Page History

...

Failure to overload the corresponding dynamic storage function is likely to violate rules like VOID MEM39MEM31-CPP. Resources allocated by memory allocation functions must be released using the corresponding memory deallocation functionProperly deallocate dynamically allocated resources. For instance, if an overloaded allocation function uses a private heap to perform its allocations, passing a pointer returned by it to the default deallocation function will likely cause undefined behavior. Even in situations where the allocation function ultimately calls through to the default allocator to obtain a pointer to memory, failing to overload a corresponding deallocation function may leave the program in an unexpected state by not updating internal allocator state.

...

In this noncompliant code example, an allocation function is overloaded at global scope, however, the corresponding deallocation function is not declared. Were an object to be allocated with the overloaded allocation function, any attempt to delete the object would result in undefined behavior in violation of VOID MEM39MEM31-CPP. Resources allocated by memory allocation functions must be released using the corresponding memory deallocation functionProperly deallocate dynamically allocated resources.

#include <Windows.h>
#include <new>
 
void *operator new(std::size_t size) noexcept(false) {
  static HANDLE H = ::HeapCreate(0, 0, 0); // Private, expandable heap
  if (H) {
    return ::HeapAlloc(H, 0, size);
  }
  throw std::bad_alloc();
}

...

Related Vulnerabilities

...

Bibliography

...