| Wiki Markup |
|---|
Dynamic memory managers are not required to clear freed memory and generally do not because of the additional runtime overhead. Furthermore, dynamic memory managers are free to reallocate this same memory. As a result, it is possible to accidentlyaccidentally leak sensitive information if it is not cleared before calling a function that frees dynamic memory. Programmers cannot rely on memory being cleared during allocation either \[[Do not assume memory allocation routines initialize memory]\]. |
| Wiki Markup |
In practice, this type of security flaw can expose sensitive information to unintended parties. The Sun tarball vulnerability discussed in _Secure Coding Principles & Practices: Designing and Implementing Secure Applications_ \[[Graf 03|AA. C References#Graf 03]\] and [Sun Security Bulletin #00122 | http://sunsolve.sun.com/search/document.do?assetkey=1-22-00122-1] illustrates a violation of this recommendation leading to sensitive data being leaked. Attackers may also be able to leverage this defect to retrieve sensitive information using techniques such as _heap inspection_. |
To prevent information leakage, sensitive information must be cleared from dynamically allocated buffers before they are freed.
...
| Code Block | ||
|---|---|---|
| ||
/* ... */
size_t secret_size;
/* ... */
if (secret_size > SIZE_MAX/2) {
/* handle error condition */
}
secret = realloc(secret, secret_size * 2);
/* ... */
|
| Wiki Markup |
|---|
A testThe {{secret_size}} is added at the beginning of this code tested to makeensure sure that the integer multiplication ({{secret_size * 2}}) does not result in an integer overflow \[[INT32-C. Ensure that integer operations do not result in an overflow]\]. |
...
| Wiki Markup |
|---|
The {{calloc()}} function ensures that the newly allocated memory has also been cleared. Because {{sizeof(char)}} is guaranteed to be 1, this solution does not need to check for a numeric overflow as a result of using {{calloc()}} \[[MEM07-A. Ensure that size arguments to calloc() do not result in an integer overflow]\]. |
Risk Assessment
| Wiki Markup |
|---|
In practice, this type of security flaw can expose sensitive information to unintended parties. The Sun tarball vulnerability discussed in _Secure Coding Principles & Practices: Designing and Implementing Secure Applications_ \[[Graf 03|AA. C References#Graf 03]\] and [Sun Security Bulletin #00122 | http://sunsolve.sun.com/search/document.do?assetkey=1-22-00122-1] illustrates a violation of this recommendation leading to sensitive data being leaked. Attackers may also be able to leverage this defect to retrieve sensitive information using techniques such as _heap inspection_ |
. |
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MEM03-A | 2 (medium) | 1 (unlikely) | 3 (low) | P6 | L2 |
...