realloc() in C: Resizing Dynamic Arrays Without Losing Data

0s7 min★ 30 XP

Lesson 53Mixed lesson

realloc() in C: Resizing Dynamic Arrays Without Losing Data

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format12 sections1 video2 code blocks1 practice itemUpdated Aug 27, 2026

You allocated an array for 10 elements. Now you need 20. Without realloc, you allocate a new block, copy the old data, free the old block, and update your pointer. realloc does all of that in one call. If the heap has room to extend the existing block, it does so in place with no copy. If not, it allocates a new block, copies, frees the old, and returns the new address. Either way, your data survives.

realloc Basics

#Growing a Dynamic Array#link

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int capacity = 4;
    int *arr = malloc(capacity * sizeof(int));
    if (arr == NULL) return 1;

    for (int i = 0; i < capacity; i++) {
        arr[i] = i + 1;
    }

    printf("Before realloc (cap=%d): ", capacity);
    for (int i = 0; i < capacity; i++) printf("%d ", arr[i]);
    printf("\n");

    int new_capacity = 8;
    int *tmp = realloc(arr, new_capacity * sizeof(int));
    if (tmp == NULL) {
        fprintf(stderr, "realloc failed\n");
        free(arr);
        return 1;
    }
    arr = tmp;
    capacity = new_capacity;

    for (int i = 4; i < capacity; i++) {
        arr[i] = i + 1;
    }

    printf("After realloc  (cap=%d): ", capacity);
    for (int i = 0; i < capacity; i++) printf("%d ", arr[i]);
    printf("\n");

    free(arr);
    return 0;
}

Run realloc_grow

root@vulnarex:~#gcc -Wall -fsanitize=address realloc_grow.c -o realloc_grow && ./realloc_grow

#The Critical Pattern: Use a Temporary Pointer#link

Never write arr = realloc(arr, new_size). If realloc fails, it returns NULL. Your original pointer is overwritten with NULL. The old block is still allocated but you have lost the only reference to it. That is a memory leak and a dangling situation simultaneously. Always assign to a temporary, check for NULL, then update the original.

STRICT SECURE AUDIT RULE

arr = realloc(arr, size) is the most common realloc bug in C code. It leaks memory on failure and leaves you with a NULL pointer. The temporary-variable pattern (tmp = realloc(arr, size); if (tmp) arr = tmp;) costs one extra line and eliminates the bug entirely.

#Shrinking and realloc(NULL, size)#link

realloc can shrink a block. The excess data is discarded. Passing NULL as the first argument is equivalent to malloc: realloc(NULL, size) allocates a new block. Passing 0 as the size is implementation-defined: it may free the block and return NULL, or return a unique pointer. Avoid relying on either behavior.

★ 30 XP

quiz BLOCK (★ 30 XP)

Why should you assign realloc's return value to a temporary pointer instead of directly to the original?

Select your proof vectors above

realloc is the foundation of dynamic arrays, string builders, and any data structure that grows at runtime. The temporary-pointer pattern is non-negotiable. Next: a security vulnerability specific to realloc that appears in real CVEs.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 30 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

Growing a Dynamic Array The Critical Pattern: Use a Temporary Pointer Shrinking and realloc(NULL, size)

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "https://vulnarex.com/api/content/lessons?courseSlug=c-programming-tutorials&lessonSlug=53-realloc-basics&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

#include <stdio.h>

#include <stdlib.h>

int main(void) {

int capacity = 4;

int *arr = malloc(capacity * sizeof(int));

if (arr == NULL) return 1;

for (int i = 0; i < capacity; i++) {

arr[i] = i + 1;

}

printf("Before realloc (cap=%d): ", capacity);

for (int i = 0; i < capacity; i++) printf("%d ", arr[i]);

printf("\n");

int new_capacity = 8;

int *tmp = realloc(arr, new_capacity * sizeof(int));

if (tmp == NULL) {

fprintf(stderr, "realloc failed\n");

free(arr);

return 1;

}

arr = tmp;

capacity = new_capacity;

for (int i = 4; i < capacity; i++) {

arr[i] = i + 1;

}

printf("After realloc (cap=%d): ", capacity);

for (int i = 0; i < capacity; i++) printf("%d ", arr[i]);

printf("\n");

free(arr);

return 0;

}