C memory management & pointers

#include <stdio.h>
#include <stdlib.h>
 
const char *greeting = "hi";  // the pointer: .data
                              // the bytes "hi": .rodata
int limit = 10;               // .data (initialized)
int counter;                  // .bss (zero-initialized)
 
int main(void) {
    static int calls;         // .bss too: not on the stack
    int local = 5;            // stack
    int *heap = malloc(sizeof *heap);   // heap
    if (heap == nullptr) return 1;
 
    printf("rodata %p\n", (void *)greeting);
    printf("data   %p\n", (void *)&limit);
    printf("bss    %p %p\n", (void *)&counter,
           (void *)&calls);
    printf("heap   %p\n", (void *)heap);
    printf("stack  %p\n", (void *)&local);
    free(heap);
}

$ ./where
rodata 0x562ae0bf9004
data   0x562ae0bfb030
bss    0x562ae0bfb03c 0x562ae0bfb038
heap   0x562b178ab2a0
stack  0x7ffc52d17cf8
$ size ./where
   text    data     bss     dec     hex filename
   1978     640      16    2634     a4a ./where

#include <stdio.h>
 
int main(void) {
    int x = 5;
    int *p = &x;      // p holds the address of x
    *p = 7;           // write through p: x is now 7
    int **pp = &p;    // a pointer to a pointer
 
    printf("%d %d %d\n", x, *p, **pp);   // 7 7 7
    printf("%p %p\n", (void *)&x, (void *)p);  // equal
    printf("%zu\n", sizeof p);   // 8 on 64-bit systems
}

#include <stddef.h>
#include <stdio.h>
 
int main(void) {
    int a[5] = {10, 20, 30, 40, 50};
    int *p = a;              // decays: same as &a[0]
 
    printf("%d %d %d\n", p[2], *(p + 2), a[2]);  // 30 x 3
    printf("%p %p\n", (void *)p, (void *)(p + 1));
    // the two addresses differ by sizeof(int) == 4
 
    ptrdiff_t d = &a[4] - &a[1];     // 3 elements
    printf("%td\n", d);
 
    for (int *it = a; it != a + 5; it++)  // a + 5 is one
        printf("%d ", *it);               // past the end
    printf("\n%zu %zu\n", sizeof a, sizeof p);  // 20 8
}

#include <stddef.h>
 
#define ARRAY_LEN(a) (sizeof (a) / sizeof (a)[0])
 
// The parameter is really `const int *xs`: pass the length
long sum(const int xs[], size_t n) {
    long total = 0;
    for (size_t i = 0; i < n; i++) total += xs[i];
    return total;
}
 
long sum_all(void) {
    static const int xs[] = {1, 2, 3, 4};
    return sum(xs, ARRAY_LEN(xs));  // ARRAY_LEN on the real
}                                   // array, never on xs[]

#include <stdio.h>
 
int main(void) {
    int x = 1, y = 2;
 
    const int *a = &x;        // pointer to const int
    // *a = 5;                // error: *a is read-only
    a = &y;                   // fine: a itself can move
 
    int *const b = &x;        // const pointer to int
    *b = 5;                   // fine
    // b = &y;                // error: b is read-only
 
    const int *const c = &x;  // neither can change
    printf("%d %d %d\n", *a, *b, *c);   // 2 5 5
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// On success sets *out to a new string (caller frees) and
// returns 0; on failure leaves *out alone, returns -1.
int join_path(const char *dir, const char *file,
              char **out) {
    size_t n = strlen(dir) + 1 + strlen(file) + 1;
    char *s = malloc(n);
    if (!s) return -1;
    snprintf(s, n, "%s/%s", dir, file);
    *out = s;
    return 0;
}
 
int main(void) {
    char *path = nullptr;
    if (join_path("/etc", "hosts", &path) != 0) return 1;
    puts(path);                  // /etc/hosts
    free(path);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
int main(void) {
    size_t rows = 3, cols = 4;
 
    // Contiguous: one allocation; the type knows cols
    double (*m)[cols] = malloc(rows * sizeof *m);
    if (!m) return 1;
    for (size_t r = 0; r < rows; r++)
        for (size_t c = 0; c < cols; c++)
            m[r][c] = (double)(r * cols + c);
    printf("%.0f\n", m[2][3]);       // 11
    free(m);
 
