Windows provides several APIs for allocating memory. While some of these functions have converged over time, it is still important to always properly pair allocations and deallocations. The following table shows the proper pairings.
| Allocator | Deallocator |
|---|---|
malloc() | free() |
realloc() | free() |
LocalAlloc() | LocalFree() |
LocalReAlloc() | LocalFree() |
GlobalAlloc() | GlobalFree() |
GlobalReAlloc() | GlobalFree() |
VirtualAlloc() | VirtualFree() |
VirtualAllocEx() | VirtualFreeEx() |
VirtualAllocExNuma() | VirtualFreeEx() |
AllocateUserPhysicalPages() | FreeUserPhysicalPages() |
AllocateUserPhysicalPagesNuma() | FreeUserPhysicalPages() |
HeapAlloc() | HeapFree() |
HeapReAlloc() | HeapFree() |
Noncompliant Code Example
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
LPTSTR buf;
DWORD n = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS, 0, GetLastError(),
LANG_USER_DEFAULT, (LPTSTR)&buf, 1024, 0);
if (n != 0) {
/* Format and display the error to the user */
GlobalFree(buf);
}
|
Compliant Solution
The compliant solution uses the proper deallocation function as described by the documentation.
| Code Block | ||||
|---|---|---|---|---|
| ||||
LPTSTR buf;
DWORD n = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS, 0, GetLastError(),
LANG_USER_DEFAULT, (LPTSTR)&buf, 1024, 0);
if (n != 0) {
/* Format and display the error to the user */
LocalFree(buf);
}
|
Risk Assessment
Mixing allocation and deallocation functions can lead to memory corruption issues, or result in accessing out-of-bounds memory.
Rule | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
WIN30-C | Low | Probable |
No | No |
P2 |
L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported: Can be checked with appropriate analysis stubs. | |||||||
| CodeSonar |
| ALLOC.TM | Type |
| mismatch | |||||||||
| Coverity |
| ALLOC_FREE_MISMATCH (needs improvement) | Partially implemented; needs improvement | ||||||
| Klocwork |
| FMM.MIGHT FMM.MUST | |||||||
| Parasoft C/C++test |
| CERT_C-WIN30-a | Ensure resources are freed | ||||||
| CERT C: Rule WIN30-C | Checks for mismatched alloc/dealloc functions on Windows (rule fully covered) | |||||||
| PVS-Studio |
| V701 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard |
| MEM51-CPP. |
...
...