...
According to the C Standard, 6.2.4, paragraph 2 [ISO/IEC 9899:20112024],
The lifetime of an object is the portion of program execution during which storage is guaranteed to be reserved for it. An object exists, has a constant address, and retains its last-stored value throughout its lifetime. If an object is referred to outside of its lifetime, the behavior is undefined. The value of If a pointer becomes indeterminate when value is used in an evaluation after the object it the pointer points to (or just past) reaches the end of its lifetime, the behavior is undefined.
Do not attempt to access an object outside of its lifetime. Attempting to do so is undefined behavior and can lead to an exploitable vulnerability. (see See also undefined behavior 9 in the C Standard, Annex J.).
Noncompliant Code Example (Differing Storage Durations)
...
Some compilers generate a diagnostic message when a pointer to an object with automatic storage duration is returned from a function, as in this example. Programmers should compile code at high warning levels and resolve any diagnostic messages. (see See MSC00-C. Compile cleanly at high warning levels.).
Compliant Solution (Return Values)
...
Referencing an object outside of its lifetime can result in an attacker being able to execute arbitrary code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
DCL30-C | High | Probable | High | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| pointered-deallocation return-reference-local | Fully checked | ||||||
| Axivion Bauhaus Suite |
| CertC-DCL30 | Fully implemented | ||||||
| CodeSonar |
| LANG.STRUCT.RPL | Returns pointer to local | ||||||
| Compass/ROSE |
Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope, would be difficult | |||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary |
7.6.0
| Cppcheck |
| danglingLifetime | Fully implemented | ||||||
| Cppcheck Premium |
| danglingLifetime | Fully implemented | ||||||
| Helix QAC |
| C3217, C3225, C3230, C4140 C++2515, C++2516, C++2527, C++2528, C++4026, C++4624, C++4629 | Fully implemented | ||||||
| Klocwork |
| LOCRET.ARG |
| RET |
| Fully implemented | |||||||||
| LDRA tool suite |
| 42 D, 77 D, 71 S, 565 S | Enhanced Enforcement | ||||||
| Parasoft C/C++test |
| CERT_C-DCL30-a | The address of an object with automatic storage shall not be returned from a function | |||||||
| PC-lint Plus |
| 604, 674, 733, 789 | Partially supported | ||||||
| Polyspace Bug Finder |
| Checks for pointer |
or reference to stack variable leaving scope |
Pointer to local variable leaves the variable scope
(rule fully covered) | ||
| PVS-Studio |
|
|
|
|
|
3217
3225
3230
4140
| V506, V507, V558, V623, V723, V738 | ||||||||
| RuleChecker |
| return-reference-local | Partially checked |
| Splint |
|
| TrustInSoft Analyzer |
| dangling_pointer | Exhaustively detects undefined behavior (see one compliant and one non-compliant example). |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | MSC00-C. Compile cleanly at high warning levels |
| Prior to 2018-01-12: CERT: Unspecified Relationship | ||
| CERT C | EXP54-CPP. Do not access an object outside of its lifetime | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TR 24772:2013 | Dangling References to Stack Frames [DCM] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TS 17961 | Escaping of the address of an automatic object [addrescape] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| MISRA C:2012 | Rule 18.6 (required) | Prior to 2018-01-12: CERT: Unspecified Relationship |
CERT-CWE Mapping Notes
Key here for mapping notes
CWE-562 and DCL30-C
DCL30-C = Union( CWE-562, list) where list =
- Assigning a stack pointer to an argument (thereby letting it outlive the current function
Bibliography
...
...