1010
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
...
if (abrt) {
free(ptr);
}
...
free(ptr);
Double free vulnerabilities have two common (and sometimes overlapping) causes:
• Error conditions and other exceptional circumstances
• Confusion over which part of the program is responsible for freeing the memory
Although some double free vulnerabilities are not much more complicated than this example,
most are spread out across hundreds of lines of code or even different files. Programmers seem
particularly susceptible to freeing global variables more than once.
Example 2:
While contrived, this code should be exploitable on Linux distributions that do not ship with heapchunk
check summing turned on.
Example Language: C (Bad)
#include <stdio.h>
#include <unistd.h>
#define BUFSIZE1 512
#define BUFSIZE2 ((BUFSIZE1/2) - 8)
int main(int argc, char **argv) {
char *buf1R1;
char *buf2R1;
char *buf1R2;
buf1R1 = (char *) malloc(BUFSIZE2);
buf2R1 = (char *) malloc(BUFSIZE2);
free(buf1R1);
free(buf2R1);
buf1R2 = (char *) malloc(BUFSIZE1);
strncpy(buf1R2, argv[1], BUFSIZE1-1);
free(buf2R1);
free(buf1R2);
}
Observed Examples
Reference Description
CVE-2006-5051 Chain: Signal handler contains too much functionality (CWE-828), introducing
a race condition (CWE-362) that leads to a double free (CWE-415).
https://www.cve.org/CVERecord?id=CVE-2006-5051
CVE-2004-0642 Double free resultant from certain error conditions.
https://www.cve.org/CVERecord?id=CVE-2004-0642
CVE-2004-0772 Double free resultant from certain error conditions.
https://www.cve.org/CVERecord?id=CVE-2004-0772
CVE-2005-1689 Double free resultant from certain error conditions.
https://www.cve.org/CVERecord?id=CVE-2005-1689
CVE-2003-0545 Double free from invalid ASN.1 encoding.
https://www.cve.org/CVERecord?id=CVE-2003-0545
CVE-2003-1048 Double free from malformed GIF.
https://www.cve.org/CVERecord?id=CVE-2003-1048
CVE-2005-0891 Double free from malformed GIF.
https://www.cve.org/CVERecord?id=CVE-2005-0891
CWE Version 4.14
CWE-415: Double Free
CWE-415: Double Free