Dynamic memory management is a common source of programming flaws that can lead to security vulnerabilities. Decisions regarding how dynamic memory is allocated, used, and deallocated are the burden of the programmer. Poor memory management can lead to security issues such as heap-buffer overflows, dangling pointers, and double-free issues [Seacord 05]. From the programmer's perspective, memory management involves allocating memory, reading and writing to memory, and deallocating memory.
The following rules and recommendations are designed to reduce the common errors associated with memory management. These guidelines address common misunderstandings and errors in memory management that lead to security vulnerabilities.
These guidelines apply to the following standard memory management routines described in C99 Section 7.20.3:
void *malloc(size_t size); void *calloc(size_t nmemb, size_t size); void *realloc(void *ptr, size_t size); void free(void *ptr);
The specific characteristics of these routines are based on the compiler used. With a few exceptions, this document considers only the general and compiler-independent attributes of these routines.
Recommendations
MEM00-A. Allocate and free memory in the same module, at the same level of abstraction
MEM01-A. Set pointers to dynamically allocated memory to NULL after they are released
MEM02-A. Do not cast the return value from malloc()
MEM03-A. Clear sensitive information stored in dynamic memory prior to deallocation
MEM04-A. Do not make assumptions about the result of allocating 0 bytes
MEM05-A. Avoid large stack allocations
MEM06-A. Do not use user-defined functions as parameters to allocation routines
MEM07-A. Ensure that size arguments to calloc() do not result in an integer overflow
Rules
MEM30-C. Do not access freed memory
MEM31-C. Free dynamically allocated memory exactly once
MEM32-C. Detect and handle critical memory allocation errors
MEM33-C. Do not assume memory allocation routines initialize memory
MEM34-C. Only free memory allocated dynamically
MEM35-C. Allocate sufficient memory for an object
MEM38-C. Use Flexible Array Members for dynamically sized structures
MEM39-C. Allocate sufficient memory for an object
Risk Assessment Summary
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
MEM00-A |
3 (high) |
2 (probable) |
1 (high) |
P6 |
L2 |
MEM01-A |
3 (high) |
2 (probable) |
3 (low) |
P18 |
L1 |
MEM02-A |
1 (low) |
1 (unlikely) |
3 (low) |
P3 |
L3 |
MEM03-A |
2 (medium) |
1 (unlikely) |
3 (low) |
P6 |
L2 |
MEM04-A |
3 (high) |
2 (probable) |
2 (medium) |
P12 |
L1 |
MEM05-A |
1 (low) |
1 (unlikely) |
2 (medium) |
P2 |
L3 |
MEM06-A |
3 (high) |
2 (probable) |
2 (medium) |
P12 |
L1 |
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
MEM30-C |
3 (high) |
3 (likely) |
2 (medium) |
P18 |
L1 |
MEM31-C |
3 (high) |
2 (probable) |
1 (high) |
P6 |
L2 |
MEM32-C |
1 (low) |
3 (likely) |
2 (medium) |
P6 |
L2 |
MEM33-C |
2 (medium) |
1 (unlikely) |
3 (low) |
P6 |
L2 |
MEM34-C |
1 (low) |
1 (unlikely) |
2 (medium) |
P2 |
L3 |
MEM35-C |
3 (high) |
2 (probable) |
1 (high) |
P6 |
L2 |
MEM36-C |
|
|
|
P0 |
L3 |
MEM37-C |
3 (high) |
1 (unlikely) |
1 (high) |
P3 |
L3 |
MEM38-C |
1 (low) |
1 (unlikely) |
3 (low) |
P3 |
L3 |
MEM39-C |
1 (low) |
1 (unlikely) |
2 (medium) |
P2 |
L3 |
References
[[ISO/IEC 9899-1999]] Section 7.20.3, "Memory management functions"
[[Seacord 05]] Chapter 4, "Dynamic Memory Management"