Page History

...

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Rule	Severity	Likelihood	Detectable	RepairableRemediation Cost	Priority	Level
MEM35-C	High	Probable	No	HighNo	P6	L2

Automated Detection

, C2841, C2842, C2843, C2935, C2936, C2937, C2938C++2840, C++2841, C++2842, C++2843, C++2935, C++2936, C++2937, C++2938 fully covered.2840, 2841, 2842, 2843, 2935, 2936, 2937, 2938

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

malloc-size-insufficient

Partially checked

Besides direct rule violations, all undefined behaviour resulting from invalid memory accesses is reported by Astrée.

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-MEM35

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
ALLOC.SIZE.TRUNC
IO.TAINT.SIZE
MISC.MEM.SIZE.BAD
LANG.MEM.BO
LANG.MEM.BU
LANG.STRUCT.PARITH
LANG.STRUCT.PBB
LANG.STRUCT.PPE
LANG.MEM.TBA
LANG.MEM.TO
LANG.MEM.TU

Addition overflow of allocation size
Addition overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Truncation of allocation size
Tainted allocation size
Unreasonable size argument
Buffer Overrun
Buffer Underrun
Pointer Arithmetic
Pointer Before Beginning of Object
Pointer Past End of Object
Tainted Buffer Access
Type Overrun
Type Underrun

Compass/ROSE

Could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Coverity

Include Page

	Coverity_V
	Coverity_V

BAD_ALLOC_STRLEN

SIZECHECK (deprecated)

Partially implemented

Can find instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

premium-cert-mem35-c

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C0696, C0701, C1069, C1071, C1073, C2840

DF2840, DF2841, DF2842, DF2843, DF2935, DF2936, DF2937, DF2938

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

INCORRECT.ALLOC_SIZE
SV.TAINTED.ALLOC_SIZE

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

400 S, 487 S, 115 D

Enhanced enforcement

Splint 3.1.1

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-MEM35-a

Do not use sizeof operator on pointer type to specify the size of the memory to be allocated via 'malloc', 'calloc' or 'realloc' function

PC-lint Plus

Include Page

	PC-lint Plus_V
	PC-lint Plus_V

433, 826

Partially supported

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule MEM35-C

Checks for:

Pointer access out of bounds
Memory allocation with tainted size

Rule

PRQA QA-C

Include Page

PRQA QA-C_v PRQA QA-C_v 0696, 0701, 1069, 1071, 1073, 2840, 2841, 2842, 2843, 2935, 2936, 2937, 2938 PRQA QA-C++

Include Page

cplusplus:PRQA QA-C++_V

partially covered.

PVS-Studio

Include Page

	PVS-Studio_V
	PVS-Studio_V

V531, V635, V781

RuleChecker

Include Page

	RuleChecker_V
	RuleChecker_V

malloc-size-insufficient

Partially checked

TrustInSoft Analyzer

Include Page

	TrustInSoft Analyzer_V
	TrustInSoft Analyzer_V

mem_access

Exhaustively detects undefined behavior (see one compliant and one non-compliant example).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Space shortcuts

Page tree

Versions Compared

Old Version 201

New Version Current

Key

Automated Detection

Related Vulnerabilities