Page History

...

the pointer argument to the free or realloc function does not match a pointer earlier returned by calloc, malloc, or realloca memory management function, or the space has been deallocated by a call to free or realloc.

Freeing memory that is not allocated dynamically can lead to serious errors similar to those discussed in MEM31-C. Free dynamically allocated memory exactly once. The specific consequences of this error depend on the implementation, but they range from nothing to abnormal program termination. Regardless of the implementation, avoid calling free() on anything other than a pointer returned by a dynamic-memory allocation function, such as malloc(), calloc(), or realloc(), or aligned_alloc.

A similar situation arises when realloc() is supplied a pointer to nondynamically allocated memory. The realloc() function is used to resize a block of dynamic memory. If realloc() is supplied a pointer to memory not allocated by a memory allocation function, such as malloc(), the program may terminate abnormally.

...

MITRE CWE: CWE-590, "Free of Invalid Pointer Not invalid pointer not on the Heapheap"

Bibliography

[Seacord 2005] Chapter 4, "Dynamic Memory Management"

...