1597
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 763 Release of Invalid Pointer or Reference 1599
ParentOf 590 Free of Memory not on the Heap 1326
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Integrity
Availability
Confidentiality
Modify Memory
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
Potential Mitigations
Phase: Implementation
Only call matching memory management functions. Do not mix and match routines. For example,
when you allocate a buffer with malloc(), dispose of the original pointer with free().
Phase: Implementation
Strategy = Libraries or Frameworks
Choose a language or tool that provides automatic memory management, or makes manual
memory management less error-prone. For example, glibc in Linux provides protection
against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic
reference counting (ARC) [REF-391]. To help correctly and consistently manage memory when
programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by
ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming
revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as
Boost.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, glibc in Linux provides
protection against free of invalid pointers.
Phase: Architecture and Design
Use a language that provides abstractions for memory allocation and deallocation.
Phase: Testing
Use a tool that dynamically detects memory management problems, such as valgrind.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-762: Mismatched Memory Management Routines
CWE-762: Mismatched Memory Management Routines