1603
if( isMalformed( tok ) ){
/* ignore and discard bad data */
free( tok );
}
else{
add_to_command_queue( tok );
}
tok = strtok( NULL, sep));
}
While the above code attempts to free memory associated with bad commands, since the memory
was all allocated in one chunk, it must all be freed together.
One way to fix this problem would be to copy the commands into a new memory location before
placing them in the queue. Then, after all commands have been processed, the memory can safely
be freed.
Example Language: C (Good)
//hardcode input length for simplicity
char* input = (char*) malloc(40*sizeof(char));
char *tok, *command;
char* sep = " \t";
get_user_input( input );
/* The following loop will parse and process each token in the input string */
tok = strtok( input, sep);
while( NULL != tok ){
if( !isMalformed( command ) ){
/* copy and enqueue good data */
command = (char*) malloc( (strlen(tok) + 1) * sizeof(char) );
strcpy( command, tok );
add_to_command_queue( command );
}
tok = strtok( NULL, sep));
}
free( input )
Observed Examples
Reference Description
CVE-2019-11930 function "internally calls 'calloc' and returns a pointer at an index... inside the
allocated buffer. This led to freeing invalid memory."
https://www.cve.org/CVERecord?id=CVE-2019-11930
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 969 SFP Secondary Cluster: Faulty Memory Release 888 2404
MemberOf 1237 SFP Primary Cluster: Faulty Resource Release 888 2482
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
CWE Version 4.14
CWE-764: Multiple Locks of a Critical Resource
CWE-764: Multiple Locks of a Critical Resource