Page History

Integer values The types of integer expressions used as a size argument arguments to malloc(), calloc(), realloc(), or aligned_alloc() must be of sufficient size to contain have sufficient range to represent the size of the objects to be stored. If size arguments are incorrect or can be manipulated by an attacker, then a buffer overflow may occur. Incorrect size arguments, inadequate range checking, integer overflow, or truncation can result in the allocation of an inadequately sized buffer.

Typically, the amount of memory to allocate will be the size of the type of object to allocate. When allocating space for an array, the size of the object will be multiplied by the bounds of the array. When allocating space for a structure containing a flexible array member, the size of the array member must be added to the size of the structure (see MEM33-C. Allocate and copy structures containing a flexible array member dynamically). Use the correct type of the object when computing the size of chunk memory to allocate.

STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator is a specific instance of this rule.

...

In this noncompliant code example, an array of long is allocated and assigned to p. The code checks for unsigned integer overflow in compliance with INT32-C. Ensure that operations on signed integers do not result in overflow and also ensures that len is not equal to zero (see MEM04-C. Beware of zero-length allocations). ) UnfortunatelyHowever, because sizeof(int) is used to size the allocated memorycompute the size, and not sizeof(long), an insufficient amount of memory can be allocated on implementations where sizeof(long) is larger than sizeof(int) .

#include <stdint.h>
#include <stdlib.h>
 
void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(long)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(int));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Compliant Solution (Integer)

...

#include <stdint.h>
#include <stdlib.h>

void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(long)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(long));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Compliant Solution (Integer)

...

#include <stdint.h>
#include <stdlib.h>
 
void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(*p)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(*p));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Noncompliant Code Example (Pointer)

In this noncompliant code example, inadequate space is allocated for a struct tm object because the size of the pointer is being used to determine the size of the pointed-to object.:

#include <stdlib.h>
#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(tmb));
  if (tmb == NULL) {
    return NULL;
  }
  tmb->tm*tmb = (struct tm) {
    .tm_sec = sec;
  tmb->tm, .tm_min = min;
  tmb->tm, .tm_hour = hour;,
  tmb->tm  .tm_mday = day;
  tmb->tm, .tm_mon = mon;
  tmb->tm, .tm_year = year
  };
  return return tmb;
}

Compliant Solution (Pointer)

 In this compliant solution, the correct amount of memory is allocated for the struct tm object. When allocating  space for a single object, passing the (dereferenced) pointer type to the sizeof operator is a simple way to allocate sufficient memory. Because the sizeof operator does not evaluate its operand, dereferencing an uninitialized or null pointer in this context is well-defined behavior.

#include <stdlib.h>
#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(*tmb));
  if (tmb == NULL) {
    return NULL;
  }
   tmb->tm*tmb = (struct tm) {
    .tm_sec = sec;
  tmb->tm, .tm_min = min;
  tmb->tm, .tm_hour = hour;,
  tmb->tm    .tm_mday = day;
  tmb->tm, .tm_mon = mon;
  tmb->tm, .tm_year = year
  };
  return tmb;
}

Risk Assessment

...

if (a < SIZE_MAX / b && a > 0) ...

...

Bibliography

...