1481
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
When a resource is released it might not be in an expected
state, later attempts to access the resource may lead to
resultant errors that may lead to a crash.
Demonstrative Examples
Example 1:
The following code shows a simple example of a use after free error:
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
if (err) {
abrt = 1;
free(ptr);
}
...
if (abrt) {
logError("operation aborted before commit", ptr);
}
When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly
used in the logError function.
Example 2:
The following code shows a simple example of a double free error:
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
...
if (abrt) {
free(ptr);
}
...
free(ptr);
Double free vulnerabilities have two common (and sometimes overlapping) causes:
• Error conditions and other exceptional circumstances
• Confusion over which part of the program is responsible for freeing the memory
Although some double free vulnerabilities are not much more complicated than the previous
example, most are spread out across hundreds of lines of code or even different files.
Programmers seem particularly susceptible to freeing global variables more than once.
Example 3:
In the following C/C++ example the method processMessage is used to process a message
received in the input array of char arrays. The input message array contains two char arrays:
the first is the length of the message and the second is the body of the message. The length
of the message is retrieved and used to allocate enough memory for a local char array,
messageBody, to be created for the message body. The messageBody is processed in the method
processMessageBody that will return an error if an error occurs while processing. If an error occurs
then the return result variable is set to indicate an error and the messageBody char array memory
is released using the method free and an error message is sent to the logError method.
Example Language: C (Bad)
#define FAIL 0
CWE Version 4.14
CWE-672: Operation on a Resource after Expiration or Release
CWE-672: Operation on a Resource after Expiration or Release