Evaluating
...
a pointer—including dereferencing the pointer, using it as an operand of an arithmetic operation, type casting it,
...
and using
...
it as the right-hand side of an
...
assignment—into memory that has been deallocated by a memory management function is undefined behavior. Pointers to memory that
...
has been deallocated are
...
called dangling pointers. Accessing a dangling pointer can result in exploitable vulnerabilities.
According to the C Standard, using the value of a pointer that refers to space deallocated by a call to the free() or realloc() function is undefined behavior (see undefined behavior 177).
...
In this noncompliant code example, buf is written to after it has been freed. Write-after-free vulnerabilities can be exploited to run arbitrary code with the permissions of the vulnerable process and are seldom this obvious. Typically, allocations and frees are far removed, making it difficult to recognize and diagnose these problems.
...
| CERT C Secure Coding Standard | MEM01-C. Store a new value in pointers immediately after free() |
| SEI CERT C++ Coding Standard | MEM50-CPP. Do not access freed memory |
| ISO/IEC TR 24772:2013 | Dangling References to Stack Frames [DCM] Dangling Reference to Heap [XYK] |
| ISO/IEC TS 17961 | Accessing freed memory [accfree] |
| MISRA C:2012 | Rule 18.6 (required) |
| MITRE CWE |
...