Page History

...

In this noncompliant code example, the local variable s1space is passed as the expression to the placement new operator. The resulting pointer of that call is then passed to ::operator delete(), resulting in undefined behavior due to ::operator delete() attempting to free memory that was not returned by ::operator new().

#include <iostream>
 
struct S {
  S() { std::cout << "S::S()" << std::endl; }
  ~S() { std::cout << "S::~S()" << std::endl; }
};
 
void f() {
  alignas(struct S s1) char space[sizeof(struct S)];
  S *s2s1 = new (&s1space) S;
 
  // ...
 
  delete s2s1;
}

Compliant Solution (placement new())

This compliant solution removes the call to ::operator delete(), allowing s1 to be destroyed as a result of its normal object lifetime terminationinstead explicitly calling s1's destructor. This is one of the few times when explicitly invoking a destructor is warranted.

#include <iostream>
 
struct S {
  S() { std::cout << "S::S()" << std::endl; }
  ~S() { std::cout << "S::~S()" << std::endl; }
};
 
void f() {
  alignas(struct S) s1;
  S *s2char space[sizeof(struct S)];
  S *s1 = new (&s1space) S;
 
  // ...

  s1->~S();
}

Noncompliant Code Example (Uninitialized delete)

...

void f() {
  int *array = new int[10];
  // ...
  delete array;
}

Compliant Solution (array new[])

In the compliant solution, the code is fixed by replacing the call to delete with a call to delete [] to adhere to the correct pairing of memory allocation and deallocation functions.

void f() {
  int *array = new int[10];
  // ...
  delete[] array;
}

...

Passing a pointer value to a deallocation function that was not previously obtained by the matching allocation function results in undefined behavior, which can lead to exploitable vulnerabilities.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...