...
Referencing an object outside of its lifetime can result in an attacker being able to execute arbitrary code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DCL30-C | High | Probable | High | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| pointered-deallocation | Fully checked | ||||||
| CodeSonar |
| LANG.STRUCT.RPL | Returns pointer to local | ||||||
| Compass/ROSE |
Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope, would be difficult | |||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary | |||||||
| Klocwork |
| LOCRET.RET |
| LDRA tool suite |
| 42 D, 77 D, 71 S, 565 S | Enhanced Enforcement | ||||||
| Parasoft C/C++test |
|
|
| MISRA2004-17_6_{a,b} |
| Polyspace Bug Finder | R2016a | Pointer or reference to stack variable leaving scope | Pointer to local variable leaves the variable scope | ||||||
| PRQA QA-C |
| 3217 | Partially implemented | ||||||
| PRQA QA-C++ |
| 2515, 2516, 2527, 2528, 4026, 4624, 4629 |
| Splint |
|
| PVS-Studio | 6.22 | V506, V507, V558, V623, V723, V738 | General analysis rule set |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | MSC00-C. Compile cleanly at high warning levels | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | EXP54-CPP. Do not access an object outside of its lifetime | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TR 24772:2013 | Dangling References to Stack Frames [DCM] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TS 17961 | Escaping of the address of an automatic object [addrescape] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| MISRA C:2012 | Rule 18.6 (required) | Prior to 2018-01-12: CERT: Unspecified Relationship |
CERT-CWE Mapping Notes
Key here for mapping notes
...
- Assigning a stack pointer to an argument (thereby letting it outlive the current function
Bibliography
...
...