...
Referencing an object outside of its lifetime can result in an attacker being able to run arbitrary code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP54-CPP | High | Probable | High | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Clang |
| -Wdangling-initializer-list | Catches some lifetime issues related to incorrect use of std::initializer_list<> | ||||||
| CodeSonar |
| IO.UAC | Use after close Use after free | ||||||
| Klocwork |
| CL.FFM.ASSIGN |
| LDRA tool suite |
| 42 D, 53 D, 77 D, 1 J, 71 S, 565 S | Partially implemented | ||||||
| Parasoft C/C++test |
|
|
| BD-RES-FREE |
| Parasoft Insure++ |
| Runtime detection |
| PRQA QA-C++ | 9.1 | 2812, 2813, 2814, 2930, 2931, 2932, 2933, 2934, 4003, 4026 |
| PVS-Studio | 6.22 | V758 | General analysis rule |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Bibliography
| [Coverity 2007] |
| [ISO/IEC 14882-2014] | Subclause 3.8, "Object Lifetime" Subclause 8.5.4, "List-Initialization" |
...