...
In this noncompliant code example, the memory referred to by x may be freed twice: once if error_condition is true and again at the end of the code.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
int f(size_t n) {
int error_condition = 0;
int *x = (int*)malloc(n * sizeof(int));
if (x == NULL)
return -1;
/* Use x and set error_condition on error. */
if (error_condition == 1) {
/* Handle error condition*/
free(x);
}
/* ... */
free(x);
return error_condition;
}
|
...
In this compliant solution, the free a referenced by x is only freed once. This is accomplished by eliminating the call to free() when error_condition is set.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
int f(size_t n) {
int error_condition = 0;
if (n > SIZE_MAX / sizeof(int)) {
errno = EOVERFLOW;
return -1;
}
int *x = (int*)malloc(n * sizeof(int));
if (x == NULL) {
/* Report allocation failure to caller. */
return -1;
}
/* Use x and set error_condition on error. */
if (error_condition != 0) {
/* Handle error condition and proceed. */
}
free(x);
return error_condition;
}
|
...
The memory referenced by p may be freed twice in this noncompliant code example.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* p is a pointer to dynamically allocated memory */
p2 = realloc(p, size);
if (p2 == NULL) {
free(p); /* p may be indeterminate when (size == 0) */
return;
}
|
...
- Glibc (GNU/Linux)
- AIX
- HP-UX
- Solaris
- OSF/1
This means that In nonconforming implementations, calling free on the original pointer might result in a double-free vulnerability. However, not calling free on the original pointer might result in a memory leak.
...
In this compliant solution, allocations of zero bytes are prevented, ensuring that p is freed exactly once.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* p is a pointer to dynamically allocated memory */
if (size) {
p2 = realloc(p, size);
if (p2 == NULL) {
free(p);
return;
}
}
else {
free(p);
return;
}
|
...
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE | |||||||||
| RESOURCE_LEAK USE_AFTER_FREE | Finds resource leaks from variables that go out of scope while owning a resource. Can find the instances where a freed memory is freed again. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary. | |||||||
Fortify SCA | 5.0 | Double Free | |||||||
| MLK | ||||||||
| 484 S | Fully implemented. | |||||||
Splint |
|
...
| [ISO/IEC 9899:2011] | Section 7.22.3, "Memory Management Functions" |
| [MIT 2005] | |
| [OWASP Double Free] | "Double Free" |
| [Viega 2005] | "Doubly Freeing Memory" |
| [VU#623332] |
...