c - 奇怪的双重自由行为

Question

下面我有一个函数 trim()。从整数数组中删除前导零。它返回一个指针，它从 malloc() 接收。在运行连续调用 trim() 和 free() 的循环时。我注意到 trim() 返回的值(由 malloc() 接收)在每次迭代中都是相同的。

据我所知，释放同一个指针两次，如果它不是NULL，将导致双重释放错误。为什么在这种情况下没有遇到double free 错误？

#include <stdio.h>
#include <stdlib.h>

int main()
{
    int i, j, length;
    int n[] = { 4, 5, 6 };
    int m[] = { 0, 3, 5 };
    int *num;
    int *trimmed, *trimmed_length;

    trimmed_length = &length;

    for (i = 0; i < 10; i++)
    {
        num = (i % 2 == 0) ? n : m;

        trimmed = trim(num, 3, trimmed_length);

        if (!trimmed)
        {
            printf("trimmed was null\n");
            exit(-1);
        }

        for (j = 0; j < *trimmed_length; j++)
        {
            printf("%d", trimmed[j]);
        }   

        printf("\n");

        free(trimmed); 
    }

    exit(0);
}

int *trim(int *n, int nlength, int *res_length)
{
    int i, j;
    int *res;

    for (i = 0; i < nlength; i++)
    {
        if (n[i] > 0)
        {
            break;
        }
    }

    *res_length = (nlength - i);

    res = malloc(sizeof(int) * (*res_length));

    if (!res)
    {
        return NULL;
    }

    j = 0;

    while (i < nlength)
    {
        res[j++] = n[i++];
    }

    printf("Returned pointer from trim() %d\n", res);

    return res;
}

输出:

Returned pointer from trim() 11759632
456
Returned pointer from trim() 11759632
35
Returned pointer from trim() 11759632
456
Returned pointer from trim() 11759632
35
Returned pointer from trim() 11759632
456
Returned pointer from trim() 11759632
35
Returned pointer from trim() 11759632
456
Returned pointer from trim() 11759632
35
Returned pointer from trim() 11759632
456
Returned pointer from trim() 11759632
35

Answer 1

您看到的不是双重免费。考虑:

void *p1, *p2;

p1 = malloc(10);
free(p1);
p2 = malloc(10);

目前无法保证 p1 和 p2 相同。不能保证它们是不同的。如果它们恰好相同，此时调用 free(p2) 就不是双重释放。以下将是实际的双重释放:

void *p = malloc(10);
free(p);
free(p);