CWE-762 Details

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

Einführungsmodi

Implementation

Anwendbare Plattformen

Sprache

Class: Memory-Unsafe (Often)
Name: C (Undetermined)
Name: C++ (Undetermined)

Häufige Konsequenzen

Mögliche Gegenmaßnahmen

Phases : Implementation
Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
Phases : Implementation
Phases : Architecture and Design
Phases : Architecture and Design
Use a language that provides abstractions for memory allocation and deallocation.

Erkennungsmethoden

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518] or valgrind [REF-480].
Wirksamkeit : Moderate

Hinweise zur Schwachstellen-Zuordnung

Begründung : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Kommentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Hinweise

Referenzen

REF-657

boost C++ Library Smart Pointers
https://www.boost.org/doc/libs/1_38_0/libs/smart_ptr/smart_ptr.htm

REF-480

Valgrind
https://valgrind.org/

REF-391

Transitioning to ARC Release Notes
iOS Developer Library.
https://developer.apple.com/library/archive/releasenotes/ObjectiveC/RN-TransitioningToARC/Introduction/Introduction.html

REF-1518

AddressSanitizer
https://clang.llvm.org/docs/AddressSanitizer.html

Einreichung

Änderungen