
...
Referencing an object outside of its lifetime can result in an attacker being able to execute arbitrary code.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
---|---|---|---|---|---|---|
DCL30-C | High | Probable | No | HighNo | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | |||||||
---|---|---|---|---|---|---|---|---|---|---|
Astrée |
| pointered-deallocation return-reference-local | Fully checked | |||||||
Axivion Bauhaus Suite |
| CertC-DCL30 | Fully implemented | |||||||
CodeSonar |
| LANG.STRUCT.RPL | Returns pointer to local | |||||||
Compass/ROSE | Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope, would be difficult | |||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary | ||||||||
Cppcheck |
| danglingLifetime | Fully implemented | |||||||
Cppcheck Premium |
| danglingLifetime | Fully implemented | |||||||
Helix QAC |
| C3217, C3225, C3230, C4140 C++2515, C++2516, C++2527, C++2528, C++4026, C++4624, C++4629 | Fully implemented | |||||||
Klocwork |
| LOCRET.ARG | Fully implemented | |||||||
LDRA tool suite |
| 42 D, 77 D, 71 S, 565 S | Enhanced Enforcement | |||||||
Parasoft C/C++test |
| CERT_C-DCL30-a | The address of an object with automatic storage shall not be returned from a function | |||||||
PC-lint Plus |
| 604, 674, 733, 789 | Partially supported | |||||||
Polyspace Bug Finder |
| Checks for pointer or reference to stack variable leaving scope (rule fully covered) | ||||||||
PVS-Studio |
| V506, V507, V558, V623, V723, V738 | ||||||||
RuleChecker |
| return-reference-local | Partially checked | |||||||
Security Reviewer - Static Reviewer | 6.02 | C18 C176 C177 C178 C179 | Fully implemented | |||||||
Splint |
| |||||||||
TrustInSoft Analyzer |
| dangling_pointer | Exhaustively detects undefined behavior (see one compliant and one non-compliant example). |
...
DCL30-C = Union( CWE-562, list) where list =
- Assigning a stack pointer to an argument (thereby letting it outlive the current function
Bibliography
[Coverity 2007] | |
[ISO/IEC 9899:2024] | 6.2.4, "Storage Durations of Objects" |
...