...
| Code Block | ||||
|---|---|---|---|---|
| ||||
char *secret; const size_t SECRET_MAX = /* ... */ /* Initialize secret to a null-terminated byte string, of less than SECRETSIZE_MAX chars */ size_t size = strlen(secret); if (size >= SECRET_MAX) { /* Handle error */ } char *new_secret; new_secret = (char *)malloc(size+1); if (!new_secret) { /* Handle error */ } strcpy(new_secret, secret); /* Process new_secret... */ free(new_secret); new_secret = NULL; |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
harchar *secret; const size_t SECRET_MAX = /* ... */ /* Initialize secret to a null-terminated byte string, of less than SECRETSIZE_MAX chars */ size_t size = strlen(secret); if (size >= SECRET_MAX) { /* Handle error */ } char *new_secret; /* Use calloc() to zero-out allocated space */ new_secret = (char *)calloc(size+1, sizeof(char)); if (!new_secret) { /* Handle error */ } strcpy(new_secret, secret); /* Process new_secret... */ /* Sanitize memory */ memset_s(new_secret, '\0', size); free(new_secret); new_secret = NULL; |
...
Recommendation | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
MEM03-C | Medium | Unlikely | No | HighYes | P2P4 | L3 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| (customization) | Users can add a custom check for use of realloc(). | |||||||||||||
| Compass/ROSE | Could detect possible violations of this rule by first flagging any usage of | |||||||||||||||
| Helix QAC |
| C5010 | ||||||||||||||
| LDRA tool suite |
| 44 S | Enhanced Enforcement | |||||||||||||
| Parasoft C/C++test |
| CERT_C-MEM03-a | Sensitive data should be cleared before being deallocated | |||||||||||||
| Polyspace Bug Finder | R2016a
| Checks for:
| Sensitive data not cleared or released by memory routine Variable in stack is not cleared and contains sensitive data | PRQA QA-C | ||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | Rec. partially covered. | |||||||||||||
| PVS-Studio |
| V1072 | ||||||||||||||
| Security Reviewer - Static Reviewer |
| CPP_07 | Fully | 5010 | Partiallyimplemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...