To point; if you free memory, and reuse it (without nulling the reference), you likely won't segfault.
Simple example (compiled on OSX)
#include <stdlib.h>
#include <stdio.h>
struct X {
int x;
};
int main() {
struct X *a = (struct X *) malloc(sizeof(struct X));
a->x = 4;
printf("%d\n", a->x);
free(a); // a is no longer a valid reference
struct X *b = (struct X *) malloc(sizeof(struct X));
printf("%d\n", b->x); // b is probably reusing the memory used by a
a->x = 5; // updating a probably updates b
printf("%d\n", b->x);
}
If you compile this without optimization (clang test.c) you'll probably get
4
4
5
'Probably' because this is both relies on both undefined behavior (which is partially why turning on -O2 changes the result), and the way malloc is implemented.
Fortunately, in a simple case like this, compiling your application with '-fsanitize=address' will give a very nice error in this case. :)
Not necessarily. It can tell you if it is triggered by your tests; but it won't tell you if it isn't. So if you run your test suite under valgrind, and you don't trigger the problem, valgrind won't tell you that there is a potential issue for certain inputs. Which, in this case, will result in silent corruption of the heap.
So, trivially adding argc to main,
if (argc > 5) {
free(a); // a is no longer a valid reference
}
// valgrind won't catch this issue
b->x = 2; // valgrind complained about us dereferencing b before intializing
a->x = 5; // valgrind won't complain about this if argc <= 5
results in a program that valgrind won't catch. Valgrind is great; but your users won't be running it when they use your program.
Now sure, you combine valgrind with other tools like afl (https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer)) or KLEE (https://klee.github.io/), and insist that your test suites have full coverage (however, code coverage isn't the same as input space coverage), but the point is, you're stuck doing runtime analysis (and need to know that you need to do that analysis) to make sure you did this right. Baking this type of error checking into the type system itself is valuable.
Given that large projects like Google's Chrome keep hitting these issues, it seems reasonable to say that they aren't strictly trivial to solve. :)
if you segfault. UB means anything can happen. Sometimes that's a segfault. Sometimes it means worse things.