MEM35-C. Allocate sufficient memory for an object

Integer values used as a size argument to malloc(), calloc(), realloc(), or aligned_alloc() must be valid and large enough to contain the objects to be stored. If size arguments are incorrect or can be manipulated by an attacker, then a buffer overflow may occur. Incorrect size arguments, inadequate range checking, integer overflow, or truncation can result in the allocation of an inadequately sized buffer.

Typically the amount of memory to allocate will be the size of the type of object to allocate. When allocating space for an array, the size of the object will be multiplied by the bounds of the array. Use the correct type of the object when computing the size of chunk to allocate.

Noncompliant Code Example (Size Calculation)

In this noncompliant code example, an array of long is allocated and assigned to p. This example also checks for unsigned integer overflow in compliance with INT32-C. Ensure that operations on signed integers do not result in overflow. The code also ensures that len is not equal to zero. (See MEM04-C. Do not perform zero-length allocations.) However, sizeof(int) is used to size the allocated memory. If sizeof(long) is larger than sizeof(int), then an insufficient amount of memory is allocated.

#include <stdlib.h>
 
void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(long)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(int));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Compliant Solution (Size Calculation)

This compliant solution uses sizeof(long) to correctly size the memory allocation:

#include <stdlib.h>
void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(long)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(long));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Compliant Solution (Size Calculation)

#include <stdlib.h>
 
void function(size_t len) {
   long *p;
   if (len == 0 || len > SIZE_MAX / sizeof(*p)) {
      /* Handle overflow */
   }
   p = (long *)malloc(len * sizeof(*p));
   if (p == NULL) {
      /* Handle error */
   }
   free(p);
}

Noncompliant Code Example

In this noncompliant code example, too little space is allocated for a struct tm object because the size of the pointer is being used to determine the size of the pointed-to object. This is a demonstration of EXP01-C. Do not take the size of a pointer to determine the size of the pointed-to type.

#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(tmb));
  if (tmb == NULL) {
    return NULL;
  }
  tmb->tm_sec = sec;
  tmb->tm_min = min;
  tmb->tm_hour = hour;
  tmb->tm_mday = day;
  tmb->tm_mon = mon;
  tmb->tm_year = year;
  return tmb;
}

Compliant Solution

 In this compliant solution, the correct amount of memory is allocated for the struct tm object. When allocating  space for a single object, passing the (dereferenced) pointer type to the sizeof operator is a simple way to allocate sufficient memory.

#include <time.h>
 
struct tm *make_tm(int year, int mon, int day, int hour,
                   int min, int sec) {
  struct tm *tmb;
  tmb = (struct tm *)malloc(sizeof(*tmb));
  if (tmb == NULL) {
    return NULL;
  }
  tmb->tm_sec = sec;
  tmb->tm_min = min;
  tmb->tm_hour = hour;
  tmb->tm_mday = day;
  tmb->tm_mon = mon;
  tmb->tm_year = year;
  return tmb;
}

Risk Assessment

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Automated Detection

if (a < SIZE_MAX / b && a > 0) ...

Related Vulnerabilities

CVE-2009-0587 results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. An attacker could thereby execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow [xorl 2009].

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography