Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#FFCCCC
langc
const char *p;
void dont_do_this(void) {
  const char c_str[] = "This will change";
  p = c_str; /* Dangerous */
  /* ... */
}

void innocuous(void) {
  const char c_str[] = "Surprise, surprise";
}

int main(void) {
  dont_do_this();
  innocuous();  /* p might be pointing to "Surprise, surprise". */

  return 0;
}

Compliant Solution (Similar Scope)

...

Code Block
bgColor#ccccff
langc
void this_is_OK(void) {
  const char c_str[] = "Everything OK";
  const char *p = c_str;
  /* ... */
}
/* p is inaccessible outside the scope of string c_str. */

Alternatively, both p and c_str could be declared with static scope.

...

Code Block
bgColor#FFcccc
langc
void squirrel_away(char **ptr_param) {
  char local[10];
  /* Initialize array */
  *ptr_param = local;
}

void rodent() {
  char *ptr;
  squirrel_away(&ptr);
  /* ptr is live but invalid here. */
}

Compliant Solution 

The variable local has static storage duration, so ptr is live and valid in the function rodent():

Code Block
bgColor#ccccff
langc
char local[10];
 
void squirrel_away(char **ptr_param) {
  /* Initialize array */
  *ptr_param = local;
}

void rodent() {
  char *ptr;
  squirrel_away(&ptr);
  /* ptr is live and valid here. */
}

Risk Assessment

Referencing an object outside of its lifetime can result in an attacker being able to run arbitrary code.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

DCL30-C

highHigh

probableProbable

highHigh

P6

L2

Automated Detection

Tool

Version

Checker

Description

Compass/ROSE  

Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope would be difficult

Coverity

Include Page
Coverity_V
Coverity_V

RETURN_LOCAL

Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary

Fortify SCA

7.6.0

 

Can detect violations when an array is declared in a function and then a pointer to that array is returned

Klocwork

Include Page
Klocwork_V
Klocwork_V

LOCRET.*

 

LDRA tool suite

Include Page
LDRA_V
LDRA_V

42 D
71 S

Fully implemented
PRQA QA-C
Include Page
PRQA_V
PRQA_V

3217
3225
3230
4140

Partially implemented
Splint
Include Page
Splint_V
Splint_V
  

...