...
According to the C Standard, 6.2.4, paragraph 2 [ISO/IEC 9899:20112024],
The lifetime of an object is the portion of program execution during which storage is guaranteed to be reserved for it. An object exists, has a constant address, and retains its last-stored value throughout its lifetime. If an object is referred to outside of its lifetime, the behavior is undefined. The value of If a pointer becomes indeterminate when value is used in an evaluation after the object it the pointer points to (or just past) reaches the end of its lifetime, the behavior is undefined.
Do not attempt to access an object outside of its lifetime. Attempting to do so is undefined behavior and can lead to an exploitable vulnerability. (See also undefined behavior 9 in the C Standard, Annex J.)
...
Referencing an object outside of its lifetime can result in an attacker being able to execute arbitrary code.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
DCL30-C | High | Probable | No | HighNo | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| pointered-deallocation return-reference-local | Fully checked | ||||||||||||||||
| Axivion Bauhaus Suite |
| CertC-DCL30 | Fully implemented | ||||||||||||||||
| CodeSonar |
| LANG.STRUCT.RPL | Returns pointer to local | ||||||||||||||||
| Compass/ROSE | Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope, would be difficult | ||||||||||||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary | |||||||||||||||||
| Cppcheck |
| danglingLifetime | |||||||||||||||||
| Cppcheck Premium |
| danglingLifetime | |||||||||||||||||
| Helix QAC |
| C3217, C3225, C3230, C4140 C++2515, C++2516, C++2527, C++2528, C++4026, C++4624, C++4629 | Fully implemented | ||||||||||||||||
| Klocwork |
| LOCRET.ARG | Fully implemented | ||||||||||||||||
| LDRA tool suite |
| 42 D, 77 D, 71 S, 565 S | Enhanced Enforcement | ||||||||||||||||
| Parasoft C/C++test |
| CERT_C-DCL30-a | The address of an object with automatic storage shall not be returned from a function | ||||||||||||||||
| PC-lint Plus |
| 604, 674, 733, 789 | Partially supported | ||||||||||||||||
| Polyspace Bug Finder |
| Checks for pointer or reference to stack variable leaving scope (rule fully covered) | PRQA QA-C | ||||||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 3217, 3225, 3230, 4140 | Partially implemented | PRQA QA-C++ | ||||||||||||||
| Include Page | cplusplus:PRQA QA-C++_V | cplusplus:PRQA QA-C++_V||||||||||||||||||
2515, 2516, 2527, 2528, 4026, 4624, 4629 | PVS-Studio |
| V506, V507, V558, V623, V723, V738 | ||||||||||||||||
| RuleChecker |
| return-reference-local | Partially checked | ||||||||||||||||
| Splint |
| ||||||||||||||||||
| TrustInSoft Analyzer |
| dangling_pointer | Exhaustively detects undefined behavior (see one compliant and one non-compliant example). |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
DCL30-C = Union( CWE-562, list) where list =
- Assigning a stack pointer to an argument (thereby letting it outlive the current function
Bibliography
| [Coverity 2007] | |
| [ISO/IEC 9899:20112024] | 6.2.4, "Storage Durations of Objects" |
...