| Wiki Markup |
|---|
Dynamic memory managers are not required to clear freed memory and generally do not because of the additional runtime overhead. Furthermore, dynamic memory managers are free to reallocate this same memory. As a result, it is possible to accidently leak sensitive information if it is not cleared before calling a function whichthat frees dynamic memory. Programmers cannot rely on memory being cleared during allocation either \[[MEM33-C|MEM33-C. Do not assume memory allocation routines initialize memory]\]. |
| Wiki Markup |
|---|
In practice, this type of security flaw can expose sensitive information to unintended parties. The Sun tarball vulnerability discussed in _Secure Coding Principles & Practices: Designing and Implementing Secure Applications_ \[[Graf 03|AA. C References#Graf 03]\] and [Sun Security Bulletin #00122 | http://sunsolve.sun.com/search/document.do?assetkey=1-22-00122-1] illustrates a violation of this recommendation leading to sensitive data being leaked. Attackers may also be able to leverage this defect to retrieve sensitive information using techniques, such as _heap inspection_. |
To prevent information leakage it is necessary to clear , sensitive information must be cleared from dynamically allocated buffers before they are freed.
...
| Code Block |
|---|
|
...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX) {
/* Handle Error */
}
/* use calloc() to zero-out allocated space */
new_secret = calloc(size+1,sizeof(char));
if (!new_secret) {
/* Handle Error */
}
strcpy(new_secret, secret);
/* Process new_secret... */
/* sanitize memory */
memset(new_secret, '\0', size);
free(new_secret);
...
|
| Wiki Markup |
|---|
The {{calloc()}} function ensures that the newly allocated memory has also bebeen cleared. Because {{sizeof(char)}} is guaranteed to be 1, this solution does not need to check for a numeric overflow as a result of using {{calloc()}} \[[MEM37-C | MEM37-C. Ensure that size arguments to calloc() do not result in an integer overflow]\]. |
...
Reallocating memory using the realloc() function is a degenerative case of freeing memory. The realloc() function function deallocates the old object and returns a pointer to a new object.
| Wiki Markup |
|---|
Using {{realloc()}} to resize dynamic memory may inadvertently expose sensitive information, or it may allow heap inspection as is described in Fortify's _Taxonomy of Software Security Errors_ \[[vulncat|http://vulncat.fortifysoftware.com/2/HI.html]\] and NIST's _Source Code Analysis Tool Functional Specification_ \[[NIST 06b|AA. C References#NIST 06b]\]. When {{realloc()}} is called it may allocate a new, larger object, copy the contents, of {{secret}} to this new object, {{free()}} the original object, and assign the newly allocated object to {{secret}}. However, the contents of the original object may remain in memory. |
...
| Wiki Markup |
|---|
A test is added at the beginning of this code to make sure that the integer multplicationmultiplication does not result in an integer overflow \[[INT32-C|INT32-C. Ensure that integer operations do not result in an overflow]\]. |
Compliant Solution: realloc()
A compliant program cannot rely on realloc() because it is not possible to clear the memory prior to the call.
Instead, a custom function must be used that operates similar to realloc(), but sanitizes sensitive information as heap-based buffers are resized. Again, this is done by overwriting the space to be deallocated with '\0' characters.
| Code Block |
|---|
|
...
size_t secret_size;
...
if (secret_size > SIZE_MAX/2) {
/* handle error condition */
}
/* calloc() initializes memory to zero */
temp_buff = calloc(secret_size * 2, sizeof(char));
if (temp_buff == NULL) {
/* Handle Error */
}
memcpy(temp_buff, secret, secret_size);
/* sanitize the buffer */
memset(secret, '\0', secret_size);
free(secret);
secret = temp_buff; /* install the resized buffer */
temp_buff = NULL;
...
|
...
- NIST 06b
- Graff 03 Graff, Mark G. and van Wyk, Kenneth R. Secure Coding Principles & Practices: Designing and Implementing Secure Applications. Sebastopol, CA: O'Reilly & Associates, 2003 (ISBN 0-596-00242-4).
- ISO/IEC 9899-1999 Section 7.20.3, "Memory management functions"
