982
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make
this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform
automatic garbage collection that releases memory for objects that have been deallocated.
Phase: Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent
with how and where you free memory in a function. If you allocate memory that you intend to free
upon completion of the function, you must be sure to free the memory at all exit points for that
function including error conditions.
Phase: Implementation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and
new[]/delete[].
Phase: Implementation
When releasing a complex object or structure, ensure that you properly dispose of all of its
member components, not just the object itself.
Demonstrative Examples
Example 1:
The following method never closes the new file handle. Given enough time, the Finalize() method
for BufferReader should eventually call Close(), but there is no guarantee as to how long this action
will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment,
the Operating System could use up all of the available file handles before the Close() function is
called.
Example Language: Java (Bad)
private void processFile(string fName)
{
BufferReader fil = new BufferReader(new FileReader(fName));
String line;
while ((line = fil.ReadLine()) != null)
{
processLine(line);
}
}
The good code example simply adds an explicit call to the Close() function when the system is
done using the file. Within a simple example such as this the problem is easy to see and fix. In a
real system, the problem may be considerably more obscure.
Example Language: Java (Good)
private void processFile(string fName)
{
BufferReader fil = new BufferReader(new FileReader(fName));
String line;
while ((line = fil.ReadLine()) != null)
{
CWE Version 4.14
CWE-404: Improper Resource Shutdown or Release
CWE-404: Improper Resource Shutdown or Release