Page History

...

In this example, the memory referred to by x may freed twice: once if error_condition is true and again at the end of the code.

int *x = malloc (number * sizeof(int));
if (x == NULL) {
  /* Handle Allocation Error */
}
if (error_conditon == 1) {
  /* Handle Error Condition*/
  free(x);
}
/* ... */
free(x);

Compliant Solution 1

Only free a pointer to dynamic memory referred to by x once. For this example this can be accomplished by removing the call to free() in the section of code executed when error_condition is true.

int *x = malloc (number * sizeof(int));
if (x == NULL) {
  /* Handle Allocation Error */
}
if (error_conditon == 1) {
  /* Handle Error Condition*/
}
/* ... */
free(x);

References

VU#623332 http://www.kb.cert.org/vuls/id/623332
MIT krb5 Security Advisory 2005-003 http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-003-recvauth.txt
OWASP Double Free http://www.owasp.org/index.php/Double_Free