    // Jagged: an array of pointers, each row its own block
    const char *words[] = {"ab", "cde", "f"};
    char **rowsv = calloc(3, sizeof *rowsv);
    if (!rowsv) return 1;
    for (size_t i = 0; i < 3; i++)
        rowsv[i] = strdup(words[i]);   // null on failure
    printf("%s\n", rowsv[1] ? rowsv[1] : "?");   // cde
    for (size_t i = 0; i < 3; i++) free(rowsv[i]);
    free(rowsv);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
typedef struct { const char *name; int age; } Person;
 
// qsort calls this with pointers to two elements
static int by_age(const void *a, const void *b) {
    const Person *x = a, *y = b;
    return (x->age > y->age) - (x->age < y->age);
}
 
static int by_name(const void *a, const void *b) {
    const Person *x = a, *y = b;
    return strcmp(x->name, y->name);
}
 
int main(void) {
    Person people[] = {{"Lin", 41}, {"Ada", 36}, {"Bo", 29}};
    size_t n = sizeof people / sizeof people[0];
 
    int (*cmp)(const void *, const void *) = by_age;
    qsort(people, n, sizeof people[0], cmp);
    printf("%s\n", people[0].name);   // Bo
 
    qsort(people, n, sizeof people[0], by_name);
    printf("%s\n", people[0].name);   // Ada
}

#include <stddef.h>
#include <stdio.h>
 
typedef void Visit(int value, void *ctx);  // function type
 
static void for_each(const int *xs, size_t n, Visit *f,
                     void *ctx) {
    for (size_t i = 0; i < n; i++) f(xs[i], ctx);
}
 
static void add_to(int v, void *ctx) {
    *(long *)ctx += v;
}
 
typedef double BinOp(double, double);
static double add(double a, double b) { return a + b; }
static double mul(double a, double b) { return a * b; }
 
static const struct { char sym; BinOp *fn; } ops[] = {
    {'+', add},
    {'*', mul},
};
 
int main(void) {
    int xs[] = {1, 2, 3, 4};
    long total = 0;
    for_each(xs, 4, add_to, &total);
    printf("%ld\n", total);                  // 10
 
    for (size_t i = 0; i < 2; i++)     // dispatch table
        printf("6 %c 7 = %g\n", ops[i].sym, ops[i].fn(6, 7));
}

#include <stdio.h>
#include <string.h>
 
// Works for any type: the caller supplies the size
void swap_any(void *a, void *b, size_t size) {
    unsigned char *x = a, *y = b;   // byte view
    for (size_t i = 0; i < size; i++) {
        unsigned char t = x[i];
        x[i] = y[i];
        y[i] = t;
    }
}
 
int main(void) {
    double p = 1.5, q = 2.5;
    swap_any(&p, &q, sizeof p);
    char s[8] = "left", t[8] = "right";
    swap_any(s, t, sizeof s);
    printf("%g %g %s %s\n", p, q, s, t);
}   // 2.5 1.5 right left

#include <stdio.h>
#include <stdlib.h>
 
typedef struct { double x, y; } Point;
 
int main(void) {
    size_t n = 1000;
    Point *pts = malloc(n * sizeof *pts);  // type named once
    if (pts == nullptr) {
        perror("malloc");
        return 1;
    }
    for (size_t i = 0; i < n; i++)
        pts[i] = (Point){.x = (double)i, .y = 0.0};
 
    int *counts = calloc(256, sizeof *counts);  // all zero
    if (!counts) { free(pts); return 1; }
 
    // Grow: keep the old pointer until realloc succeeds
    size_t bigger = n * 2;
    Point *tmp = realloc(pts, bigger * sizeof *pts);
    if (!tmp) { free(counts); free(pts); return 1; }
    pts = tmp;               // the block may have moved
    n = bigger;
 
    printf("%.0f %d %zu\n", pts[999].x, counts[0], n);
    free(counts);
    free(pts);
    pts = nullptr;           // a later use fails loudly
}

#include <stdint.h>
#include <stdlib.h>
 
// malloc(n * size) without the silent wrap-around
void *alloc_array(size_t n, size_t size) {
    if (size != 0 && n > SIZE_MAX / size) return nullptr;
    return malloc(n * size);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// 1. Caller provides the buffer: no allocation at all
bool format_id(char *buf, size_t cap, int id) {
    int n = snprintf(buf, cap, "user-%04d", id);
    return n >= 0 && (size_t)n < cap;
}
 
// 2. Callee allocates; the comment says who frees.
// Returns a new string, or null. Caller must free() it.
char *make_id(int id) {
    char tmp[32];
    if (!format_id(tmp, sizeof tmp, id)) return nullptr;
    return strdup(tmp);          // C23 (POSIX before)
}
 
// 3. Static buffer: nothing to free, but the next call
//    overwrites it and threads would share it
const char *id_str(int id) {
    static char buf[32];
    return format_id(buf, sizeof buf, id) ? buf : "?";
}
 
int main(void) {
    char a[16];
    if (format_id(a, sizeof a, 7)) puts(a);   // user-0007
    char *b = make_id(8);
    if (b) { puts(b); free(b); }             // user-0008
    puts(id_str(9));                         // user-0009
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
int main(void) {
    char buf[32] = "hello";
    const char *p = buf;
    printf("%zu %zu %zu\n", strlen(buf), sizeof buf,
           sizeof p);                       // 5 32 8
 
    size_t n = strlen(buf) + 1;             // + 1 for '\0'
    char *copy = malloc(n);
    if (!copy) return 1;
    memcpy(copy, buf, n);
 
    // Bounded append: snprintf never writes past the cap
    size_t len = strlen(buf);
    snprintf(buf + len, sizeof buf - len, ", %s", "world");
    printf("%s / %s\n", buf, copy);   // hello, world / hello
    free(copy);
}

#include <string.h>
 
// Copy src into dst[cap] (cap > 0), always terminated.
// Returns false if src was too long and got truncated.
bool str_copy(char *dst, size_t cap, const char *src) {
    size_t n = strlen(src);
    if (n >= cap) {
        memcpy(dst, src, cap - 1);
        dst[cap - 1] = '\0';
        return false;
    }
    memcpy(dst, src, n + 1);
    return true;
}

#include <stddef.h>   // offsetof
#include <stdio.h>
 
struct item {          // offset  size
    char tag;          //   0      1   then 7 bytes padding
    double price;      //   8      8
    int qty;           //  16      4   then 4 bytes padding
};                     // sizeof 24, alignof 8
 
struct item_sorted {   // the same fields, largest first
    double price;      //   0      8
    int qty;           //   8      4
    char tag;          //  12      1   then 3 bytes padding
};                     // sizeof 16
 
int main(void) {
    printf("%zu %zu %zu %zu\n", sizeof(struct item),
           offsetof(struct item, qty), alignof(struct item),
           sizeof(struct item_sorted));   // 24 16 8 16
}

# AddressSanitizer + UBSan: rebuild with checks compiled in
cc -std=c23 -g -O1 -fno-omit-frame-pointer \
   -fsanitize=address,undefined app.c -o app
./app
 
# Valgrind memcheck: no rebuild needed, much slower
cc -std=c23 -g -O0 app.c -o app
valgrind --leak-check=full --track-origins=yes ./app
 
# GCC's static analyzer: finds bugs without running
gcc -std=c23 -fanalyzer -c app.c
 
# Clang's static analyzer over a whole build
scan-build make

$ ./uaf      # free(name); return name[0];
==5727==ERROR: AddressSanitizer: heap-use-after-free on address 0x502000000010 ...
READ of size 1 at 0x502000000010 thread T0
    #0 0x559481caa28d in main uaf.c:9
 
0x502000000010 is located 0 bytes inside of 8-byte region [0x502000000010,0x502000000018)
freed by thread T0 here:
    #0 0x7fc0beefc4d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x559481caa24f in main uaf.c:8
 
previously allocated by thread T0 here:
    #0 0x7fc0beefd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x559481caa23f in main uaf.c:5
 
SUMMARY: AddressSanitizer: heap-use-after-free uaf.c:9 in main

$ gcc -fanalyzer -c df.c
df.c: In function 'process':
df.c:8:5: warning: double-'free' of 'buf' [CWE-415] [-Wanalyzer-double-free]
    8 |     free(buf);
      |     ^~~~~~~~~
  'process': events 1-5
    |    4 |     int *buf = malloc(n * sizeof *buf);
    |      |                (1) allocated here
    |    5 |     if (n > 10) {
    |      |        (2) following 'true' branch (when 'n > 10')...
    |    6 |         free(buf);
    |      |         (3) ...to here
    |      |         (4) first 'free' here
    |    8 |     free(buf);
    |      |     (5) second 'free' here; first 'free' was at (4)

