How the heap stores your allocation

Where the metadata sits, how much space is really used, and how free/delete work from just the pointer p.

⚠ The crux: two different "sizes"

Header offset = a fixed constant hard-coded in the allocator (e.g. 16 bytes). Not stored — the allocator's own code knows it. That's why free(p) can compute p - headerSize from just p.

Block size = how big this allocation is. This is stored, inside the header. free uses the fixed offset to find the header, then reads the block size from it.

1. malloc + free C

YOUR DATAraw bytes, e.g. malloc(4)
NOT initialized

PADDINGalignment

▲ p − headerSize
(header lives here)

▲ p (malloc returns this)

malloc(4) reserves HEADER + 4 bytes + padding; returns p pointing at your data.
free(p): go to p − headerSize (fixed offset), read the block size, return the whole chunk to the free list.
No constructor, no destructor. malloc/free only move raw memory.

2. new + delete C++

YOUR OBJECTconstructor HAS run
e.g. new Entity()

PADDINGalignment

▲ p − headerSize

▲ p (new returns this)

new Entity() = operator new (usually calls malloc → same header layout) + runs the constructor on the object.
delete p: runs the destructor first (on the object at p), THEN frees the chunk exactly like free (p − headerSize → read size → free list).
So layout is the same as malloc; new/delete just add ctor/dtor on top.

3. new[] + delete[] C++ arrays

elem[0]ctor ran

elem[1] …ctor ran

PAD

▲ allocator header

▲ p − cookieSize

▲ p (points at elem[0])

new Entity[n] stores an extra count cookie (the value n) just before the first element, at a fixed compiler-defined offset.
delete[] p: read n from p − cookieSize, run the destructor n times (elem n−1 … elem 0), THEN free the whole block.
Plain delete p here skips the count → wrong number of destructors + allocator confusion = undefined behaviour. That's why new[] needs delete[].

Note: for simple types like int[] (no destructor) some compilers skip the count cookie — but for objects with destructors it's always there. Exact header/cookie sizes are allocator- and compiler-specific; the shapes above are the idea, not exact byte counts.

The pairing rule (never cross these)

malloc ↔ free • new ↔ delete • new[] ↔ delete[]. Crossing them (e.g. free on a new pointer) skips the destructor and can mismatch allocators → corruption / UB.