Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

If both size_t and unsigned long long types are represented as a 64-bit unsigned value, the result of the multiplication operation may not be representable as an unsigned long long value. See guideline INT35-C. Evaluate integer expressions in a larger size before comparing or assigning to that size for more information on upcasting.

...

In this compliant solution, the integer values passed as size arguments to memory allocation functions are of the correct size and have not been altered due to integer overflow or truncation. (See guidelines INT32-C. Ensure that operations on signed integers do not result in overflow) or truncation ( and INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data.).

Code Block
bgColor#ccccff
enum { BLOCKSIZE = 16 };
/* ... */
void *alloc_blocks(size_t num_blocks) {
  if (num_blocks == 0 || num_blocks > SIZE_MAX / BLOCKSIZE)
    return NULL;
  return malloc(num_blocks * BLOCKSIZE);
}

This example checks the value of num_blocks to make sure the subsequent multiplication operation cannot result in an integer overflow. The code also ensures that num_blocks is not equal to zero. (see See guideline MEM04-C. Do not perform zero length allocations.).

Noncompliant Code Example (Range Checking)

...

Code Block
bgColor#ccccff
size_t len;
char *str;
char buf[BUFF_SIZE];

/* ... */
if (len < BUFF_SIZE){
  memcpy(buf, str, len);
}
/* ... */

See guideline INT01-C. Use rsize_t or size_t for all integer values representing the size of an object for more information on representing the size of objects.

...

This example also checks for unsigned integer overflow in compliance with guideline INT32-C. Ensure that operations on signed integers do not result in overflow.

...

The code also ensures that len is not equal to zero. (see See guideline MEM04-C. Do not perform zero length allocations.).

Risk Assessment

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

MEM35-C

high

probable

high

P6

L2

Automated Detection

Tool

Version

Checker

Description

Section

Fortify SCA

...

Section

V. 5.0

...

 

Section

can detect violations of this rule with CERT C Rule Pack, except those involving the sizeof operator

...

Section

...

Coverity Prevent

Include Page
c:Coverity_V
c:Coverity_V
Section

SIZECHECK

Section

finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

...

Section

Coverity Prevent

Include Page
c:Coverity_V
c:Coverity_V
Section

BAD_ALLOC_STRLEN

...

Section

can find the instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule so further verification is necessary

...

Section

Compass/ROSE

 

 

Section

could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is:

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Related Vulnerabilities

Wiki Markup
[CVE-2009-0587|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0587] results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. Thus, an attacker could execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow \[[xorl 2009|http://xorl.wordpress.com/2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/]\].

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

Related Guidelines

This rule appears in the C++ Secure Coding Standard as : MEM35-CPP. Allocate sufficient memory for an object.

Bibliography

Wiki Markup
\[[Coverity 072007|AA. Bibliography#Coverity 07]\]
\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.20.3, "Memory Management Functions"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "XYB Buffer Overflow in Heap"
\[[MITRE 072007|AA. Bibliography#MITRE 07]\] [CWE ID 190|http://cwe.mitre.org/data/definitions/190.html], "Integer Overflow (Wrap or Wraparound)," and [CWE ID 131|http://cwe.mitre.org/data/definitions/131.html], "Incorrect Calculation of Buffer Size"
\[[Seacord 052005|AA. Bibliography#Seacord 05]\] Chapter 4, "Dynamic Memory Management," and Chapter 5, "Integer Security"
\[[xorl 2009|AA. Bibliography#xorl 2009]\] ["CVE-2009-0587: Evolution Data Server Base64 Integer Overflows"|http://xorl.wordpress.com/2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/]

...