#include <stdio.h>
#include <stdlib.h>
 
// Sum the bytes of a file; returns 0 on success, -1 on error
int checksum(const char *path, unsigned long *out) {
    int rc = -1;
    FILE *f = nullptr;
    unsigned char *buf = nullptr;
    unsigned long sum = 0;
    size_t n;
 
    if (!(f = fopen(path, "rb"))) goto done;
    if (!(buf = malloc(64 * 1024))) goto done;
    while ((n = fread(buf, 1, 64 * 1024, f)) > 0)
        for (size_t i = 0; i < n; i++) sum += buf[i];
    if (ferror(f)) goto done;
    *out = sum;
    rc = 0;
done:
    free(buf);              // reverse order of acquisition
    if (f) fclose(f);
    return rc;
}

#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
 
typedef struct {
    unsigned char *base;
    size_t cap, used;
} Arena;
 
bool arena_init(Arena *a, size_t cap) {
    a->base = malloc(cap);
    a->cap = a->base ? cap : 0;
    a->used = 0;
    return a->base != nullptr;
}
 
// align: a power of two, at most alignof(max_align_t)
void *arena_alloc(Arena *a, size_t size, size_t align) {
    size_t start = (a->used + align - 1) & ~(align - 1);
    if (start > a->cap || size > a->cap - start)
        return nullptr;                 // out of space
    a->used = start + size;
    return a->base + start;
}
 
// n * sizeof(T) can overflow: check n if it is untrusted
#define ARENA_NEW(a, T, n) \
    ((T *)arena_alloc((a), (n) * sizeof(T), alignof(T)))
 
void arena_reset(Arena *a) { a->used = 0; }   // free all
 
void arena_free(Arena *a) {
    free(a->base);
    *a = (Arena){};
}
 
int main(void) {
    Arena a;
    if (!arena_init(&a, 1 << 20)) return 1;   // 1 MiB
    for (int frame = 0; frame < 3; frame++) {
        double *xs = ARENA_NEW(&a, double, 1000);
        char *name = ARENA_NEW(&a, char, 32);
        if (!xs || !name) break;
        snprintf(name, 32, "frame %d", frame);
        xs[999] = frame;
        printf("%s: %zu bytes used\n", name, a.used);
        arena_reset(&a);      // the whole frame, freed
    }
    arena_free(&a);
}

#ifndef COUNTER_H
#define COUNTER_H
 
typedef struct Counter Counter;  // incomplete type
 
Counter *counter_new(const char *name);  // null on failure
void counter_add(Counter *c, long n);
long counter_total(const Counter *c);
void counter_free(Counter *c);           // accepts null
 
#endif

#include <stdlib.h>
#include <string.h>
#include "counter.h"
 
struct Counter {           // only this file sees the fields
    char *name;
    long total;
};
 
Counter *counter_new(const char *name) {
    Counter *c = malloc(sizeof *c);
    if (!c) return nullptr;
    c->name = strdup(name);
    if (!c->name) { free(c); return nullptr; }
    c->total = 0;
    return c;
}
 
void counter_add(Counter *c, long n) { c->total += n; }
long counter_total(const Counter *c) { return c->total; }
 
void counter_free(Counter *c) {
    if (!c) return;
    free(c->name);         // free what it owns, then itself
    free(c);
}

#include <stdint.h>
#include <stdlib.h>
#include <string.h>
 
typedef struct {
    size_t len;
    unsigned char bytes[];  // flexible array member (C99)
} Blob;
 
// Returns a new Blob holding a copy of src; free() it.
Blob *blob_new(const void *src, size_t len) {
    if (len > SIZE_MAX - sizeof(Blob)) return nullptr;
    Blob *b = malloc(sizeof *b + len);   // header + data
    if (!b) return nullptr;
    b->len = len;
    memcpy(b->bytes, src, len);
    return b;
}

#include <stddef.h>
 
// dst and src must not overlap
void axpy(size_t n, float a, float *restrict dst,
          const float *restrict src) {
    for (size_t i = 0; i < n; i++) dst[i] += a * src[i];
}

#include <signal.h>
#include <stdio.h>
 
static volatile sig_atomic_t stop = 0;
 
static void on_sigint(int) { stop = 1; }   // C23: unnamed
 
int main(void) {
    signal(SIGINT, on_sigint);
    unsigned long long ticks = 0;
    while (!stop) ticks++;        // Ctrl-C ends the loop
    printf("\nstopped after %llu ticks\n", ticks);
}

