The behavior of malloc(0) is implementation defined by the standard. The two legal possibilities are to return a null pointer or a unique pointer. In many implementations, the second option is accomplished by means of internally increasing the length to 1 (which is then likely rounded up to 16 or so). Legally, one cannot deference this pointer, although in practice some bytes are allocated which means that won’t crash.