...
| Code Block |
|---|
|
int main(int argc, const char *argv[]) {
char *buff;
buff = (char *)malloc(BUFSIZ);
if (!buff) {
/* Handle error condition */
}
new char[BUFSIZ];
/* ... */
free(buff)delete[] buff;
/* ... */
strncpy(buff, argv[1], BUFSIZ-1);
}
|
...
| Code Block |
|---|
|
int main(int argc, const char *argv[]) {
char *buff;
buff = new (char *)malloc(BUFSIZ);
if (!buff) {
/* Handle error condition */[BUFSIZ];
}
/* ... */
strncpy(buff, argv[1], BUFSIZ-1);
/* ... */
free(buff);
}
|
Non-Compliant Code Example
...
...
| Code Block |
|---|
|
int num = 5;
SomeClass *sc = new SomeClass[num];
// ...
delete [] sc;
// ...
SomeClass& ref = sc[0]; // undefined behavior!
|
...
...
| Code Block |
|---|
|
int num = 5 buff;
SomeClass *sc = new SomeClass[num];
// ...
delete [] sc;
sc = 0;
// ...
if (sc==0) ... // now safe buff = NULL;
}
|
Risk Assessment
Reading memory that has already been freed can lead to abnormal program termination and denial-of-service attacks. Writing memory that has already been freed can lead to the execution of arbitrary code with the permissions of the vulnerable process.
...
