![](https://csdnimg.cn/release/download_crawler_static/9412640/bg4.jpg)
2.3 Unmapped Region and No-Man’s Land
We saw earlier that the break mark the end of the mapped virtual adress space: accessing
adresses above the break should trigger a bus error. The remaining space between the break
and the maximum limit of the heap is not associated to physical memory by the virtual memory
manager of the system (the MMU and the dedicated part of the kernel.)
But, if you know a little about virtual memory (and even if use your brain 5 seconds), you
know that memory is mapped by pages: physical memory and virtual memory is organize in
pages (frames for the physical memory) of fixed size (most of the time.) The page size is by far
bigger than one byte (on most actual system a page size is 4096 bytes.) Thus, the break may
not be on pages boundary.
Mapped Region Unmapped Region
Unavailable Space
Heap’s Start
break
rlimit
Figure 2: Pages and Heap
Figure 2 presents the previous memory organisation with page boundaries. We can see the
break may not correspond to a page boundary. What is the status of the memory betwee the
break and the next page boundary ? In fact, this space is available ! You can access (for reading
or writing) bytes in this space. The issue is that you don’t have any clue on the position of the
next boundary, you can find it but it is system dependant and badly advise.
This no-man’s land is often a root of bugs: some wrong manipulations of pointer outside of
the heap can success most of the time with small tests and fail only when manipulating larger
amount of data.
2.4 mmap(2)
Even if we won’t use it in this tutorial, you should pay attention to the mmap(2) syscall. It
has an annonymous mode (mmap(2) is usualy used to directly map files in memory) which can
used to implement malloc (completely or for some specific cases.)
mmap in annonymous mode can allocate a specific amount of memory (by page size granu-
larity) and munmap can free it. It is often simpler and more efficient than classical sbrk based
malloc. Many malloc implementation use mmap for large allocation (more than one page.)
The OpenBSD’s malloc uses only mmap with some quirks in order to improve security (prefer-
ing page’s borders for allocation with holes between pages.)
3 Dummy malloc
First, we will play with sbrk(2) to code a dummy malloc. This malloc is probabily the
worst one, even if it is the simplest and quiet the fastest one.
4