1593
This can cause the product to crash, or in some cases, modify critical program variables or execute
code.
This weakness often occurs when the memory is allocated explicitly on the heap with one of the
malloc() family functions and free() is called, but pointer arithmetic has caused the pointer to be in
the interior or end of the buffer.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 763 Release of Invalid Pointer or Reference 1599
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Common Consequences
Scope Impact Likelihood
Integrity
Availability
Confidentiality
Modify Memory
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
Potential Mitigations
Phase: Implementation
When utilizing pointer arithmetic to traverse a buffer, use a separate variable to track progress
through memory and preserve the originally allocated address for later freeing.
Phase: Implementation
When programming in C++, consider using smart pointers provided by the boost library to help
correctly and consistently manage memory.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, glibc in Linux provides
protection against free of invalid pointers.
Phase: Architecture and Design
Use a language that provides abstractions for memory allocation and deallocation.
Phase: Testing
Use a tool that dynamically detects memory management problems, such as valgrind.
Demonstrative Examples
Example 1:
In this example, the programmer dynamically allocates a buffer to hold a string and then searches
for a specific character. After completing the search, the programmer attempts to release the
allocated memory and return SUCCESS or FAILURE to the caller. Note: for simplification, this
example uses a hard-coded "Search Me!" string and a constant string length of 20.
CWE Version 4.14
CWE-761: Free of Pointer not at Start of Buffer
CWE-761: Free of Pointer not at Start of Buffer