...
Setting pointers to NULL or to another valid value after memory is freed is a simple and easily implemented solution for reducing dangling pointers. Dangling pointers can result in freeing memory multiple times or in writing to memory that has already been freed. Both of these problems can lead to an attacker executing arbitrary code with the permissions of the vulnerable process.
Recommendation | Severity | Likelihood |
|---|
Detectable | Repairable | Priority | Level |
|---|---|---|---|
MEM01-C | High | Unlikely | Yes |
Yes | P9 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||
|---|---|---|---|---|---|---|---|
| Astrée |
|
| Supported: Astrée reports usage of invalid pointers. | |||||||||
| Axivion Bauhaus Suite |
| CertC-MEM01 | Fully implemented | ||||||
| CodeSonar |
| ALLOC.DF | Double free | ||||||
| Compass/ROSE |
| USE_AFTER_FREE | Can detect the specific instances where memory is deallocated more than once or read/written to the target of a freed pointer | |||||||
| Helix QAC |
| C3005 | |||||||
| LDRA tool suite |
| 484 S, 112 D | Partially implemented | ||||||
| Parasoft C/C++test |
|
|
|
CERT_C-MEM01-a | Do not use resources that have been freed |
| Parasoft Insure++ |
| Detects dangling pointers at runtime | |||||||||
| CERT C: Rec. MEM01-C | Checks for missing reset of a freed pointer (rec. fully covered) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
| SEI CERT C++ Coding Standard | VOID MEM01-CPP. Store a valid value in pointers immediately after deallocation |
| ISO/IEC TR 24772:2013 | Dangling References to Stack Frames [DCM] Dangling Reference to Heap [XYK] Off-by-one Error [XZH] |
| MITRE CWE | CWE-415, Double free CWE-416, Use after free |
Bibliography
| [Seacord 2013] | Chapter 4, "Dynamic Memory Management" |
| [Plakosh 2005] |
...
...