title: dlmalloc's mspace_malloc returns strange addresses
body: <p>[I've solved this problem--please see my last comment below.]</p>
  
  <p>In my application, I need to use my own special malloc, based on Doug Lea's dlmalloc:  I map an anonymous file (using mmap), create an mspace out of part of the mapped file, and pass the mspace to mspace_malloc.  I am finding that some of the addresses that mspace_malloc returns are not within the bounds of the mapped file--even though, as far as I can tell, the process can write to and read from the malloc'ed memory just fine.  Why am I encountering this behavior, and what can I do to force mspace_malloc to return an address within the range of the mspace?</p>
  
  <pre><code>/* Inside dl_malloc.c */
  
  #define ONLY_MSPACES 1
  #define MSPACES 1
  
  void * heap;
  off_t heap_length;
  mspace ms;
  
  void init(size_t size) {
    heap = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    if (heap == MAP_FAILED) {
      perror("init: mmap");
      exit(EXIT_FAILURE);
    }
    heap_length = size;
    ms = create_mspace(heap, size, 0);
    mspace_track_large_chunks(ms, 1);
  }
  
  void * my_malloc(size_t bytes) {
    return mspace_malloc(heap, bytes);
  }
  /************************/
  
  
  /* In application */
  #include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #define HEAP_SIZE 0x10000  // 32 pages
  #define ROWS 2
  #define COLS 4096
  
  extern void init(void);
  extern void * my_malloc(size_t bytes);
  
  extern void * heap;
  extern off_t heap_length;
  
  int main(void) {
    init(HEAP_SIZE);
    int ** matrix = (int **)my_malloc(sizeof(int *) * ROWS);
    int i;
    for (i = 0; i &lt; ROWS; ++i)
      matrix[i] = (int *)my_malloc(sizeof(int) * COLS);
  
    printf("Heap bounds: %lx to %lx\n",
      (off_t)heap, (off_t)heap + heap_length);
    printf("Matrix: %p  ", matrix;
    for (i = 0; i &lt; ROWS; ++i)
      printf("Matrix[%d]: %p  ", i, matrix[i]");
    printf("\n");
  
    return EXIT_SUCCESS;
  }
  </code></pre>
  
  <p>When I run this program (well, the above is a simplification, but not by much), I see that the address assigned to matrix is within the bounds printed for the heap, but that the two addresses for the two rows are very far <em>below</em> the lower bound--more than 0x100000000 below it!  And yet I seem to be able to read and write to the matrix.  This last point I find puzzling and would like to understand, but the more urgent issue is that I need to do something to make sure that all the addresses that my_malloc returns are within the heap bounds, because other parts of my application need this.</p>
  
  <p>BTW, note that I do not need to lock my call to create_mspace, since I'm only using one thread in this program.  Anyway, I tried setting this argument to 1, but I saw no difference in the results.</p>
  
  <p>Thanks!</p>