title: Why is malloc really non-deterministic? (Linux/Unix)
body: <p><em>malloc</em> is not guaranteed to return 0'ed memory. The conventional wisdom is not only that, but that the contents of the memory <em>malloc</em> returns are actually <a href="http://en.wiktionary.org/wiki/non-determinism" rel="nofollow">non-deterministic</a>, e.g. <a href="http://lists.debian.org/debian-security-announce/2008/msg00152.html" rel="nofollow">openssl used them for extra randomness</a>.</p>
  
  <p>However, as far as I know, <em>malloc</em> is built on top of <em>brk/sbrk</em>, which do "return" 0'ed memory. <strong>I can see why the contents of what <em>malloc</em> returns may be non-0</strong>, e.g. from previously <em>free</em>'d memory, but why would they be <a href="http://en.wiktionary.org/wiki/non-determinism" rel="nofollow">non-deterministic</a> in "normal" single-threaded software?</p>
  
  <ol>
  <li>Is the conventional wisdom really true (assuming the same binary and libraries)</li>
  <li>If so, Why?</li>
  </ol>
  
  <p><strong>Edit</strong> Several people answered explaining why the memory can be non-0, which I already explained in the question above. What I'm asking is why the program using the contents of what malloc returns may be non-deterministic, i.e. why it could have different behavior every time it's run (assuming the same binary and libraries). <strong>Non-deterministic behavior is not implied by non-0's.</strong> To put it differently: why it could have different contents every time the binary is run.</p>