深入理解malloc函数(c语言)

看下面代码(来自vs2005)

深度解析malloc函数：
extern "C" _CRTIMP void * __cdecl malloc (
size_t nSize
)
{
void *res = _nh_malloc_dbg(nSize, _newmode, _NORMAL_BLOCK, NULL, 0);//函数调用，跟进
//#define _NORMAL_BLOCK    1
//_newmode == 0

RTCCALLBACK(_RTC_Allocate_hook, (res, nSize, 0));

return res;
}

//_nh_malloc_dbg函数
extern "C" void * __cdecl _nh_malloc_dbg (
size_t nSize,
int nhFlag,
int nBlockUse,
const char * szFileName,
int nLine
)
{
void * pvBlk;

for (;;)
{
/* do the allocation
*/
pvBlk = _heap_alloc_dbg(nSize, nBlockUse, szFileName, nLine); //调用函数_heap_alloc_dbg，跟进

if (pvBlk)
{
return pvBlk;
}
if (nhFlag == 0)
{
errno = ENOMEM;
return pvBlk;
}

/* call installed new handler */
if (!_callnewh(nSize))
{
errno = ENOMEM;
return NULL;
}

/* new handler was successful -- try to allocate again */
}
}

//_heap_alloc_dbg函数
extern "C" void * __cdecl _heap_alloc_dbg(
size_t nSize,
int nBlockUse,
const char * szFileName,
int nLine
)
{
long lRequest;
size_t blockSize;
int fIgnore = FALSE;
_CrtMemBlockHeader * pHead;
void *retval=NULL;

/* lock the heap
*/
_mlock(_HEAP_LOCK);
__try {

/* verify heap before allocation */
if (check_frequency > 0)
if (check_counter == (check_frequency - 1))
{
_ASSERTE(_CrtCheckMemory());
check_counter = 0;
}
else
check_counter++;

lRequest = _lRequestCurr;

/* break into debugger at specific memory allocation */
if (_crtBreakAlloc != -1L && lRequest == _crtBreakAlloc)
_CrtDbgBreak();

/* forced failure */
if ((_pfnAllocHook) && !(*_pfnAllocHook)(_HOOK_ALLOC, NULL, nSize, nBlockUse, lRequest, (const unsigned char *)szFileName, nLine))
{
if (szFileName)
_RPT2(_CRT_WARN, "Client hook allocation failure at file %hs line %d./n",
szFileName, nLine);
else
_RPT0(_CRT_WARN, "Client hook allocation failure./n");
}
else
{
/* cannot ignore CRT allocations */
if (_BLOCK_TYPE(nBlockUse) != _CRT_BLOCK &&
!(_crtDbgFlag & _CRTDBG_ALLOC_MEM_DF))
fIgnore = TRUE;

/* Diagnostic memory allocation from this point on */

if (nSize > (size_t)(_HEAP_MAXREQ - nNoMansLandSize - sizeof(_CrtMemBlockHeader)))
{
_RPT1(_CRT_ERROR, "Invalid allocation size: %Iu bytes./n", nSize);
errno = ENOMEM;
}
else
{
if (!_BLOCK_TYPE_IS_VALID(nBlockUse))
{
_RPT0(_CRT_ERROR, "Error: memory allocation: bad memory block type./n");
}

blockSize = sizeof(_CrtMemBlockHeader) + nSize + nNoMansLandSize;//实际内存分配的大小

#ifndef WINHEAP
/* round requested size */
blockSize = _ROUND2(blockSize, _GRANULARITY);
#endif  /* WINHEAP */

RTCCALLBACK(_RTC_FuncCheckSet_hook,(0));
pHead = (_CrtMemBlockHeader *)_heap_alloc_base(blockSize);

if (pHead == NULL)
{
errno = ENOMEM;
RTCCALLBACK(_RTC_FuncCheckSet_hook,(1));
}
else
{

/* commit allocation */
++_lRequestCurr;

if (fIgnore)
{
//这里应该是所有申请的空间了，包括信息节点
pHead->pBlockHeaderNext = NULL;
pHead->pBlockHeaderPrev = NULL;
pHead->szFileName = NULL;
pHead->nLine = IGNORE_LINE;
pHead->nDataSize = nSize;
pHead->nBlockUse = _IGNORE_BLOCK;
pHead->lRequest = IGNORE_REQ;
}
else {
/* keep track of total amount of memory allocated */
_lTotalAlloc += nSize;
_lCurAlloc += nSize;

if (_lCurAlloc > _lMaxAlloc)
_lMaxAlloc = _lCurAlloc;

if (_pFirstBlock)
_pFirstBlock->pBlockHeaderPrev = pHead;
else
_pLastBlock = pHead;

pHead->pBlockHeaderNext = _pFirstBlock;
pHead->pBlockHeaderPrev = NULL;
pHead->szFileName = (char *)szFileName;
pHead->nLine = nLine;
pHead->nDataSize = nSize;
pHead->nBlockUse = nBlockUse;
pHead->lRequest = lRequest;

/* link blocks together */
_pFirstBlock = pHead;
}

/* fill in gap before and after real block */
//+		pHead	0x003f8250 {pBlockHeaderNext=0x003f8060 pBlockHeaderPrev=0x00000000 szFileName=0x00000000 <错误的指针> ...}	_CrtMemBlockHeader *
memset((void *)pHead->gap, _bNoMansLandFill, nNoMansLandSize);
//+		pHead	0x003f8250 {pBlockHeaderNext=0x003f8060 pBlockHeaderPrev=0x00000000 szFileName=0x00000000 <错误的指针> ...}	_CrtMemBlockHeader *
memset((void *)(pbData(pHead) + nSize), _bNoMansLandFill, nNoMansLandSize);
//>+		pHead	0x003f8250 {pBlockHeaderNext=0x003f8060 pBlockHeaderPrev=0x00000000 szFileName=0x00000000 <错误的指针> ...}	_CrtMemBlockHeader *

/* fill data with silly value (but non-zero) */
memset((void *)pbData(pHead), _bCleanLandFill, nSize);
//+		pHead	0x003f8250 {pBlockHeaderNext=0x003f8060 pBlockHeaderPrev=0x00000000 szFileName=0x00000000 <错误的指针> ...}	_CrtMemBlockHeader *
RTCCALLBACK(_RTC_FuncCheckSet_hook,(1));

retval=(void *)pbData(pHead);
//+		pHead	0x003f8250 {pBlockHeaderNext=0x003f8060 pBlockHeaderPrev=0x00000000 szFileName=0x00000000 <错误的指针> ...}	_CrtMemBlockHeader *
//		retval	0x003f8270	void *

}
}
}

}
__finally {
/* unlock the heap
*/
_munlock(_HEAP_LOCK);
}
return retval;
}

根据代码，我们可以知道，malloc申请的空间不只是nSize大小，还有一个用来记录以申请空间信息的头，这样，总的大小就是blockSize = sizeof(_CrtMemBlockHeader) + nSize + nNoMansLandSize。这就解释了为什么free的时候只需要传入指针就行。

可以尝试一下代码：

int _tmain(int argc, _TCHAR* argv[])
{
int *p=NULL;
p=(int*)malloc(sizeof(int)*20);
printf("%d/n",*(p-1));
printf("%d/n",*(p-2));
printf("%d/n",*(p-3));
printf("%d/n",*(p-4));
}

*(p-4)的值就是malloc时的size大小。