#include <inttypes.h>
#include <stdio.h>
#include <string.h>
 
uint32_t float_bits(float f) {
    uint32_t u;
    static_assert(sizeof u == sizeof f);
    memcpy(&u, &f, sizeof u);   // defined; compiles to a
    return u;                   // single register move
    // return *(uint32_t *)&f;  // UB: strict aliasing
}
 
int main(void) {
    printf("%08" PRIX32 "\n", float_bits(1.0f)); // 3F800000
}

#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
 
typedef struct {
    alignas(64) long hits;   // its own 64-byte cache line
} PerThreadCounter;
 
int main(void) {
    printf("%zu %zu\n", alignof(max_align_t),
           sizeof(PerThreadCounter));          // 16 64
 
    // 64-byte aligned, for SIMD or to avoid false sharing
    void *p = aligned_alloc(64, 64 * 16);  // size: k * 64
    if (!p) return 1;
    printf("%d\n", (uintptr_t)p % 64 == 0);    // 1
    free(p);
}

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
 
typedef struct {
    int *data;
    size_t len, cap;
} IntVec;
 
// Appends x. Returns false (v unchanged) if out of memory.
bool vec_push(IntVec *v, int x) {
    if (v->len == v->cap) {
        size_t cap = v->cap ? v->cap * 2 : 8;
        if (cap > SIZE_MAX / sizeof *v->data) return false;
        int *p = realloc(v->data, cap * sizeof *v->data);
        if (!p) return false;
        v->data = p;
        v->cap = cap;
    }
    v->data[v->len++] = x;
    return true;
}
 
// Bounds-checked read: false if i is out of range.
bool vec_get(const IntVec *v, size_t i, int *out) {
    if (i >= v->len) return false;
    *out = v->data[i];
    return true;
}
 
void vec_free(IntVec *v) {
    free(v->data);
    *v = (IntVec){};          // data = null, len = cap = 0
}
 
int main(void) {
    IntVec v = {};
    for (int i = 0; i < 100; i++)
        if (!vec_push(&v, i * i)) { vec_free(&v); return 1; }
    int x;
    if (vec_get(&v, 99, &x)) printf("%d\n", x);    // 9801
    printf("len %zu cap %zu\n", v.len, v.cap); // 100 128
    vec_free(&v);
}

#include <stdio.h>
#include <stdlib.h>
 
typedef struct Node {
    int value;
    struct Node *next;
} Node;
 
// Inserts at *link; returns false if out of memory.
bool list_push(Node **link, int value) {
    Node *n = malloc(sizeof *n);
    if (!n) return false;
    *n = (Node){.value = value, .next = *link};
    *link = n;
    return true;
}
 
// Inserts keeping the list in ascending order.
bool list_insert_sorted(Node **head, int value) {
    Node **link = head;
    while (*link && (*link)->value < value)
        link = &(*link)->next;
    return list_push(link, value);
}
 
// Removes the first node holding value; true if found.
bool list_remove(Node **head, int value) {
    for (Node **link = head; *link; link = &(*link)->next) {
        if ((*link)->value == value) {
            Node *dead = *link;
            *link = dead->next;       // unlink, then free
            free(dead);
            return true;
        }
    }
    return false;
}
 
void list_free(Node **head) {
    Node *n = *head;
    while (n) {
        Node *next = n->next;         // read before free
        free(n);
        n = next;
    }
    *head = nullptr;
}
 
int main(void) {
    Node *head = nullptr;
    int xs[] = {5, 1, 4, 2, 3};
    for (size_t i = 0; i < 5; i++)
        if (!list_insert_sorted(&head, xs[i])) break;
    list_remove(&head, 4);
    for (Node *n = head; n; n = n->next)
        printf("%d ", n->value);      // 1 2 3 5
    putchar('\n');
    list_free(&head);
}

#include <stdio.h>
#include <stdlib.h>
 
// Reads all of f into a new buffer with a '\0' after the
// data. Returns null on error. Caller frees the result.
char *read_all(FILE *f, size_t *len_out) {
    size_t cap = 4096, len = 0;
    char *buf = malloc(cap);
    if (!buf) return nullptr;
    for (;;) {
        len += fread(buf + len, 1, cap - len - 1, f);
        if (len < cap - 1) break;     // end of file or error
        char *tmp = realloc(buf, cap * 2);
        if (!tmp) { free(buf); return nullptr; }
        buf = tmp;
        cap *= 2;
    }
    if (ferror(f)) { free(buf); return nullptr; }
    buf[len] = '\0';    // handy for text; data may hold 0s
    if (len_out) *len_out = len;
    return buf;
}
 
int main(int argc, char *argv[]) {
    FILE *f = argc > 1 ? fopen(argv[1], "rb") : stdin;
    if (!f) { perror(argv[1]); return 1; }
    size_t len = 0;
    char *data = read_all(f, &len);
    if (f != stdin) fclose(f);
    if (!data) { perror("read"); return 1; }
    printf("%zu bytes\n", len);
    free(data);
}

