| Wiki Markup |
|---|
As noted in [undefined behavior 169|CC. Undefined Behavior#ub_169] of Annex J of \ [[ISO/IEC 9899-1999|AA. Bibliography#ISO/IEC 9899-1999]\], the behavior a program is [undefined|BB. Definitions#undefined behavior] when
the pointer argument to the free or realloc function does not match a pointer earlier returned by calloc, malloc, or realloc, or the space has been deallocated by a call to free or realloc.
...
| Code Block |
|---|
|
/* p is a pointer to dynamically allocated memory */
p2 = realloc(p, size);
if (p2 == NULL) {
free(p); /* p may be indeterminate when (size == 0) */
return;
}
|
...
According to the C99 standard \ [[ISO/IEC 9899-1999|AA. Bibliography#ISO/IEC 9899-1999]\] (7.20.3):
If the size of the space requested is zero, the behavior is implementation defined: either a null pointer is returned, or the behavior is as if the size were some nonzero value, except that the returned pointer shall not be used to access an object.
...
Tool | Version | Checker | Description |
|---|
| | | | Section |
|---|
Fully Implemented |
|
| | | |
| | | |
| | | | Section |
|---|
finds resource leaks from variables that go out of scope while owning a resource |
|
| | | | Section |
|---|
can find the instances where a freed memory is freed again. Coverity Prevent cannot discover all violations of this rule so further verification is necessary |
|
| | | | Section |
|---|
can detect some violations of this rule. In particular, false positives may be raised if a variable is freed by a different function than the one that allocated it. Also, it is unable to warn on cases where a call to free() happens inside of a for-loop |
|
| | | |
...
MITRE CWE: CWE-415, "Double Free"
Bibliography
| Wiki Markup |
|---|
\[[MIT 2005|AA. Bibliography#MIT 05]\]
\[[]
[OWASP, Double Free|AA. Bibliography#OWASP Double Free]\]
\[[Viega 2005|AA. Bibliography#Viega 05]\] "Doubly freeing memory"
\[[VU#623332|AA. Bibliography#VU623332]\]
[Viega 2005] "Doubly freeing memory"
[VU#623332]
...
08. Memory Management (MEM) MEM32-C. Detect and handle memory allocation errors
