...
In this compliant solution, the integer values passed as size arguments to memory allocation functions are of the correct size and have not been altered due to integer overflow or truncation. (See INT32-C. Ensure that operations on signed integers do not result in overflow and INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data.)
| Code Block | ||||
|---|---|---|---|---|
| ||||
enum { BLOCKSIZE = 16 };
/* ... */
void *alloc_blocks(size_t num_blocks) {
if (num_blocks == 0 || num_blocks > SIZE_MAX / BLOCKSIZE)
return NULL;
return malloc(num_blocks * BLOCKSIZE);
}
|
...
This example also checks for unsigned integer overflow in compliance with INT32-C. Ensure that operations on signed integers do not result in overflow.
Compliant Solution (Size Calculation)
...
Tool | Version | Checker | Description | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Include Page | LDRA_V | LDRA_V | 487 S | Fully implemented. | |||||||||||||
Fortify SCA | V. 5.0 |
| Can detect violations of this rule with CERT C Rule Pack, except those involving the | ||||||||||||||
| Include Page | Coverity_V | Coverity_V | SIZECHECK | Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block. | |||||||||||||
| Include Page | Coverity_V | Coverity_V | BAD_ALLOC_STRLEN | Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary. | Compass/ROSE |
|
| could check violations of this rule by examining the size expression to
| |||||||||
| BAD_ALLOC_STRLEN
| Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary. Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block. | |||||||||||||||
Fortify SCA | 5.0 |
| Can detect violations of this rule with CERT C Rule Pack, except those involving the | ||||||||||||||
| 487 S | Fully implemented. |
Related Vulnerabilities
CVE-2009-0587 results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. An attacker could thereby execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow [xorl 2009].
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
...
...
ISO/IEC TR 24772 "XYB Buffer overflow in heap"
...
| TR 24772:2013 | Buffer Overflow in Heap [XYB] |
| MITRE CWE | CWE-190, |
...
| Integer overflow (wrap or wraparound) |
...
...
...
| -131, |
...
| Incorrect calculation of buffer size |
...
Bibliography
[Coverity 2007]
[Seacord 2005] Chapter 4, "Dynamic Memory Management," and Chapter 5, "Integer Security"
[xorl 2009] CVE-2009-0587: Evolution Data Server Base64 Integer Overflows
...