如何在Linux中获得正确的堆起始地址？

Question

In my C Code:

 unsigned char* p2 = NULL;
 p2 = malloc(0x1024);
 printf("start of heap = %p \r\n",p2);
 printf("end of heap = 0x%x \r\n",(unsigned long)sbrk(0));
 unsigned long sizeOfHeap = (unsigned long)sbrk(0) - (unsigned long)p2;
 printf("sizeOfHeap = 0x%x \r\n",sizeOfHeap);

And it shows:

yangxiaoyu@STB-240:~/test/c/mem$ ./a.out   
start of heap = 0x1b26010 
end of heap = 0x1b48000 
sizeOfHeap = 0x21ff0 

But when I add "while(1)" at the end of this code, and cat proc maps,

yangxiaoyu@STB-240:~/test/c/mem$ ./a.out & 
[1] 163026
yangxiaoyu@STB-240:~/test/c/mem$ start of heap = 0xb7b010 
end of heap = 0xb9d000 
sizeOfHeap = 0x21ff0 

yangxiaoyu@STB-240:~/test/c/mem$ cat /proc/163026/map
map_files/ maps       
yangxiaoyu@STB-240:~/test/c/mem$ cat /proc/163026/map
map_files/ maps       
yangxiaoyu@STB-240:~/test/c/mem$ cat /proc/163026/maps 
00400000-00401000 r-xp 00000000 08:12 266873328                          /home/yangxiaoyu/test/c/mem/a.out
00600000-00601000 r--p 00000000 08:12 266873328                          /home/yangxiaoyu/test/c/mem/a.out
00601000-00602000 rw-p 00001000 08:12 266873328                          /home/yangxiaoyu/test/c/mem/a.out
00b7b000-00b9d000 rw-p 00000000 00:00 0                                  [heap]
7f499604e000-7f499620c000 r-xp 00000000 08:03 9572117                    /lib/x86_64-linux-gnu/libc-2.19.so
7f499620c000-7f499640c000 ---p 001be000 08:03 9572117                    /lib/x86_64-linux-gnu/libc-2.19.so
7f499640c000-7f4996410000 r--p 001be000 08:03 9572117                    /lib/x86_64-linux-gnu/libc-2.19.so
7f4996410000-7f4996412000 rw-p 001c2000 08:03 9572117                    /lib/x86_64-linux-gnu/libc-2.19.so
7f4996412000-7f4996417000 rw-p 00000000 00:00 0 
7f4996417000-7f499643a000 r-xp 00000000 08:03 9572106                    /lib/x86_64-linux-gnu/ld-2.19.so
7f4996624000-7f4996627000 rw-p 00000000 00:00 0 
7f4996638000-7f4996639000 rw-p 00000000 00:00 0 
7f4996639000-7f499663a000 r--p 00022000 08:03 9572106                    /lib/x86_64-linux-gnu/ld-2.19.so
7f499663a000-7f499663b000 rw-p 00023000 08:03 9572106                    /lib/x86_64-linux-gnu/ld-2.19.so
7f499663b000-7f499663c000 rw-p 00000000 00:00 0 
7ffde625a000-7ffde627b000 rw-p 00000000 00:00 0                          [stack]
7ffde633b000-7ffde633d000 r--p 00000000 00:00 0                          [vvar]
7ffde633d000-7ffde633f000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
yangxiaoyu@STB-240:~/test/c/mem$ 

you can get

start of heap = 0xb7b010 ,

and

00b7b000-00b9d000 rw-p 00000000 00:00 0 [heap]

so, How I get the real address of heap in C code? WHY the address of malloc(0xb7b010) is not equal to 0b7b000 ？

Answer 1

00b7b000 is the actual start of heap memory allocated to the program.

When you call malloc it will store some data before the pointer returned (in this case 16 bytes). The data stored is implementation specific, but at least size of memory allocated should be stored.

This information is used when you call free to properly free the memory for future use. It is also used for realloc functions.

As for the end not matching the given size, probably the program takes a chunk of memory from the OS for heap and uses it as needed. So, even though you have allocated 0x21ff0 bytes some more data is still available to allocate before asking the OS for more memory.