...
In this example, the memory referred to by x is mistakingly may be freed multiple times. if error_condition is true, then x is freed, and then freed again further along in the code.
| Code Block |
|---|
*x = malloc (number * sizeof(int)); if (x == NULL) { /* Handle Allocation Error */ } /* Manipulate x*/ free(x); y = malloc (number * sizeof(int)); if (yerror_conditon == NULL1) { /* Handle Error Condition*/ free(x); } /* Manipulate... y*/ free(x); |
Compliant Solution 1
Only free a pointer to dynamic memory referred to by x once. This can be accomplished in this example by replacing removing the second call to free.
...
() in the section of code executed when error_condition is true.
*x = malloc (number * sizeof(int));
...
if
...
(x
...
==
...
NULL)
...
{
...
/*
...
Handle
...
Allocation Error
...
*/
...
}
if (error_conditon == 1) {
/* Handle Error Condition*/
}
/* ... */
free;
References
VU#623332, http://www.kb.cert.org/vuls/id/623332