Page History

...

According to C99 \[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\]:

The lifetime of an object is the portion of program execution during which storage is guaranteed to be reserved for it. An object exists, has a constant address, and retains its last-stored value throughout its lifetime. If an object is referred to outside of its lifetime, the behavior is undefined. The value of a pointer becomes indeterminate when the object it points to reaches the end of its lifetime.

Attempting to access an object outside of its lifetime can result in undefined behavior and lead to an exploitable vulnerability. (see See also undefined behavior 8 of Appendix J.).

Noncompliant Code Example (Static Variables)

...

Some compilers generate a warning when a pointer to an automatic variable is returned from a function, as in this example. Compile your code at high warning levels and resolve any warnings. (see See guideline MSC00-C. Compile cleanly at high warning levels.).

Compliant Solution (Return Values)

...

Automated Detection

...

Tool	Version	Checker	Description
Section LDRA tool suite	Include Page c:LDRA_V c:LDRA_V
Section Fortify SCA	Section V. 7.6.0

...

Section can detect violations when an array is declared in a function and then a pointer to that array is returned

...

Section Splint	Include Page c:Splint_V c:Splint_V
Section

...

Compass/ROSE			Section can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope would be difficult.
Section

...

Coverity Prevent

Include Page c:Coverity_V c:Coverity_V

Section RETURN_LOCAL

...

Section finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

...

Section Klocwork	Include Page c:Klocwork_V c:Klocwork_V	Section LOCRET.*

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

Related Guidelines

This rule appears in the C++ Secure Coding Standard as : DCL30-CPP. Declare objects with appropriate storage durations.

Bibliography

\[[Coverity 072007|AA. Bibliography#Coverity 07]\]
\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 6.2.4, "Storage durations of objects," and Section 7.20.3, "Memory management functions"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "DCM Dangling references to stack frames"
\[[MISRA 042004|AA. Bibliography#MISRA 04]\] Rule 8.6

...