...
To prevent information leakage, dynamic memory containing sensitive information should be sanitized before it is marked for deallocation. Below, this is done by filling the allocated space with '\0' characters. Note that calloc() is also used to zero-out newly allocated memory.
| Code Block |
|---|
|
...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX) {
/* Handle Error */
}
new_secret = malloccalloc(size+1,sizeof(char)); /* allocate space + NULL Terminator */
if (!new_secret) {
/* Handle Error */
}
strcpy(new_secret, secret);
/* Process new_secret... */
memset(new_secret,'\0',size); /* sanitize memory */
free(new_secret);
...
|
...
| Wiki Markup |
|---|
Using {{realloc()}} to resize dynamic memory may inadvertently expose sensitive information, or allow heap inspection as is described in Fortify's Taxonomy of Software Security Errors \[[vulncat|http://vulncat.fortifysoftware.com/2/HI.html]\] and NIST's Source Code Analysis Tool Functional Specification \[[SAMATE]\]. When {{realloc()}} is called it may allocate a new, larger block of memory, copy the contents, of {{buffersecret}} to this new block, {{free()}} the original block, and assign the newly allocated block to {{buffersecret}}. However, the contents of the original block may remain in heap memory after being marked for deallocation. |
| Code Block |
|---|
|
...
buffersecret = realloc(buffersecret ,new_size);
...
|
Compliant Solution 2
| Code Block |
|---|
|
...
temp_buff = calloc(new_size,sizeof(char));
if (temp_buff == NULL) {
/* Handle Error */
}
memcpy(temp_buff, buffer, buffer_size);
memset(buffer,'\0',buffer_size); /* sanitize the buffer */
free(buffer); /* free old space */
buffer = temp_buff; /* install the resized buffer */
temp_buff = 0;
...
|
Risk Assessment
Failure to clear dynamic memory can result in leaked information.
...
