984
}
}
}
fclose(f);
return DECODE_SUCCESS;
}
Example 5:
In this example, the program does not use matching functions such as malloc/free, new/delete, and
new[]/delete[] to allocate/deallocate the resource.
Example Language: C++ (Bad)
class A {
void foo();
};
void A::foo(){
int *ptr;
ptr = (int*)malloc(sizeof(int));
delete ptr;
}
Example 6:
In this example, the program calls the delete[] function on non-heap memory.
Example Language: C++ (Bad)
class A{
void foo(bool);
};
void A::foo(bool heap) {
int localArray[2] = {
11,22
};
int *p = localArray;
if (heap){
p = new int[2];
}
delete[] p;
}
Observed Examples
Reference Description
CVE-1999-1127 Does not shut down named pipe connections if malformed data is sent.
https://www.cve.org/CVERecord?id=CVE-1999-1127
CVE-2001-0830 Sockets not properly closed when attacker repeatedly connects and
disconnects from server.
https://www.cve.org/CVERecord?id=CVE-2001-0830
CVE-2002-1372 Chain: Return values of file/socket operations are not checked (CWE-252),
allowing resultant consumption of file descriptors (CWE-772).
https://www.cve.org/CVERecord?id=CVE-2002-1372
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
CWE Version 4.14
CWE-404: Improper Resource Shutdown or Release
CWE-404: Improper Resource Shutdown or Release