...
Failing to free memory can result in the exhaustion of system memory resources, which can lead to a denial-of-service attack.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
MEM31-C | Medium | Probable | No | MediumNo | P8P4 | L2L3 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported, but no explicit checker | ||||||||||||||||||||
| Axivion Bauhaus Suite |
| CertC-MEM31 | Can detect dynamically allocated resources that are not freed | |||||||||||||||||||
| CodeSonar |
| ALLOC.LEAK | Leak | |||||||||||||||||||
| Compass/ROSE | ||||||||||||||||||||||
| RESOURCE_LEAK ALLOC_FREE_MISMATCH | Finds resource leaks from variables that go out of scope while owning a resource | ||||||||||||||||||||
| Cppcheck |
| memleak leakReturnValNotUsed leakUnsafeArgAlloc memleakOnRealloc | ||||||||||||||||||||
| Cppcheck Premium |
| memleak leakReturnValNotUsed leakUnsafeArgAlloc memleakOnRealloc | leakReturnValNotUsed | Doesn't use return value of memory allocation function | ||||||||||||||||||
| Helix QAC |
| C2706DF2706, | C2707DF2707, | C2708DF2708 | C++2706, C++ | 2707, C++2708, C++3337, C++3338 | ||||||||||||||||
| Klocwork |
| MLKCL.FFM. | MIGHTASSIGN | MLKCL.FFM. | MUSTCOPY | MLKCL. | RETSHALLOW. | MUSTASSIGN | MLK.RETCL.SHALLOW.COPY FMM.MIGHT FMM.MUST | |||||||||||||
| LDRA tool suite |
| 50 D | Partially implemented | |||||||||||||||||||
| Parasoft C/C++test |
| CERT_C-MEM31-a | Ensure resources are freed | |||||||||||||||||||
| Parasoft Insure++ | Runtime analysis | |||||||||||||||||||||
| PC-lint Plus |
| 429 | Fully supported | |||||||||||||||||||
| Polyspace Bug Finder |
| CERT C: Rule MEM31-C | Checks for memory leak (rule fully covered) | |||||||||||||||||||
| PRQA QAPVS-CStudio |
| 2706, 2707, 2708 | PRQA QA-C++ | |||||||||||||||||||
| Include Page | cplusplus:PRQA QA-C++_V | cplusplus:PRQA QA-C++_V | 2706, 2707, 2708, 3337, 3338 | PVS-Studio | ||||||||||||||||||
| Include Page | PVS-Studio_V | PVS-Studio_V | V773
| V773 | ||||||||||||||||||
| Security Reviewer - Static Reviewer |
| CPP_17 CPP_18 CPP_22 CPP_23 CPP_24 CPP_25 CPP_26 CPP_27 | Fully implemented | |||||||||||||||||||
| SonarQube C/C++ Plugin |
| S3584 | ||||||||||||||||||||
| Splint |
| |||||||||||||||||||||
| TrustInSoft Analyzer |
| malloc | Exhaustively verified. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
CWE-404 = Union( FIO42-C, MEM31-C list) where list =
- Failure to free resources besides files or memory chunks, such as mutexes)
Bibliography
| [ISO/IEC 9899:20112024] | Subclause 7.2224.3, "Memory Management Functions" |
...