Before the lifetime of the last pointer object that stores the return value of a call to a standard memory allocation function has ended, it must be matched by a call to a standard memory deallocation function with that pointer value.

Noncompliant Code Example

In this noncompliant example, the object allocated by the call to malloc() is not freed before the end of the lifetime of last pointer object (text_buffer) referring to the object.

#include <stdlib.h>
 
int f(void) {
  char *text_buffer = (char *)malloc(BUFSIZ); 
  if (text_buffer == NULL) {
    return -1;
  }
  return 0;
}

Compliant Solution 

In this compliant solution, the pointer object that stores the return value from malloc() is stored in a variable of static storage duration.

#include <stdlib.h>

char *text_buffer;
 
int f(void) {
  text_buffer = (char *)malloc(BUFSIZ); 
  if (text_buffer == NULL) {
    return -1;
  }
  return 0;
}

Risk Assessment

Freeing memory multiple times can result in an attacker executing arbitrary code with the permissions of the vulnerable process.

Automated Detection

Tool	Version	Checker	Description
Compass/ROSE
Coverity		RESOURCE_LEAK	Finds resource leaks from variables that go out of scope while owning a resource
Fortify SCA	5.0	Double Free
Klocwork		MLK UFM.FFM
LDRA tool suite		484 S	Fully implemented
Splint

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography