Confusion about realloc function

Question

I read about dynamic memory allocation in C using this reference.

That document Say's :

realloc() should only be used for dynamically allocated memory. If the memory is not dynamically allocated, then behavior is undefined.

If we use realloc() something like this:

int main()
{
    int *ptr;
    int *ptr_new = (int *)realloc(ptr, sizeof(int));

    return 0;
}

According to that reference, this program is undefined because pointer ptr not allocated dynamically.

But, If I use something like:

int main()
{
    int *ptr = NULL;
    int *ptr_new = (int *)realloc(ptr, sizeof(int));

    return 0;
}

Is it also undefined behavior according to that reference?

I thing second case does not invoked undefined behaviour. Am I right?

The document you mention is incomplete. See storyteller's answer below. — Jabberwocky, Nov 13 '17 at 14:22
In C you should not cast the return of `realloc` for the same reasons you shouldn't do it for `malloc`: https://stackoverflow.com/questions/605845/do-i-cast-the-result-of-malloc — Jens Gustedt, Nov 13 '17 at 16:34

score 10 · Accepted Answer · answered Nov 13 '17 at 14:18

The first case has undefined behavior, and the second doesn't. In the first case, the value of ptr is indeterminate. So passing that value to realloc or any function, is undefined by itself.

On the other hand, since realloc has well defined behavior when passed a null pointer value (it's just like calling malloc)¹, the second piece of code is perfectly legitimate (other than the fact you don't free anything).

¹ 7.22.3.5 The realloc function / p3

If ptr is a null pointer, the realloc function behaves like the malloc function for the specified size.

score 1 · Answer 2 · answered Nov 13 '17 at 14:21

In the first case the program almost sure will finish by segmentation fault as the linked lists that are created in the heap to find segments are not coherent, in the second case you call the realloc with the NULL first parameter, which means, is a call equivalent to malloc(size)

man realloc says:

   void *malloc(size_t size); 
   void *realloc(void *ptr, size_t size);

If ptr is NULL, then the call is equivalent to malloc(size), for all values of size

score 1 · Answer 3 · answered Nov 13 '17 at 14:25

The only authorative reference is the standard document. n1570 (the latest C11 standard) has the following to say:

§7.22.3.5 The realloc function, p3:

If ptr is a null pointer, the realloc function behaves like the malloc function for the specified size. Otherwise, if ptr does not match a pointer earlier returned by a memory management function, or if the space has been deallocated by a call to the free or realloc function, the behavior is undefined. [...]

So, your second example is well-defined.

score 1 · Answer 4 · answered Nov 13 '17 at 14:31

The first case is obviously undefined behavior because we don't know where the ptr is pointing or what the ptr is holding at that time. And c standard says that 7.20.3.4.2 The realloc function

The realloc function deallocates the old object pointed to by ptr and returns a pointer to a new object that has the size specified by size.

So first case is Undefined behavior.

In second case compiler knows what ptr has so it is valid but realloc() will act as malloc() according to 7.20.3.4.3 The realloc function

If ptr is a null pointer, the realloc function behaves like the malloc function for the specified size.

Confusion about realloc function

4 Answers4