malloc, free, and the Heap

Why check? Because malloc can fail — especially with very large allocations, or on memory-constrained systems. Dereferencing NULL is undefined behavior — the same class of bug as your bare-pointer scanf from lesson 1.

free — give it back

char *buf = malloc(100 * sizeof(char));
if (!buf) { return 1; }

/* use buf */

free(buf);      // return the memory to the OS
buf = NULL;    // optional but smart: prevents use-after-free

free(buf) tells the OS "I'm done with this memory." The bytes are returned to the heap for reuse. After free, buf is a dangling pointer — it holds an address that no longer belongs to you.

malloc + strings — the real "dynamic string"

Here's a concrete example. You have two strings and you want to concatenate them into a new string — on the heap, sized exactly right:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *join(const char *a, const char *b) {
    // Count the exact size we need
    size_t len = strlen(a) + strlen(b) + 1;

    // Ask the heap for exactly that many bytes
    char *result = malloc(len * sizeof(char));
    if (result == NULL) {
        return NULL;
    }

    // Copy both parts in — using your lesson 2/5 skills
    char *p = result;
    while (*a != '\0') { *p++ = *a++; }
    while (*b != '\0') { *p++ = *b++; }
    *p = '\0';

    return result;       // caller now owns this memory
}

int main(void) {
    char *s = join("Hello", "World");
    if (s) {
        printf("%s\n", s);   // → HelloWorld
        free(s);            // must free what we malloc'd
    }
    return 0;
}

Notice the discipline: join mallocs, the caller frees. Whoever allocates is responsible for documenting who frees. In library code, this is the convention: the function that returns heap memory transfers ownership to the caller.

Stack vs heap — when to use which

calloc — malloc that zeroes

// These two are equivalent:
int *a = malloc(100 * sizeof(int));     // 100 ints, uninitialized garbage
int *b = calloc(100, sizeof(int));    // 100 ints, all set to 0

calloc(count, size) takes two arguments: how many elements, and how big each one is. It zeroes the memory. Slightly slower, but safer — uninitialized heap memory is a common source of unpredictable bugs.

realloc — resize a heap allocation

char *buf = malloc(50);
/* ... use buf ... */

/* Need more space? */
char *bigger = realloc(buf, 200);
if (bigger == NULL) {
    // realloc failed — original buf is still valid!
    free(buf);
    return 1;
}
buf = bigger;   // now buf points at 200 bytes

realloc tries to grow (or shrink) the allocation in place. If it can't, it allocates new memory, copies the old data over, frees the old block, and returns the new pointer. If it fails, it returns NULL — and the old pointer is still valid. This is the one trap: don't do buf = realloc(buf, 200); without checking — if it returns NULL, you've lost the original pointer (leak + can't free).

buf = realloc(buf, 200);  // if NULL → you leaked the original buf!

char *s = malloc(6);
strcpy(s, "Hello");
printf("%s\n", s);
  
Show answer
  Two things. First: no #include <stdlib.h> — the compiler may not see malloc's declaration, defaulting to assuming it returns int, which will corrupt the pointer on 64-bit systems. Second: no NULL check — if malloc fails, strcpy writes to address 0. Both are real bugs, even if they don't crash on your machine today.
  

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *mystrdup(const char *src) {
    if (src == NULL) return NULL;

    size_t len = strlen(src);
    char *copy = malloc(len + 1);
    if (copy == NULL) return NULL;

    // Copy using lesson 5's compact form
    char *dst = copy;
    while (*src != '\0') {
        *dst++ = *src++;
    }
    *dst = '\0';

    return copy;
}

int main(void) {
    char *s = mystrdup("Hello, world!");
    if (s) {
        printf("Copy: %s\n", s);
        printf("Address of copy: %p\n", (void *)s);
        free(s);
    }
    return 0;
}