Raw Heap String - c

Question

I'm trying to wrap my head around the concept of heap-management in C. The following code compiles w/o warnings and runs w/o errors.
char* string_make(char* text) {
size_t len = strlen(text) + 1;
char* str = malloc(len);
memcpy(str, text, len);
return str;
}
char* string_concat(char* x, char* y) {
size_t len_x = strlen(x);
size_t len_y = strlen(y);
x = realloc(x, len_x + len_y + 1);
memcpy(x+len_x, y, len_y+1);
return x;
}
int main (int argc, char const *argv[]) {
char* first = string_make("funny");
char* second = string_make(" duck");
char* third = string_make("! c++");
//
printf("%s\n", string_concat(first, second));
printf("%s\n", string_concat(first, third));
//
free(first);
free(second);
free(third);
}
I have a couple of questions:
Is string_make() doing anything illegal or undefined?
Is string_concat() doing anything illegal or undefined?
I just want to create a simple heap string, which could be increased/decreased at different stages of program as per requirements.
Thanks.
EDIT:
If I change string_concat() calls in main to the following:
first = string_concat(first, second);
first = string_concat(first, third);
would it make things legit?

Answer 1

string_make is fine.
string_concat is not. It reallocates x, which possibly means that a bigger chunk of memory is allocated elsewhere, and the original chunk of memory is marked as free. However, functions in C do not change their arguments, therefore when string_concat returns, x possibly points to a location which is marked as free.

Answer 2

Ignoring error checking (after malloc and realloc), all you need to do is replace these two lines in main:
printf("%s\n", string_concat(first, second));
printf("%s\n", string_concat(first, third));
with these lines
first = string_concat(first, second);
printf("%s\n", first);
first = string_concat(first, third);
printf("%s\n", first);
The reason is that arguments are passed by value in C. So updating x in the string_concat does not update variable first in main. So the code needs to update first using the return value from the function.
Now, you may be confused because you tested your code and it seemed to work. That's because your final string was only 16 bytes, including the NUL terminator. Most modern implementations of malloc will round up the size to a multiple of 16 (or some larger power of 2). That means that all three calls to string_make returned pointers to memory regions of 16 bytes, even though you requested less. And that also means that realloc can expand the buffer without moving it. As the man page explains
If there is not enough room to enlarge the memory allocation
pointed to by ptr, realloc() creates a new allocation, copies as much
of the old data pointed to by ptr as will fit to the new allocation,
frees the old allocation, and returns a pointer to the allocated
memory.
In your case, there was enough room to enlarge the memory allocation, so realloc returned the same pointer that was passed in. And as a result, your code would appear to work even though it has a serious flaw.

Answer 3

string_concat(): If using realloc() I would pass the address of the pointer to the string which has to be realloc-ed, but return the reallocated string itself. So I would avoid the return value pointing at location possibly marked as free. In case realloc returns NULL, function returns pointer to the original string.
char* string_concat(char** x, char* y) {
size_t len_x = strlen(*x);
size_t len_y = strlen(y);
char *temp = realloc(*x, len_x + len_y + 1);
if(!temp) return *x; //or do some more appropriate error handling
memcpy(temp+len_x, y, len_y+1);
*x = temp;
return *x;
}
and
printf("%s\n", string_concat(&first, second));
printf("%s\n", string_concat(&first, third));
free(first);
free(second);
free(third);
It is well explained here.