CWE Rule 415
Description
Rule Description
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Polyspace Implementation
The rule checker checks for Deallocation of previously deallocated pointer.
Examples
This issue occurs when a block of memory is freed more than
once using the free
function without an intermediate
allocation.
When a pointer is allocated dynamic memory with malloc
,
calloc
or realloc
, it points to a memory
location on the heap. When you use the free
function on this
pointer, the associated block of memory is freed for reallocation. Trying to free
this block of memory can result in a segmentation fault.
The fix depends on the root cause of the defect. See if you intended to allocate a
memory block to the pointer between the first deallocation and the second.
Otherwise, remove the second free
statement.
As a good practice, after you free a memory block, assign the corresponding pointer to NULL. Before freeing pointers, check them for NULL values and handle the error. In this way, you are protected against freeing an already freed block.
#include <stdlib.h>
void allocate_and_free(void)
{
int* pi = (int*)malloc(sizeof(int));
if (pi == NULL) return;
*pi = 2;
free(pi);
free (pi); //Noncompliant
/* Defect: pi has already been freed */
}
The first free
statement
releases the block of memory that pi
refers to.
The second free
statement on pi
releases
a block of memory that has been freed already.
One possible correction is to remove the second free
statement.
#include <stdlib.h>
void allocate_and_free(void)
{
int* pi = (int*)malloc(sizeof(int));
if (pi == NULL) return;
*pi = 2;
free(pi);
/* Fix: remove second deallocation */
}
#include <stdlib.h>
void reshape(char *buf, size_t size) {
char *reshaped_buf = (char *)realloc(buf, size);
if (reshaped_buf == NULL) {
free(buf); //Noncompliant
}
}
In this example, the argument size
of the reshape()
function can be zero and result in a zero-size reallocation with realloc()
.
In some implementations such as the GNU® library, zero-size reallocations free the memory leading to a double free
defect.
One possible correction is to check size argument of realloc()
for zero values before use. If the size argument is zero, you can simply free the memory instead of reallocating it.
#include <stdlib.h>
void reshape(char *buf, size_t size) {
if (size != 0) {
char *reshaped_buf = (char *)realloc(buf, size);
if (reshaped_buf == NULL) {
free(buf);
}
}
else {
free(buf);
}
}
Check Information
Category: Others |
Version History
Introduced in R2023a
See Also
External Websites
MATLAB Command
You clicked a link that corresponds to this MATLAB command:
Run the command by entering it in the MATLAB Command Window. Web browsers do not support MATLAB commands.
Seleziona un sito web
Seleziona un sito web per visualizzare contenuto tradotto dove disponibile e vedere eventi e offerte locali. In base alla tua area geografica, ti consigliamo di selezionare: .
Puoi anche selezionare un sito web dal seguente elenco:
Come ottenere le migliori prestazioni del sito
Per ottenere le migliori prestazioni del sito, seleziona il sito cinese (in cinese o in inglese). I siti MathWorks per gli altri paesi non sono ottimizzati per essere visitati dalla tua area geografica.
Americhe
- América Latina (Español)
- Canada (English)
- United States (English)
Europa
- Belgium (English)
- Denmark (English)
- Deutschland (Deutsch)
- España (Español)
- Finland (English)
- France (Français)
- Ireland (English)
- Italia (Italiano)
- Luxembourg (English)
- Netherlands (English)
- Norway (English)
- Österreich (Deutsch)
- Portugal (English)
- Sweden (English)
- Switzerland
- United Kingdom (English)