Double free

Not to be confused with the memory management bug..

Double free

Designed by	User:raiseafloppafan7741
Appeared in	2026
Computational class	Below combinational logic
Reference implementation	Unimplemented
Influenced by	Malloc
Influenced	Mixed allocators

Double free is a programming language by User:raiseafloppafan7741 inspired by and is a superset of Malloc. It is obviously based on the memory management bug. Here, you can really only do two things: allocate memory, and free a pointer twice.

Syntax

Double free's syntax is built on Malloc's syntax, but with heavy extensions. It adds basic expressions with integers, comparison and relational operators, arithmetic operators, bitwise operators, unary negation, and grouping with the same precedence as in C. This also means that since C has a == b bind tighter than a & b, you have to parenthesize them if you want to use a bitwise operator in a comparison. However, there are no dereferencing or increment/decrement operators.

Function calls are implicit via juxtaposition with argument lists longer than one having each argument separated by backticks, so malloc 10 in C would be malloc(10), double_free malloc 10 would be double_free(malloc(10)), and function(a, b, c) in C would be function a ` b ` c in Double free.

nullptr is a keyword borrowed from C++ and is just a null pointer value.

Variables can be defined to exist with the type void* (uninitialized) with

?! varname

and can be assigned with

varname : value

malloc semantics

malloc and double_free are both functions.

Since Malloc does not specify what happens when a negative amount of bytes are allocated, allocating a negative amount of bytes will just wrap around, as you are trying to use a two's complement signed number in a function that expects an unsigned integer. Specifically, the argument to malloc is a size_t as defined by the C standard. So, the following program will just allocate an insane amount of memory.

malloc -1

Since size_t's size is platform-dependent, the amount of bytes this allocates is also varying.

Since malloc(0) is implementation-defined in the C standard, it is also implementation-defined in Double free.

Examples

Allocate 5 bytes of memory and double-free it

?! x
x : malloc 5
double_free x

Allocate a gibibyte of memory and double-free it

?! ptr
ptr : malloc (1024 * 1024 * 1024)
double_free ptr

Leak 8 bytes and double-free 8 bytes

?! ptr1
?! ptr2
ptr1 : malloc 8
ptr2 : malloc 8
double_free ptr1

Test memory security

?! x
x : malloc 1024
double_free x
x : malloc 1024
double_free x
x : malloc 1024
double_free x
x : malloc 1024
double_free x

I have no idea

?! a
?! b
?! c
double_free a
double_free b
double_free c

This thing

?! ptr
ptr malloc -1

With a 16-bit size_t, this will allocate 65,536 bytes. With 32-bit size_ts, this will allocate 4 GiB. With 64-bit size_ts, this will allocate 18 quintillion bytes.

Wild card program 1

?! ptr
ptr : malloc 0
double_free ptr

Wild card program 2

?! ptr
double_free ptr

Looks dangerous, is safe

double_free nullptr

This works because free(NULL) does nothing in C, so freeing it twice does nothing as well.

Uno reverse card

double_free malloc
double_free double_free

This is a valid program since malloc and double_free are treated as the addresses of the functions' respective machine code.

See also

• Malloc
• Mixed allocators, an offshoot of Double free focusing on what happens when you mix the standard allocators in C++
• Use-after-free, a variant of Double free focusing on using a pointer after freeing it.