A simple test case shows the problem when compiled with -lmalloc:
% cat main.c
#include <stdio.h>
#include <stdlib.h>
int
main() {
void *p1 = valloc(16);
printf("p1 = 0x%lx\n", p1 );
free( p1 );
return 0;
}
% cc -o main -lmalloc main.c
% main
p1 = 0x22000
Segmentation Fault (core dumped)
The reason for that is that vallos is used from libc.so and allocates memory
from its heap. Free is used from libmalloc.so and it frees an arbitrary pointer
from its heap's point of view.