Page History

...

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Rule	Severity	Likelihood	Detectable	RepairableRemediation Cost	Priority	Level
MEM35-C	High	Probable	No	HighNo	P6	L2

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

Supported, but no explicit checker

malloc-size-insufficient

Partially checked

Besides direct rule violations, all undefined behaviour resulting from invalid memory accesses is reported by Astrée.

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-MEM35

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
IO.TAINT.SIZE
MISC.MEM.SIZE.BAD
LANG.MEM.BO
LANG.MEM.BU
LANG.STRUCT.PARITH
LANG.STRUCT.PBB
LANG.STRUCT.PPE
LANG.MEM.TBA
LANG.MEM.TO
LANG.MEM.TU

Addition overflow of allocation size
Addition overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Tainted allocation size
Unreasonable size argument
Buffer Overrun
Buffer Underrun
Pointer Arithmetic
Pointer Before Beginning of Object
Pointer Past End of Object
Tainted Buffer Access
Type Overrun
Type Underrun

Compass/ROSE

Could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Coverity

Include Page

	Coverity_V
	Coverity_V

BAD_ALLOC_STRLEN

SIZECHECK (deprecated)

Partially implemented

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

premium-cert-mem35-c

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C0696, C0701, C1069, C1071, C1073, C2840

DF2840, DF2841, DF2842, DF2843, DF2935, DF2936, DF2937, DF2938

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

INCORRECT.ALLOC_SIZE
SV.TAINTED.ALLOC_SIZE

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

400 S, 487 S, 115 D

Enhanced enforcement

Splint 3.1.1

Parasoft C/C++test

Include Page

c:

	Parasoft_V

c:

	Parasoft_V

MRM-45Partially implementedPolyspace Bug Finder

CERT_C-MEM35-a

Do not use sizeof operator on pointer type to specify the size of the memory to be allocated via 'malloc', 'calloc' or 'realloc' function

PC-lint Plus

Include Page

	PC-lint Plus_V
	PC-lint Plus_V

433, 826

Partially supported

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule MEM35-C

Checks for:

Pointer access out of bounds

R2016a

Memory allocation with tainted size

, Pointer access out of bounds, Wrong type used in sizeof

Size argument to memory function is from an unsecure source

Pointer dereferenced outside its bounds

sizeof argument does not match pointer type

Rule partially covered.

PVS-Studio

Include Page

	PVS-Studio_V
	PVS-Studio_V

V531, V635, V781

RuleChecker

Include Page

	RuleChecker_V
	RuleChecker_V

malloc-size-insufficient

Partially checked

Security Reviewer - Static Reviewer

Include Page

	Security Reviewer - Static Reviewer_V
	Security Reviewer - Static Reviewer_V

CPP_039

Fully implemented

TrustInSoft Analyzer

Include Page

	TrustInSoft Analyzer_V
	TrustInSoft Analyzer_V

mem_access

Exhaustively detects undefined behavior (see one compliant and one non-compliant example).

PRQA QA-C Include PagePRQA QA-C_vPRQA QA-C_v0696, 0701, 1069, 1071, 1073 PRQA QA-C++4.2 2840, 2841, 2842, 2843, 2844

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Key here (explains table format and definitions)

Taxonomy	Taxonomy item	Relationship
CERT C Secure Coding Standard	ARR01-C. Do not apply the sizeof operator to a pointer when taking the size of an array INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard	INT32-C. Ensure that operations on signed integers do not result in overflow	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard	INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C Secure Coding Standard	MEM04-C. Beware of zero-length allocations	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772:2013	Buffer Boundary Violation (Buffer Overflow) [HCB]	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TS 17961:2013	Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr]	Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11	CWE-131, Incorrect Calculation of Buffer Size	2017-05-16: CERT: Rule subset of CWE
CWE 2.11	CWE-680	2017-05-18: CERT: Rule subset of CWE
CWE 2.11	CWE-789	2017-06-12: CERT: Partial overlap

CERT-CWE Mapping Notes

Key here for mapping notes

...

Space shortcuts

Page tree

Versions Compared

Old Version 175

New Version Current

Key

Automated Detection

Related Vulnerabilities

CERT-CWE Mapping Notes