...
According to the C Standard, 6.2.4, paragraph 2 [ISO/IEC 9899:20112024],
The lifetime of an object is the portion of program execution during which storage is guaranteed to be reserved for it. An object exists, has a constant address, and retains its last-stored value throughout its lifetime. If an object is referred to outside of its lifetime, the behavior is undefined. The value of If a pointer becomes indeterminate when value is used in an evaluation after the object it the pointer points to (or just past) reaches the end of its lifetime, the behavior is undefined.
Do not attempt to access an object outside of its lifetime. Attempting to do so is undefined behavior and can lead to an exploitable vulnerability. (See also undefined behavior 9 in the C Standard, Annex J.)
...
Tool | Version | Checker | Description | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| pointered-deallocation return-reference-local | Fully checked | |||||||||||||||||
| Axivion Bauhaus Suite |
| CertC-DCL30 | Fully implemented | |||||||||||||||||
| CodeSonar |
| LANG.STRUCT.RPL | Returns pointer to local | |||||||||||||||||
| Compass/ROSE | Can detect violations of this rule. It automatically detects returning pointers to local variables. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of scope, would be difficult | |||||||||||||||||||
| RETURN_LOCAL | Finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary | ||||||||||||||||||
| Cppcheck |
| danglingLifetime | Fully implemented | |||||||||||||||||
| Cppcheck Premium |
| danglingLifetime | Fully implemented | |||||||||||||||||
| Helix QAC |
| C3217, C3225, C3230, C4140 C++2515, C++2516, C++2527, C++2528, C++4026, C++4624, C++4629 | Fully implemented | |||||||||||||||||
| Klocwork |
| LOCRET.ARG | Fully implemented | |||||||||||||||||
| LDRA tool suite |
| 42 D, 77 D, 71 S, 565 S | Enhanced Enforcement | |||||||||||||||||
| Parasoft C/C++test |
| MISRA2004-17_6_a, MISRA2004-17_6_b | ||||||||||||||||||
| Polyspace Bug Finder | R2016a | Pointer or reference to stack variable leaving scope | Pointer to local variable leaves the variable scope | |||||||||||||||||
CERT_C-DCL30-a | The address of an object with automatic storage shall not be returned from a function | |||||||||||||||||||
| PC-lint Plus |
| 604, 674, 733, 789 | Partially supported | |||||||||||||||||
| Polyspace Bug Finder |
| Checks for pointer or reference to stack variable leaving scope (rule fully covered) | PRQA QA-C | |||||||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 3217 | Partially implemented | PRQA QA-C++ | |||||||||||||||
| Include Page | cplusplus:PRQA QA-C++_V | cplusplus:PRQA QA-C++_V | 2515, 2516, 2527, 2528, 4026, 4624, 4629||||||||||||||||||
| PVS-Studio |
| V506, V507, V558, V623, V723, V738 | ||||||||||||||||||
| RuleChecker |
| return-reference-local | Partially checked | |||||||||||||||||
| Splint |
| |||||||||||||||||||
| TrustInSoft Analyzer |
| dangling_pointer | Exhaustively detects undefined behavior (see one compliant and one non-compliant example). |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
| [Coverity 2007] | |
| [ISO/IEC 9899:20112024] | 6.2.4, "Storage Durations of Objects" |
...