Page History

An object has a storage duration that determines its lifetime. There are three storage durations: static, automatic, and allocated.

According to C99 C11, Section 6.2.4, para. 2 [ISO/IEC 9899:19992011],

The lifetime of an object is the portion of program execution during which storage is guaranteed to be reserved for it. An object exists, has a constant address, and retains its last-stored value throughout its lifetime. If an object is referred to outside of its lifetime, the behavior is undefined. The value of a pointer becomes indeterminate when the object it points to reaches the end of its lifetime.

Attempting to access an object outside of its lifetime can result in undefined behavior and lead to an exploitable vulnerability. (See also undefined behavior 8 9  of Appendix J.)

Noncompliant Code Example (Static Variables)

...

const char *p;
void dont_do_this(void) {
    const char str[] = "This will change";
    p = str; /* dangerous */
    /* ... */
}

void innocuous(void) {
    const char str[] = "Surprise, surprise";
}
/* ... */
dont_do_this();
innocuous();
/* p might be pointing to "Surprise, surprise" */

...

void this_is_OK(void) {
    const char str[] = "Everything OK";
    const char *p = str;
    /* ... */
}
/* p is inaccessible outside the scope of string str */

...

const char *p;
void is_this_OK(void) {
    const char str[] = "Everything OK?";
    p = str;
    /* ... */
    p = NULL;
}

...

char *init_array(void) {
   char array[10];
   /* Initialize array */
   return array;
}

Some compilers generate a warning when a pointer to an automatic variable is returned from a function, as in this example. Compile your code at high warning levels and resolve any warnings. (See recommendation MSC00-C. Compile cleanly at high warning levels.)

...

void init_array(char array[]) {
   /* Initialize array */
   return;
}

int main(int argc, char *argv[]) {
   char array[10];
   init_array(array);
   /* ... */
   return 0;
}

...

In this noncompliant code sample, the function squirrel_away() stores a pointer to local stack variable local into a location pointed to by function parameter ptr_param. Since it an can be assumed that the pointer variable to which ptr_param points remains alive upon squirrel_away()'s return, it is illegal for local to go out of scope.

void squirrel_away(char **ptr_param) {
   char local[10];
   /* Initialize array */
   *ptr_param = local;
}

void rodent() {
  char *ptr;
  squirrel_away(&ptr);
  /* ptr is live but invalid here */
}

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C++ Secure Coding Standard: DCL30-CPP. Declare objects with appropriate storage durations

ISO/IEC 9899:19992011 Section 6.2.4, "Storage durations of objects," and Section 7.2022.3, "Memory management functions"

ISO/IEC TR 17961 (Draft) Escaping of the address of an automatic object [addrescape]

ISO/IEC PDTR 24772 "DCM Dangling references to stack frames"

...