MEM31-C. Free dynamically allocated memory when no longer needed

Before the lifetime of the last pointer object that stores the return value of a call to a standard memory allocation function has ended, it must be matched by a call to a standard memory deallocation function with that pointer value.

Noncompliant Code Example

In this noncompliant example, the object allocated by the call to malloc() is not freed before the end of the lifetime of last pointer object (text_buffer) referring to the object.

#include <stdlib.h>
 
int f(void) {
  char *text_buffer = (char *)malloc(BUFSIZ); 
  if (text_buffer == NULL) {
    return -1;
  }
  return 0;
}

Compliant Solution 

In this compliant solution, the pointer object that stores the return value from malloc() is stored in a variable of static storage duration.

#include <stdlib.h>

char *text_buffer;
 
int f(void) {
  text_buffer = (char *)malloc(BUFSIZ); 
  if (text_buffer == NULL) {
    return -1;
  }
  return 0;
}

Risk Assessment

Freeing memory multiple times can result in an attacker executing arbitrary code with the permissions of the vulnerable process.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography