Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

In this compliant solution do not free the memory until it is no longer required.:

Code Block
bgColor#ccccff
langc
int main(int argc, const char *argv[]) {
  char *buff;

  buff = (char *)malloc(BUFFERSIZE);
  if (!buff) {
     /* Handle error condition */
  }
  /* ... */
  strncpy(buff, argv[1], BUFFERSIZE-1);
  /* ... */
  free(buff);
}

...

The compliant solution simply reassigns im->clip->list to the value of more after the call to realloc.:

Code Block
bgColor#ccccff
langc
void gdClipSetAdd(gdImagePtr im,gdClipRectanglePtr rect) {
  gdClipRectanglePtr more;
  if (im->clip == 0) {
    ...
  }
  if (im->clip->count == im->clip->max) {
    more = gdRealloc (im->clip->list,(im->clip->max + 8) *
                      sizeof (gdClipRectangle));
    if (more == 0) return;
    im->clip->max += 8;
    im->clip->list = more;
  }
  im->clip->list[im->clip->count] = (*rect);
  im->clip->count++;

...

Tool

Version

Checker

Description

Compass/ROSE

 

 

 

Coverity

Include Page
Coverity_V
Coverity_V

USE_AFTER_FREE

Can detect the specific instances where memory is deallocated more than once or read/written to the target of a freed pointer.

Fortify SCA

5.0

 

 

Klocwork

Include Page
Klocwork_V
Klocwork_V

UFM.DEREF.MIGHT
UFM.DEREF.MUST
UFM.RETURN.MIGHT
UFM.RETURN.MUST
UFM.USE.MIGHT
UFM.USE.MUST

 

LDRA tool suite

Include Page
LDRA_V
LDRA_V

51 D

Fully implemented.

Splint

Include Page
Splint_V
Splint_V

 

 

...

CERT C++ Secure Coding StandardMEM30-CPP. Do not access freed memory
ISO/IEC TR 24772:2013Dangling References to Stack Frames [DCM]
Dangling Reference to Heap [XYK]
ISO/IEC TS 17961 (Draft)Accessing freed memory [accfree]
MISRA - C:2012Rule 1718.6 (required)
MITRE CWECWE-416, Use after free

...

[Kernighan 1988]Section 7.8.5, "Storage Management"
[OWASP Freed Memory] 
[Seacord 2013]Chapter 4, "Dynamic Memory Management"
[Viega 2005]Section 5.2.19, "Using Freed Memory"
[xorl 2009]CVE-2009-1364: LibWMF Pointer Use after free()

 

Image Modified