Page History

Do no not evaluate any pointers into freed memory after an allocated block of dynamic storage has been deallocated by a memory management function, including dereferencing or acting as an operand of an arithmetic operation, type casting, or using the pointer as the right-hand side of an assignment.

According to the C Standard, the behavior of a program that uses the value of a pointer that refers to space deallocated by a call to the free() or realloc() function is undefined. (See undefined behavior 177  of Annex J.)  Similarly, if an object is referred to outside of its lifetime, the behavior is undefined.  (See undefined behavior 9 of Annex J.)

Reading a pointer to deallocated memory is undefined because the pointer value is indeterminate and can have a trap representation. In the latter case, doing so may cause a hardware trap.

...

In this compliant solution do not free the memory until it is no longer required, the memory is freed after its final use, and the pointer is zeroed in compliance with MEM01-C. Store a new value in pointers immediately after free():

#include <stdlib.h>
#include <string.h>
 
enum { BUFFERSIZE = 32 };
 
int main(int argc, const char *argv[]) {
  char *buff = (char *)malloc(BUFFERSIZE);
  if (!buff) {
     /* Handle error */
  }
  
  if (argc > 1){
    strncpy(buff, argv[1], BUFFERSIZE - 1);
  }
  free(buff);
  buff = 0;
 
  return 0;
}

Noncompliant Code Example

...

void gdClipSetAdd(gdImagePtr im,gdClipRectanglePtr rect) {
  gdClipRectanglePtr more;
  if (im->clip == 0) {
    ...
  }
  if (im->clip->count == im->clip->max) {
    more = gdRealloc (im->clip->list,(im->clip->max + 8) *
                      sizeof (gdClipRectangle));
    if (more == 0) return;
    im->clip->max += 8;
    im->clip->list = more;
  }
  im->clip->list[im->clip->count] = (*rect);
  im->clip->count++;

Noncompliant Code Example

In this example, an object is referred to outside of its lifetime:

int *get_ptr(void) {
  int obj = 12;
  return &obj;
}
 
void func(void) {
  int *ptr = get_ptr();
  *ptr = 42;
}

Compliant Solution

In this compliant solution, allocated storage is used instead of automatic storage for the pointer:

#include <stdlib.h>
 
int *get_ptr(void) {
  int *ptr = (int *)malloc(sizeof(int));
  if (!ptr) {
    return 0;
  }
  *ptr = 12;
  return ptr;
}
 
void func(void) {
  int *ptr = get_ptr();
  if (ptr) {
    *ptr = 42;
    free(ptr);
    ptr = 0;
  }
}

Risk Assessment

Reading memory that has already been freed can lead to abnormal program termination and denial-of-service attacks. Writing memory that has already been freed can lead to the execution of arbitrary code with the permissions of the vulnerable process.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...