Clear sensitive information stored in dynamic memory prior to deallocation

Calling free() on a block of dynamic memory marks that memory for deallocation. Once deallocated, the block of memory is made available for future allocation. However, the data stored in the block of memory to be recycled may be preserved. If this memory block contains sensitive information, that information may be unintentionally exposed. This phenomenon is referred to as heap inspection [http://vulncat.fortifysoftware.com/2/HI.html and http://samate.nist.gov/docs/SAMATE_source_code_analysis_tool_spec_09_15_06.pdf]. To prevent heap inspection it is necessary to clear sensitive information from dynamically allocated buffers before they are freed.

This type of defect can lead to information leakage as is stated in Rule: MEM33-C. Do not assume memory allocation routines initialize memory.

Non-Compliant Code Example 1

In this example, sensitive information in stored in the buffer secret is copied to the dynamically allocated buffer, new_secret, which is then processed and eventually marked for deallocation with free(). However, the contents of new_secret may remain in heap memory after being marked for deallocation. Furthermore, if this memory is recycled by the heap manager, the information stored in new_secret may be exposed to another, unintended section of the program, or another program entirely.

...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX) {
  /* Handle Error */
}

new_secret = malloc(size+1); /* allocate space + NULL Terminator */
if (!new_secret) {
  /* Handle Error */
}
strcpy(new_secret, secret);

/* Process new_secret... */

free(new_secret);
...

Compliant Solution 1

To prevent information leakage, dynamic memory containing sensitive information should be sanitized before it is marked for deallocation. Below, this is done by filling the allocated space with '\0' characters.

...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX) {
  /* Handle Error */
}

new_secret = malloc(size+1); /* allocate space + NULL Terminator */
if (!new_secret) {
  /* Handle Error */
}
strcpy(new_secret, secret);

/* Process new_secret... */

memset(new_secret,'\0',size); /* sanitize memory  */
free(new_secret);
...

Non-Compliant Code Example 2

Using realloc() to resize dynamic memory may inadvertently expose sensitive data. realloc() may allocate a new, larger block of memory, copy the contents, of buffer to this new block, free() the original block, and assign the newly allocated block to buffer. However, the contents of the original block may remain in heap memory after being marked for deallocation.

...
buffer = realloc(buffer,new_size);
...

Compliant Solution 2

Risk Assessment

Failure to clear memory can result in leaked information. Occasionally, it can also lead to buffer overflows when programmers assume, for example, a null termination byte is present when it is not.

Refernces

http://vulncat.fortifysoftware.com/2/HI.html
http://samate.nist.gov/docs/SAMATE_source_code_analysis_tool_spec_09_15_06.pdf
MEM33-C. Do not assume memory allocation routines initialize memory