...
If both size_t and unsigned long long types are represented as a 64-bit unsigned value, the result of the multiplication operation may not be representable as an unsigned long long value. See guideline INT35-C. Evaluate integer expressions in a larger size before comparing or assigning to that size for more information on upcasting.
...
In this compliant solution, the integer values passed as size arguments to memory allocation functions are of the correct size and have not been altered due to integer overflow or truncation. (See guidelines INT32-C. Ensure that operations on signed integers do not result in overflow) or truncation ( and INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data.).
| Code Block | ||
|---|---|---|
| ||
enum { BLOCKSIZE = 16 };
/* ... */
void *alloc_blocks(size_t num_blocks) {
if (num_blocks == 0 || num_blocks > SIZE_MAX / BLOCKSIZE)
return NULL;
return malloc(num_blocks * BLOCKSIZE);
}
|
This example checks the value of num_blocks to make sure the subsequent multiplication operation cannot result in an integer overflow. The code also ensures that num_blocks is not equal to zero. (see See guideline MEM04-C. Do not perform zero length allocations.).
Noncompliant Code Example (Range Checking)
...
| Code Block | ||
|---|---|---|
| ||
size_t len;
char *str;
char buf[BUFF_SIZE];
/* ... */
if (len < BUFF_SIZE){
memcpy(buf, str, len);
}
/* ... */
|
See guideline INT01-C. Use rsize_t or size_t for all integer values representing the size of an object for more information on representing the size of objects.
...
This example also checks for unsigned integer overflow in compliance with guideline INT32-C. Ensure that operations on signed integers do not result in overflow.
...
The code also ensures that len is not equal to zero. (see See guideline MEM04-C. Do not perform zero length allocations.).
Risk Assessment
Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MEM35-C | high | probable | high | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description |
|---|---|---|---|
|
...
|
...
|
|
...
|
...
|
|
|
...
|
|
|
...
|
...
|
|
|
|
Related Vulnerabilities
| Wiki Markup |
|---|
[CVE-2009-0587|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0587] results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. Thus, an attacker could execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow \[[xorl 2009|http://xorl.wordpress.com/2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/]\]. |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
Related Guidelines
This rule appears in the C++ Secure Coding Standard as : MEM35-CPP. Allocate sufficient memory for an object.
Bibliography
| Wiki Markup |
|---|
\[[Coverity 072007|AA. Bibliography#Coverity 07]\] \[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.20.3, "Memory Management Functions" \[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "XYB Buffer Overflow in Heap" \[[MITRE 072007|AA. Bibliography#MITRE 07]\] [CWE ID 190|http://cwe.mitre.org/data/definitions/190.html], "Integer Overflow (Wrap or Wraparound)," and [CWE ID 131|http://cwe.mitre.org/data/definitions/131.html], "Incorrect Calculation of Buffer Size" \[[Seacord 052005|AA. Bibliography#Seacord 05]\] Chapter 4, "Dynamic Memory Management," and Chapter 5, "Integer Security" \[[xorl 2009|AA. Bibliography#xorl 2009]\] ["CVE-2009-0587: Evolution Data Server Base64 Integer Overflows"|http://xorl.wordpress.com/2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/] |
...