Which pointer may be passed to free?

Which pointer may be passed to free?

1. The still-valid pointer returned by malloc, or NULL.
2. Any pointer to an element inside a malloc block.
3. A pointer to an automatic array after its block ends.
4. The old pointer saved before a successful realloc.