How does free () know how many bytes to free?

The malloc/free Implementation remembers the size of each block as it is allocated, so it is not necessary to remind it of the size when freeing.

Typically,the size is stored adjacent to the allocated block,which is why things usually break badly if the bounds of the allocated block are even slightly overstepped.