The types of integer expressions used as size arguments to
aligned_alloc() must have sufficient range to represent the size of the objects to be stored. If size arguments are incorrect or can be manipulated by an attacker, then a buffer overflow may occur. Incorrect size arguments, inadequate range checking, integer overflow, or truncation can result in the allocation of an inadequately sized buffer.
Typically, the amount of memory to allocate will be the size of the type of object to allocate. When allocating space for an array, the size of the object will be multiplied by the bounds of the array. When allocating space for a structure containing a flexible array member, the size of the array member must be added to the size of the structure. (See MEM33-C. Allocate and copy structures containing a flexible array member dynamically.) Use the correct type of the object when computing the size of memory to allocate.
STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator is a specific instance of this rule.
Noncompliant Code Example (Pointer)
In this noncompliant code example, inadequate space is allocated for a
struct tm object because the size of the pointer is being used to determine the size of the pointed-to object:
Compliant Solution (Pointer)
In this compliant solution, the correct amount of memory is allocated for the
struct tm object. When allocating space for a single object, passing the (dereferenced) pointer type to the
sizeof operator is a simple way to allocate sufficient memory. Because the
sizeof operator does not evaluate its operand, dereferencing an uninitialized or null pointer in this context is well-defined behavior.
Noncompliant Code Example (Integer)
In this noncompliant code example, an array of
long is allocated and assigned to
p. The code attempts to check for unsigned integer overflow in compliance with INT30-C. Ensure that unsigned integer operations do not wrap and also ensures that
len is not equal to zero. (See MEM04-C. Beware of zero-length allocations.) However, because
sizeof(int) is used to compute the size, and not
sizeof(long), an insufficient amount of memory can be allocated on implementations where
sizeof(long) is larger than
sizeof(int), and filling the array can cause a heap buffer overflow.
Compliant Solution (Integer)
This compliant solution uses
sizeof(long) to correctly size the memory allocation:
Compliant Solution (Integer)
sizeof(*p) can be used to properly size the allocation:
Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.
Besides direct rule violations, all undefined behaviour resulting from invalid memory accesses is reported by Astrée.
Addition overflow of allocation size
Could check violations of this rule by examining the size expression to
Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary
Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block
|LDRA tool suite|
|400 S, 487 S, 115 D||Enhanced enforcement|
Do not use sizeof operator on pointer type to specify the size of the memory to be allocated via 'malloc', 'calloc' or 'realloc' function
|Polyspace Bug Finder|
Rule fully covered.
|0696, 0701, 1069, 1071, 1073|
2840, 2841, 2842, 2843, 2844,
2935, 2936, 2937, 2938, 2939
|V531, V635, V641, V781|
Exhaustively detects undefined behavior (see one compliant and one non-compliant example).
Key here (explains table format and definitions)
|CERT C Secure Coding Standard||ARR01-C. Do not apply the sizeof operator to a pointer when taking the size of an array|
INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data
|Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C Secure Coding Standard||INT32-C. Ensure that operations on signed integers do not result in overflow||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C Secure Coding Standard||INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C Secure Coding Standard||MEM04-C. Beware of zero-length allocations||Prior to 2018-01-12: CERT: Unspecified Relationship|
|ISO/IEC TR 24772:2013||Buffer Boundary Violation (Buffer Overflow) [HCB]||Prior to 2018-01-12: CERT: Unspecified Relationship|
|ISO/IEC TS 17961:2013||Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr]||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CWE 2.11||CWE-131, Incorrect Calculation of Buffer Size||2017-05-16: CERT: Rule subset of CWE|
|CWE 2.11||CWE-680||2017-05-18: CERT: Rule subset of CWE|
|CWE 2.11||CWE-789||2017-06-12: CERT: Partial overlap|
CERT-CWE Mapping Notes
Key here for mapping notes
CWE-680 and MEM35-C
Intersection( INT32-C, MEM35-C) = Ø
CWE-680 = Union( MEM35-C, list) where list =
- Overflowed buffers with inadequate sizes not produced by integer overflow
CWE-467 and MEM35-C
CWE-467 = Subset( MEM35-C)
CWE-789 and MEM35-C
Intersection( MEM35-C, CWE-789) =
- Insufficient memory allocation on the heap
MEM35-C – CWE-789 =
- Insufficient memory allocation with trusted value but incorrect calculation
CWE-789 - MEM35-C =
- Sufficient memory allocation (possibly over-allocation) with untrusted value
CWE-120 and MEM35-C
Intersection( MEM35-C, CWE-120) = Ø
CWE-120 specifically addresses buffer overflow operations, which occur in the context of string-copying. MEM35-C specifically addresses allocation of memory ranges (some of which may be for subsequent string copy operations).
Consequently, they address different sections of code, although one (or both) may be responsible for a single buffer overflow vulnerability.
CWE-131 and MEM35-C
- Intersection( INT30-C, MEM35-C) = Ø
- CWE-131 = Union( MEM35-C, list) where list =
- Miscalculating a buffer for a non-heap region (such as a variable-length array)
|[Drepper 2006]||Section 2.1.1, "Respecting Memory Bounds"|
|[Seacord 2013]||Chapter 4, "Dynamic Memory Management"|
Chapter 5, "Integer Security"
|[Viega 2005]||Section 5.6.8, "Use of |
|[xorl 2009]||CVE-2009-0587: Evolution Data Server Base64 Integer Overflows|