.

sizeof *p does not dereference p - sizeof is evaluated at compile time from the type alone, so it is safe even when p is uninitialized or NULL.

Uninitialized Memory

malloc does not clear what it gives you. The bytes hold whatever was there before.

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(4 * sizeof *p);
    if (p == NULL) {
        return 1;
    }

    /* reading before writing is undefined behavior - so write first */
    for (int i = 0; i < 4; i++) {
        p[i] = 0;
    }

    printf("%d %d %d %d\n", p[0], p[1], p[2], p[3]);

    free(p);
    return 0;
}

When you want the block zeroed for you, calloc does it in one step - see calloc and realloc.

free: Giving It Back

free(p) returns the block to the allocator. Three rules:

• Pass the exact pointer malloc returned, not one that has been advanced. free(p + 1) is undefined behavior.
• Free each block exactly once. Twice is a double free, which corrupts the allocator's own bookkeeping.
• After freeing, the pointer is stale. Using it is a use-after-free.

int *p = malloc(sizeof *p);
free(p);
*p = 5;        /* use-after-free - undefined behavior */
free(p);       /* double free - undefined behavior */

Neither line is required to crash immediately, which is what makes them dangerous: the program may run for minutes and then fail somewhere unrelated. The cheap defense is to blank the pointer:

free(p);
p = NULL;

free(NULL) is explicitly defined to do nothing, so a second free(p) after that is harmless, and *p becomes an immediate crash at the real fault site instead of quiet corruption.

A Dynamic Array, End to End

Here is the shape of a real allocation: read a count at runtime, size the block from it, use it, free it.

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int n = 8;   /* imagine this came from input or a file */

    double *values = malloc((size_t)n * sizeof *values);
    if (values == NULL) {
        fprintf(stderr, "allocation of %d doubles failed\n", n);
        return 1;
    }

    for (int i = 0; i < n; i++) {
        values[i] = 1.0 / (i + 1);
    }

    double sum = 0.0;
    for (int i = 0; i < n; i++) {
        sum += values[i];
    }

    printf("sum of 1/1 .. 1/%d = %f\n", n, sum);
    printf("block holds %zu bytes\n", (size_t)n * sizeof *values);

    free(values);
    values = NULL;
    return 0;
}

The cast to size_t on the count matters once sizes get large: n * sizeof *values with a plain int n can overflow before the multiplication ever reaches malloc, producing a block far smaller than intended. Multiplying in size_t avoids that.

Allocating Inside a Function

The heap's lifetime rule is what makes this legal - and what makes returning a local array illegal:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

/* caller owns the returned block and must free it */
char *duplicate(const char *text) {
    size_t len = strlen(text);
    char *copy = malloc(len + 1);
    if (copy == NULL) {
        return NULL;
    }
    memcpy(copy, text, len + 1);
    return copy;
}

int main(void) {
    char *greeting = duplicate("hello, heap");
    if (greeting == NULL) {
        fprintf(stderr, "out of memory\n");
        return 1;
    }

    greeting[0] = 'H';
    printf("%s\n", greeting);

    free(greeting);
    return 0;
}

len + 1 leaves room for the null terminator - the same sizing rule as everywhere in strings. And notice the comment above the function: when a function returns allocated memory, who frees it is part of its contract. Writing that down is not paperwork; it is the only thing preventing a leak.

Structs on the Heap

The same idiom works for any type:

#include <stdio.h>
#include <stdlib.h>

struct Point {
    double x;
    double y;
};

int main(void) {
    struct Point *p = malloc(sizeof *p);
    if (p == NULL) {
        return 1;
    }

    p->x = 3.0;
    p->y = 4.0;
    printf("(%.1f, %.1f)\n", p->x, p->y);

    /* an array of them */
    int n = 3;
    struct Point *path = malloc((size_t)n * sizeof *path);
    if (path == NULL) {
        free(p);
        return 1;
    }

    for (int i = 0; i < n; i++) {
        path[i].x = i;
        path[i].y = i * i;
    }
    printf("last point: (%.1f, %.1f)\n", path[n - 1].x, path[n - 1].y);

    free(path);
    free(p);
    return 0;
}

Note the second failure branch frees p before returning. Once a function holds more than one allocation, every error path has to release the ones already taken - the commonest source of the leaks described in memory leaks.

Checklist

• Always check malloc for NULL before the first use.
• Size with n * sizeof *p, multiplying in size_t.
• No cast on the return value in C.
• malloc memory is uninitialized; write before you read.
• Free exactly once, with the original pointer, then set it to NULL.
• Every error path after an allocation must free what it already holds.