scanf calling malloc without free - c

Question

I was trying to replace the standard library functions malloc and free with my own versions to detect memory leak. I did this through dynamic linking:
// malloc.c
#include <stddef.h>
#include <stdlib.h>
#include <unistd.h>
#ifndef __GLIBC__
#error glibc must be used.
#endif
extern void *__libc_malloc(size_t size);
extern void *__libc_free(void *ptr);
void *malloc(size_t size) {
const char msg[] = "malloc called.\n";
void *ptr = __libc_malloc(size);
if (ptr != NULL)
write(STDOUT_FILENO, msg, sizeof(msg) - 1);
return ptr;
}
void free(void *ptr) {
const char msg[] = "free called.\n";
if (ptr != NULL)
write(STDOUT_FILENO, msg, sizeof(msg) - 1);
__libc_free(ptr);
}
Compiled with
gcc -shared malloc.c -o libmalloc.so -fpic
Then I wrote another C program:
// hello.c
#include <stdio.h>
#include <stdlib.h>
int compare_less(const void *a_, const void *b_) {
const int a = *(const int *)a_, b = *(const int *)b_;
return a < b ? -1 : (a == b ? 0 : 1);
}
int main() {
int n;
scanf("%d", &n);
int *a = malloc(sizeof(int) * n);
for (int i = 0; i != n; ++i) {
scanf("%d", a + i);
}
qsort(a, n, sizeof(int), &compare_less);
for (int i = 0; i < n - 1; ++i)
printf("%d, ", a[i]);
printf("%d\n", a[n - 1]);
free(a);
return 0;
}
and link them by
gcc hello.c -o hello -L. -lmalloc
When I run ./hello, I found that malloc called. was printed three times: during the first call to scanf, during the direct call to malloc, and during the second call to scanf. However free called. was only printed once.
I added a breakpoint at malloc and GDB backtrace shows the following:
(gdb) bt
#0 malloc (size=1024) at malloc.c:12
#1 0x00007ffff7df2c24 in __GI__IO_file_doallocate (fp=0x7ffff7f8daa0 <_IO_2_1_stdin_>) at ./libio/filedoalloc.c:101
#2 0x00007ffff7e01d60 in __GI__IO_doallocbuf (fp=fp#entry=0x7ffff7f8daa0 <_IO_2_1_stdin_>) at ./libio/libioP.h:947
#3 0x00007ffff7e00d5c in _IO_new_file_underflow (fp=0x7ffff7f8daa0 <_IO_2_1_stdin_>) at ./libio/fileops.c:485
#4 0x00007ffff7e01e16 in __GI__IO_default_uflow (fp=0x7ffff7f8daa0 <_IO_2_1_stdin_>) at ./libio/libioP.h:947
#5 0x00007ffff7dd7150 in __vfscanf_internal (s=<optimized out>, format=<optimized out>, argptr=argptr#entry=0x7fffffffdfb0, mode_flags=mode_flags#entry=2)
at ./stdio-common/vfscanf-internal.c:628
#6 0x00007ffff7dd61c2 in __isoc99_scanf (format=<optimized out>) at ./stdio-common/isoc99_scanf.c:30
#7 0x000055555555525e in main () at hello.c:11
It seems that scanf calls malloc to allocate memory for its buffer, but I did not see scanf calling free. However, valgrind shows that all heap blocks were freed, so that memory must have been freed somehow.
My questions:
How is the memory allocated by scanf deallocated?
If I want to record the calls to malloc and free from users' code only (i.e. ignoring those from standard libraries like scanf), what should I do?