...
Attempting to access an object outside of its lifetime can result in undefined behavior and lead to an exploitable vulnerability. (See also undefined behavior 9 of Appendix J.)
Noncompliant Code Example (Static Variables)
...
Some compilers generate a warning when a pointer to an automatic variable is returned from a function, as in this example. Compile your code at high warning levels and resolve any warnings. (See MSC00-C. Compile cleanly at high warning levels.)
Compliant Solution (Return Values)
...
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| 42 D | Fully implemented. | |||||||
Fortify SCA | V. 7.6.0 | Can detect violations when an array is declared in a function and then a pointer to that array is returned. | |||||||
| Splint |
| ||||||||
| Compass/ROSE | Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope would be difficult. | ||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary. | |||||||
| LOCRET.* | ||||||||
| PRQA QA·CQA-C |
| Partially implemented |
...
ISO/IEC TR 17961 (Draft) Escaping of the address of an automatic object [addrescape]
ISO/IEC PDTR 24772 "DCM Dangling references to stack frames"
MISRA Rule 8.6
Bibliography
...