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
 
typedef struct {
    size_t rows, cols;
    double data[];    // rows * cols values, row after row
} Matrix;
 
// Zero-filled rows x cols matrix, or null. free() it.
Matrix *mat_new(size_t rows, size_t cols) {
    size_t room = SIZE_MAX - sizeof(Matrix);
    room /= sizeof(double);      // most doubles that fit
    if (cols != 0 && rows > room / cols) return nullptr;
    size_t n = rows * cols;
    Matrix *m = calloc(1, sizeof *m + n * sizeof m->data[0]);
    if (!m) return nullptr;
    m->rows = rows;
    m->cols = cols;
    return m;
}
 
static inline double *mat_at(Matrix *m, size_t r,
                             size_t c) {
    return &m->data[r * m->cols + c];
}
 
int main(void) {
    Matrix *a = mat_new(2, 3);
    if (!a) return 1;
    for (size_t r = 0; r < a->rows; r++)
        for (size_t c = 0; c < a->cols; c++)
            *mat_at(a, r, c) = (double)(r * 10 + c);
    printf("%g\n", *mat_at(a, 1, 2));    // 12
    free(a);                             // one free
}

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
 
typedef struct { float x, y, vx, vy; } Particle;
 
typedef union Slot {      // a free slot holds the link,
    union Slot *next;     // a used one holds the object
    Particle item;
} Slot;
 
typedef struct {
    Slot *slots;
    Slot *free_list;
} Pool;
 
bool pool_init(Pool *p, size_t n) {
    *p = (Pool){};
    if (n == 0 || n > SIZE_MAX / sizeof(Slot)) return false;
    p->slots = malloc(n * sizeof *p->slots);
    if (!p->slots) return false;
    for (size_t i = 0; i + 1 < n; i++)    // chain the slots
        p->slots[i].next = &p->slots[i + 1];
    p->slots[n - 1].next = nullptr;
    p->free_list = p->slots;
    return true;
}
 
Particle *pool_alloc(Pool *p) {           // O(1)
    Slot *s = p->free_list;
    if (!s) return nullptr;               // pool exhausted
    p->free_list = s->next;
    return &s->item;
}
 
void pool_release(Pool *p, Particle *item) {   // O(1)
    Slot *s = (Slot *)item;   // a union and its members
    s->next = p->free_list;   // share one address
    p->free_list = s;
}
 
void pool_destroy(Pool *p) {
    free(p->slots);           // every object at once
    *p = (Pool){};
}
 
int main(void) {
    Pool pool;
    if (!pool_init(&pool, 1024)) return 1;
    Particle *a = pool_alloc(&pool);
    Particle *b = pool_alloc(&pool);
    if (!a || !b) return 1;
    *a = (Particle){.x = 1, .vx = 0.5f};
    pool_release(&pool, a);
    Particle *c = pool_alloc(&pool);   // reuses a's slot
    printf("%d\n", c == a);            // 1
    pool_destroy(&pool);
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void free_tokens(char **toks) {
    if (!toks) return;
    for (char **t = toks; *t; t++) free(*t);
    free(toks);
}
 
// Splits s at every sep. Returns a null-terminated array of
// new strings (free with free_tokens), or null on failure.
char **split(const char *s, char sep) {
    size_t n = 1;
    for (const char *c = s; *c; c++) n += (*c == sep);
    char **toks = calloc(n + 1, sizeof *toks);  // + null
    if (!toks) return nullptr;
    const char delim[2] = {sep, '\0'};
    for (size_t i = 0; i < n; i++) {
        size_t len = strcspn(s, delim);
        toks[i] = strndup(s, len);           // C23
        if (!toks[i]) { free_tokens(toks); return nullptr; }
        s += len + 1;
    }
    return toks;
}
 
int main(void) {
    char **parts = split("red,green,,blue", ',');
    if (!parts) return 1;
    for (size_t i = 0; parts[i]; i++)
        printf("[%s] ", parts[i]); // [red] [green] [] [blue]
    putchar('\n');
    free_tokens(parts);
}